ansible/roles/netbird-proxy/handlers/main.yml

@@ -1,4 +1,9 @@
 ---
+- name: Restart docker
+  ansible.builtin.systemd:
+    name: docker
+    state: restarted
+
 # Force-recreate so a changed compose file / proxy.env (env_file) is picked
 # up — a plain `restart` would not re-read the env_file.
 - name: Restart netbird proxy

ansible/roles/netbird-proxy/tasks/main.yml

@@ -12,6 +12,20 @@
     - /opt/netbird-proxy/certs
     - /opt/netbird-proxy/state
 
+# proxy-1 is v6-only (no IPv4), and the proxy must reach the management
+# server (netbird.renner.uno) over IPv6. Docker gives containers no IPv6 by
+# default, so enable it on the daemon (ipv6 + ULA + ip6tables NAT); the
+# compose service joins the default bridge so it inherits this v6.
+- name: Enable IPv6 in the Docker daemon
+  ansible.builtin.template:
+    src: daemon.json.j2
+    dest: /etc/docker/daemon.json
+    mode: "0644"
+  notify: Restart docker
+
+- name: Apply the Docker IPv6 config before the container is deployed
+  ansible.builtin.meta: flush_handlers
+
 - name: Deploy docker-compose.yml
   ansible.builtin.template:
     src: docker-compose.yml.j2

ansible/roles/netbird-proxy/templates/daemon.json.j2

@@ -0,0 +1,5 @@
+{
+  "ipv6": true,
+  "fixed-cidr-v6": "fd00:dead:beef::/64",
+  "ip6tables": true
+}

ansible/roles/netbird-proxy/templates/docker-compose.yml.j2

@@ -8,6 +8,9 @@ services:
     image: netbirdio/reverse-proxy:{{ netbird_version }}
     container_name: netbird-proxy
     restart: unless-stopped
+    # Join the default bridge (which carries the daemon.json fixed-cidr-v6),
+    # so the container gets IPv6 egress to reach the v6-only management path.
+    network_mode: bridge
     env_file:
       - ./proxy.env
     ports: