netbird-proxy: add a second reverse-proxy HA cluster member (proxy-1) #47

2026-06-26T11:24:38Z

k.renner commented

2026-06-26 11:24:38 +00:00

Edge HA for the public ingress: a second netbirdio/reverse-proxy running on proxy-1 (Netcup) as a NetBird proxy-cluster member, so a single proxy-host failure no longer drops the public edge. NetBird forms an HA cluster from instances sharing the same NB_PROXY_DOMAIN; client traffic is distributed by DNS round-robin (upstream docs).

New netbird-proxy role (proxy-only host): just the reverse-proxy container bound to :443 — no Traefik, since nothing else on this host competes for the port. NB_PROXY_DOMAIN=proxy.renner.uno (matches VPS-1), its own per-instance token, enrolls against https://netbird.renner.uno. Independent ACME (option A) — each member issues its own tls-alpn-01 certs, so VPS-1's working proxy is untouched. Reuses docker-install; deploys via the new deploy-netbird-proxy pipeline.

Gated on human prereqs (also in the play header)

Token: generate proxy-1's token on the management server, add vault_netbird_proxy1_token to the ansible vault:

docker exec -it netbird-management netbird-server token create --name proxy-1 --config /var/lib/netbird/config.yaml

Host: proxy-1.renner.uno on Ubuntu, root SSH reachable, DNS A/AAAA for its own name → its IP.
After deploy + verify: repoint proxy.renner.uno from its CNAME netbird.renner.uno (management host) to A/AAAA records listing BOTH proxy IPs (VPS-1 + proxy-1) so traffic round-robins across the cluster.

⚠️ netbird_version in the role MUST stay in sync with netbird-server (same proxy-cluster release line).

Verification after rollout: proxy-1 enrolls (dashboard + docker logs netbird-proxy), issues its own certs once it's in the round-robin, and serves all 8 names; then drop one proxy and confirm the other still serves.

🤖 Generated with Claude Code

Edge HA for the public ingress: a second `netbirdio/reverse-proxy` running on **proxy-1** (Netcup) as a NetBird **proxy-cluster member**, so a single proxy-host failure no longer drops the public edge. NetBird forms an HA cluster from instances sharing the same `NB_PROXY_DOMAIN`; client traffic is distributed by **DNS round-robin** ([upstream docs](https://docs.netbird.io/selfhosted/maintenance/scaling/multiple-proxy-instances)). **New `netbird-proxy` role** (proxy-only host): just the reverse-proxy container bound to `:443` — no Traefik, since nothing else on this host competes for the port. `NB_PROXY_DOMAIN=proxy.renner.uno` (matches VPS-1), its **own** per-instance token, enrolls against `https://netbird.renner.uno`. **Independent ACME (option A)** — each member issues its own `tls-alpn-01` certs, so **VPS-1's working proxy is untouched**. Reuses `docker-install`; deploys via the new `deploy-netbird-proxy` pipeline. ### Gated on human prereqs (also in the play header) 1. **Token:** generate proxy-1's token on the management server, add `vault_netbird_proxy1_token` to the ansible vault: ``` docker exec -it netbird-management netbird-server token create --name proxy-1 --config /var/lib/netbird/config.yaml ``` 2. **Host:** `proxy-1.renner.uno` on Ubuntu, root SSH reachable, DNS A/AAAA for its own name → its IP. 3. **After deploy + verify:** repoint `proxy.renner.uno` from its `CNAME netbird.renner.uno` (management host) to **A/AAAA records listing BOTH proxy IPs** (VPS-1 + proxy-1) so traffic round-robins across the cluster. ⚠️ `netbird_version` in the role MUST stay in sync with `netbird-server` (same proxy-cluster release line). Verification after rollout: proxy-1 enrolls (dashboard + `docker logs netbird-proxy`), issues its own certs once it's in the round-robin, and serves all 8 names; then drop one proxy and confirm the other still serves. 🤖 Generated with Claude Code

k.renner added 1 commit 2026-06-26 11:24:39 +00:00

netbird-proxy: add a second reverse-proxy HA cluster member (proxy-1)

ci/woodpecker/push/deploy-netbird-proxy Pipeline failed

Details

8db4762d33

Edge HA for the public ingress: run a second netbirdio/reverse-proxy as a
NetBird proxy-cluster member on proxy-1 (Netcup), so a proxy-host failure
no longer takes the public edge down. NetBird forms an HA cluster from
instances sharing the same NB_PROXY_DOMAIN; traffic is distributed by DNS
round-robin across the members.

  https://docs.netbird.io/selfhosted/maintenance/scaling/multiple-proxy-instances

New `netbird-proxy` role (proxy-only host): just the reverse-proxy
container bound to :443 (no Traefik — nothing else competes for the port),
NB_PROXY_DOMAIN=proxy.renner.uno (matches VPS-1), its OWN per-instance
token, enrolling against https://netbird.renner.uno. Independent ACME
(option A) — each member issues its own tls-alpn-01 certs, so VPS-1's
working proxy is untouched. Reuses the docker-install role; deploy via the
deploy-netbird-proxy woodpecker pipeline.

Deployment is GATED on human prereqs (documented in the play):
  1. Generate proxy-1's token on the management server and add
     vault_netbird_proxy1_token to the ansible vault.
  2. proxy-1.renner.uno: Ubuntu + root SSH, DNS for its own name -> its IP.
  3. AFTER deploy + verify: repoint proxy.renner.uno from its CNAME to
     netbird.renner.uno (management host) to A/AAAA records listing BOTH
     proxy IPs, so traffic round-robins across the cluster.

netbird_version in the role MUST be kept in sync with netbird-server.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

k.renner added 1 commit 2026-06-26 11:30:02 +00:00

netbird-proxy: make the deploy Arch-native (proxy-1 runs Arch)

ci/woodpecker/push/deploy-netbird-proxy Pipeline failed

Details

6b18c80668

proxy-1 is Arch Linux, where the apt-based docker-install/common roles
fail. Make the netbird-proxy role self-contained: install Docker via the
OS package manager (pacman on Arch, apt on Debian) + enable the service,
and drop common/docker-install from the play.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

k.renner added 1 commit 2026-06-26 11:35:41 +00:00

docker-install: make Arch-aware; netbird-proxy reuses the shared roles

ci/woodpecker/push/deploy-netbird-proxy Pipeline failed

Details

61ed0a4b23

Rather than reinventing docker install inside netbird-proxy, extend the
shared docker-install role to support Arch (proxy-1 runs Arch): guard the
existing apt/Docker-repo tasks with os_family == Debian and add an Arch
branch (package: docker, docker-compose). service enable + docker group
stay OS-agnostic. Debian hosts (netbird-server) are unaffected.

netbird-proxy drops its inline docker tasks; the play goes back to the
standard common + docker-install + netbird-proxy role stack.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

k.renner referenced this issue from a commit

2026-06-26 11:49:46 +00:00

woodpecker-agent: enable IPv6 in the Docker daemon

k.renner referenced this pull request

2026-06-26 11:50:31 +00:00

woodpecker-agent: enable IPv6 in the Docker daemon (so CI can reach v6 hosts) #48

k.renner merged commit 05cf7ceb5f into master

2026-06-26 12:01:14 +00:00

k.renner referenced this issue from a commit

2026-06-26 12:01:14 +00:00

Merge pull request 'netbird-proxy: add a second reverse-proxy HA cluster member (proxy-1)' (#47) from netbird-proxy-ha into master

k.renner referenced this pull request