From 3803a0962e3130579532963031060292f6e6e08f Mon Sep 17 00:00:00 2001 From: Konstantin Renner Date: Sat, 27 Jun 2026 07:00:52 +0200 Subject: [PATCH] netbird-proxy: named volume for /var/lib/netbird too (state write perms) Same root-owned-bind-mount issue as /certs: the non-root proxy couldn't write netbird state ('failed to write active profile state / geolocation: permission denied'). Use a named volume for /var/lib/netbird as well. Co-Authored-By: Claude Opus 4.8 (1M context) --- .../roles/netbird-proxy/templates/docker-compose.yml.j2 | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/ansible/roles/netbird-proxy/templates/docker-compose.yml.j2 b/ansible/roles/netbird-proxy/templates/docker-compose.yml.j2 index d86ff4a7..695311ef 100644 --- a/ansible/roles/netbird-proxy/templates/docker-compose.yml.j2 +++ b/ansible/roles/netbird-proxy/templates/docker-compose.yml.j2 @@ -16,10 +16,11 @@ services: ports: - "443:443" volumes: - # Named volume (like VPS-1) — inherits the image's writable ownership so - # the non-root proxy can write ACME certs. A root-owned bind mount can't. + # Named volumes — they inherit the image's writable ownership, so the + # non-root proxy can write certs + netbird state. Root-owned bind mounts + # can't (permission denied on /certs and /var/lib/netbird). - netbird_proxy_certs:/certs - - /opt/netbird-proxy/state:/var/lib/netbird + - netbird_proxy_state:/var/lib/netbird logging: driver: "json-file" options: @@ -28,3 +29,4 @@ services: volumes: netbird_proxy_certs: + netbird_proxy_state: -- 2.54.0