From 8f04f5a3887725844caa289a77c49e273b1457d9 Mon Sep 17 00:00:00 2001 From: Konstantin Renner Date: Sat, 27 Jun 2026 06:57:30 +0200 Subject: [PATCH] netbird-proxy: use a named volume for /certs so ACME can write The proxy runs non-root; a root-owned bind mount (/opt/netbird-proxy/certs) was unwritable ('open lock file ...: permission denied'), which would block cert issuance once the host gets traffic. Switch to a named volume like VPS-1, which inherits the image's writable ownership. Co-Authored-By: Claude Opus 4.8 (1M context) --- .../roles/netbird-proxy/templates/docker-compose.yml.j2 | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/ansible/roles/netbird-proxy/templates/docker-compose.yml.j2 b/ansible/roles/netbird-proxy/templates/docker-compose.yml.j2 index 9d6b0268..d86ff4a7 100644 --- a/ansible/roles/netbird-proxy/templates/docker-compose.yml.j2 +++ b/ansible/roles/netbird-proxy/templates/docker-compose.yml.j2 @@ -16,10 +16,15 @@ services: ports: - "443:443" volumes: - - /opt/netbird-proxy/certs:/certs + # Named volume (like VPS-1) — inherits the image's writable ownership so + # the non-root proxy can write ACME certs. A root-owned bind mount can't. + - netbird_proxy_certs:/certs - /opt/netbird-proxy/state:/var/lib/netbird logging: driver: "json-file" options: max-size: "500m" max-file: "2" + +volumes: + netbird_proxy_certs: -- 2.54.0