From e0d387099184ef075a748fa9c14044cb74a835b6 Mon Sep 17 00:00:00 2001
From: Konstantin Renner <konstantin@renner.uno>
Date: Sat, 27 Jun 2026 00:09:14 +0200
Subject: [PATCH] netbird-proxy: enable Docker IPv6 so the proxy reaches the
 v6-only mgmt path

The deployed proxy on proxy-1 (v6-only host) couldn't connect to the
management server: 'dial tcp [2a01:...]:443 / 162.55.50.97:443: network is
unreachable'. The host reaches mgmt over v6 fine, but Docker had no IPv6
(no daemon.json), so the container had no v6 egress and no v4 exists.

Add /etc/docker/daemon.json (ipv6 + ULA fixed-cidr-v6 + ip6tables NAT),
flush it (restart docker) before the container deploys, and put the proxy
service on the default bridge (network_mode: bridge) so it inherits that v6.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 ansible/roles/netbird-proxy/handlers/main.yml      |  5 +++++
 ansible/roles/netbird-proxy/tasks/main.yml         | 14 ++++++++++++++
 .../roles/netbird-proxy/templates/daemon.json.j2   |  5 +++++
 .../netbird-proxy/templates/docker-compose.yml.j2  |  3 +++
 4 files changed, 27 insertions(+)
 create mode 100644 ansible/roles/netbird-proxy/templates/daemon.json.j2

diff --git a/ansible/roles/netbird-proxy/handlers/main.yml b/ansible/roles/netbird-proxy/handlers/main.yml
index daf2cb36..536b21db 100644
--- a/ansible/roles/netbird-proxy/handlers/main.yml
+++ b/ansible/roles/netbird-proxy/handlers/main.yml
@@ -1,4 +1,9 @@
 ---
+- name: Restart docker
+  ansible.builtin.systemd:
+    name: docker
+    state: restarted
+
 # Force-recreate so a changed compose file / proxy.env (env_file) is picked
 # up — a plain `restart` would not re-read the env_file.
 - name: Restart netbird proxy
diff --git a/ansible/roles/netbird-proxy/tasks/main.yml b/ansible/roles/netbird-proxy/tasks/main.yml
index bafd85f3..fcff8429 100644
--- a/ansible/roles/netbird-proxy/tasks/main.yml
+++ b/ansible/roles/netbird-proxy/tasks/main.yml
@@ -12,6 +12,20 @@
     - /opt/netbird-proxy/certs
     - /opt/netbird-proxy/state
 
+# proxy-1 is v6-only (no IPv4), and the proxy must reach the management
+# server (netbird.renner.uno) over IPv6. Docker gives containers no IPv6 by
+# default, so enable it on the daemon (ipv6 + ULA + ip6tables NAT); the
+# compose service joins the default bridge so it inherits this v6.
+- name: Enable IPv6 in the Docker daemon
+  ansible.builtin.template:
+    src: daemon.json.j2
+    dest: /etc/docker/daemon.json
+    mode: "0644"
+  notify: Restart docker
+
+- name: Apply the Docker IPv6 config before the container is deployed
+  ansible.builtin.meta: flush_handlers
+
 - name: Deploy docker-compose.yml
   ansible.builtin.template:
     src: docker-compose.yml.j2
diff --git a/ansible/roles/netbird-proxy/templates/daemon.json.j2 b/ansible/roles/netbird-proxy/templates/daemon.json.j2
new file mode 100644
index 00000000..bae2cfc1
--- /dev/null
+++ b/ansible/roles/netbird-proxy/templates/daemon.json.j2
@@ -0,0 +1,5 @@
+{
+  "ipv6": true,
+  "fixed-cidr-v6": "fd00:dead:beef::/64",
+  "ip6tables": true
+}
diff --git a/ansible/roles/netbird-proxy/templates/docker-compose.yml.j2 b/ansible/roles/netbird-proxy/templates/docker-compose.yml.j2
index 2a3c8e14..9d6b0268 100644
--- a/ansible/roles/netbird-proxy/templates/docker-compose.yml.j2
+++ b/ansible/roles/netbird-proxy/templates/docker-compose.yml.j2
@@ -8,6 +8,9 @@ services:
     image: netbirdio/reverse-proxy:{{ netbird_version }}
     container_name: netbird-proxy
     restart: unless-stopped
+    # Join the default bridge (which carries the daemon.json fixed-cidr-v6),
+    # so the container gets IPv6 egress to reach the v6-only management path.
+    network_mode: bridge
     env_file:
       - ./proxy.env
     ports:
-- 
2.54.0