From facbb859ada8bcbaf103a64165d968213ebe5f73 Mon Sep 17 00:00:00 2001 From: Konstantin Renner Date: Sat, 27 Jun 2026 12:05:00 +0200 Subject: [PATCH] netbird-server: drop vestigial reverse-SSH tunnel The netbird-tunnel.service.j2 reverse-SSH tunnel template was never instantiated by any task in the role, and its target netbird_auth_ingress_host=10.2.45.100 was the Caddy HA keepalived VIP, destroyed in PR #70. The VPS reaches homelab auth over the NetBird mesh now (netbird-ingress DaemonSet -> Traefik fd99::86), so the tunnel is dead. Remove the template and its only-consumer vars (netbird_auth_tunnel_port/ingress_host/ingress_port, netbird_tunnel_ssh_key). Co-Authored-By: Claude Opus 4.8 (1M context) --- .../roles/netbird-server/defaults/main.yml | 8 ------ .../templates/netbird-tunnel.service.j2 | 28 ------------------- 2 files changed, 36 deletions(-) delete mode 100644 ansible/roles/netbird-server/templates/netbird-tunnel.service.j2 diff --git a/ansible/roles/netbird-server/defaults/main.yml b/ansible/roles/netbird-server/defaults/main.yml index 10de9b4b..3b0cfc88 100644 --- a/ansible/roles/netbird-server/defaults/main.yml +++ b/ansible/roles/netbird-server/defaults/main.yml @@ -16,14 +16,6 @@ netbird_auth_audience: "qrCjbsFeOO32kXOVwF8OrunzettalsMJ5GoOKJAR" netbird_auth_client_id: "qrCjbsFeOO32kXOVwF8OrunzettalsMJ5GoOKJAR" netbird_auth_client_secret: "{{ vault_netbird_auth_client_secret }}" netbird_auth_issuer: "https://auth.renner.uno/application/o/netbird/" -netbird_auth_tunnel_port: 8443 - -# Homelab ingress for tunnel -netbird_auth_ingress_host: "10.2.45.100" -netbird_auth_ingress_port: 443 - -# Tunnel SSH key path (on tunnel host) -netbird_tunnel_ssh_key: "/root/.ssh/netbird_tunnel_key" # TURN server credentials netbird_turn_secret: "{{ vault_netbird_turn_secret }}" diff --git a/ansible/roles/netbird-server/templates/netbird-tunnel.service.j2 b/ansible/roles/netbird-server/templates/netbird-tunnel.service.j2 deleted file mode 100644 index f6e5b9a5..00000000 --- a/ansible/roles/netbird-server/templates/netbird-tunnel.service.j2 +++ /dev/null @@ -1,28 +0,0 @@ -[Unit] -Description=NetBird Auth SSH Tunnel (autossh) -Documentation=https://netbird.io -After=network-online.target -Wants=network-online.target - -[Service] -Type=simple -Environment="AUTOSSH_GATETIME=0" -Environment="AUTOSSH_POLL=30" -Environment="AUTOSSH_LOGLEVEL=7" - -# Reverse tunnel: VPS:{{ netbird_auth_tunnel_port }} -> homelab ingress:{{ netbird_auth_ingress_port }} -# This allows VPS containers to reach auth.renner.uno via localhost:{{ netbird_auth_tunnel_port }} -ExecStart=/usr/bin/autossh -M 0 -N \ - -o "ServerAliveInterval=30" \ - -o "ServerAliveCountMax=3" \ - -o "ExitOnForwardFailure=yes" \ - -o "StrictHostKeyChecking=accept-new" \ - -i {{ netbird_tunnel_ssh_key }} \ - -R {{ netbird_auth_tunnel_port }}:{{ netbird_auth_ingress_host }}:{{ netbird_auth_ingress_port }} \ - {{ netbird_server_user }}@{{ netbird_server_host }} - -Restart=always -RestartSec=10 - -[Install] -WantedBy=multi-user.target -- 2.54.0