From 5fa8c0382749538c036825089e878810c847f8e4 Mon Sep 17 00:00:00 2001 From: Claude Bot Date: Sun, 26 Jul 2026 07:41:10 +0200 Subject: [PATCH] hotfix(netbird-proxy): allow non-root :443 bind on the host network MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The host-network switch (#406) broke both proxy members: the reverse-proxy runs as a non-root user, and on the host netns the default ip_unprivileged_port_start=1024 denies binding :443 — the container crash-loops with 'listen tcp :443: bind: permission denied'. In bridge mode Docker set the sysctl to 0 inside the container netns, which is why the published-port setup never hit this. Set net.ipv4.ip_unprivileged_port_start=443 persistently on the proxy hosts (governs v6 binds too, despite the name). The crash-looping container self-heals within its restart backoff once the sysctl lands. Co-Authored-By: Claude Fable 5 --- ansible/roles/netbird-proxy/tasks/main.yml | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) diff --git a/ansible/roles/netbird-proxy/tasks/main.yml b/ansible/roles/netbird-proxy/tasks/main.yml index 8465bcdf..e4bf59bc 100644 --- a/ansible/roles/netbird-proxy/tasks/main.yml +++ b/ansible/roles/netbird-proxy/tasks/main.yml @@ -28,6 +28,22 @@ - name: Apply the Docker IPv6 config before the container is deployed ansible.builtin.meta: flush_handlers +# The reverse-proxy runs host-network as a non-root user, so binding :443 +# requires the host to permit unprivileged low ports. In bridge mode Docker +# set ip_unprivileged_port_start=0 inside the container netns, which is why +# the published-port setup never hit this; on the host netns the default +# (1024) applies and the proxy crash-loops with "listen tcp :443: bind: +# permission denied" (both members down, hit live 2026-07-26). Despite the +# ipv4 name the sysctl governs v6 binds too. 443 is the lowest port any +# host-network service on these single-purpose hosts needs. +- name: Allow unprivileged bind to :443 (host-network proxy runs non-root) + ansible.posix.sysctl: + name: net.ipv4.ip_unprivileged_port_start + value: "443" + sysctl_file: /etc/sysctl.d/90-netbird-proxy.conf + state: present + reload: true + # Deliberately does NOT notify "Restart netbird proxy". The "Start # netbird-proxy" task below runs `docker compose up -d` on every pass, which # already recreates exactly those services whose definition changed. Notifying -- 2.54.0