claude-botandClaude Opus 5.5
adbfd3bfc6
The public edge is proxy-1/proxy-2; proxy.renner.uno has not pointed at netbird.renner.uno since the netcup fleet took over. The proxy that kept running on the management host has served nothing since the controller moved every service to TLS passthrough (2026-09-07): passthrough routes live on the proxy's own :443 listener, while the host's Traefik forwards HostSNI(*) to its :8443 main listener, which answers "unknown domain". Its watchdog therefore failed every probe round and ran `docker restart` every ~3 minutes since 2026-09-07 12:53 (last healthy round). Each restart registered a fresh proxy peer and pushed a network-map update to every peer in the mesh — ~10 stale proxy-* identities per ingress peer and a map update every 1-2 minutes. - netbird-server: drop the proxy service, its Traefik TCP passthrough, proxy.env and the proxy vars; `compose up --remove-orphans` removes the container, and one-off tasks stop/remove both watchdogs and delete the proxy volumes, config and state. - install-netbird-server.yml no longer applies netbird-proxy-watchdog; its pipeline no longer triggers on that role. - Comments that described the management host as a cluster member now describe the proxy hosts only. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
32 lines
1.4 KiB
YAML
32 lines
1.4 KiB
YAML
---
|
|
# Deploy the NetBird reverse-proxy HA cluster members (the public edge).
|
|
# Usage: ansible-playbook -i inventory/ plays/install-netbird-proxy.yml
|
|
#
|
|
# Prerequisites:
|
|
# - Proxy VPS provisioned (proxy-1 is Arch Linux), root SSH reachable, and
|
|
# listed under [netbird_proxy] in inventory/pve_hosts.yml. Docker is
|
|
# installed by the (Arch-aware) docker-install role.
|
|
# - DNS A/AAAA for the host's own name (e.g. proxy-1.renner.uno) -> its IP.
|
|
# - Uses the existing vault_netbird_proxy_token (shared by every member) — no
|
|
# new token to generate; a shared token + same NB_PROXY_DOMAIN forms the
|
|
# cluster.
|
|
# - AFTER deploy + verify: add this host's A/AAAA to proxy.renner.uno so
|
|
# traffic round-robins across the cluster.
|
|
|
|
- name: Deploy NetBird reverse-proxy cluster member
|
|
hosts: netbird_proxy
|
|
# Roll through cluster members one at a time. proxy.renner.uno round-robins
|
|
# across every member, so restarting them in parallel takes the whole proxy
|
|
# cluster down at once and defeats the point of running more than one.
|
|
serial: 1
|
|
become: true
|
|
roles:
|
|
- common
|
|
- docker-install
|
|
- netbird-proxy
|
|
- netbird-proxy-watchdog
|
|
# Enforces the cluster's CrowdSec decisions here, where public traffic
|
|
# enters. Deployed in dry-run: it logs what it would block and creates no
|
|
# nftables rules until crowdsec_bouncer_mode is flipped per host.
|
|
- crowdsec-edge-bouncer
|