Nix Podman Stacks

Appearance

netbird-management ​

Self-hosted NetBird management server and dashboard

Example ​

nix
{config, ...}: {
  nps.stacks.netbird-management = {
    enable = true;
    authSecretFile = config.sops.secrets."netbird/auth_secret".path;
    storeEncryptionKeyFile = config.sops.secrets."netbird/encryption_key".path;
    adminProvisioning = {
      email = "admin@example.com";
      passwordFile = config.sops.secrets."netbird/admin_password".path;
    };
    oidc = {
      enable = true;
      clientSecretFile = config.sops.secrets."netbird/authelia/client_secret".path;
    };
  };
}

adminProvisioning creates the initial owner only while NetBird setup is incomplete. oidc.enable configures the Authelia client in Nix and registers the provider during initial setup. The setup API is only available before setup completes, so enabling OIDC later will not register the provider. Manage later provider changes in the NetBird web UI. Keep OIDC enabled in Nix to retain its Authelia client configuration.

See the NetBird client stack to enroll peers.

Stack Options ​

nps.stacks.netbird-management.adminProvisioning.email ​

Email for the initial NetBird owner account.

Type
plaintext
string
Declaration
<nps/modules/netbird-management>

nps.stacks.netbird-management.adminProvisioning.name ​

Display name for the initial NetBird owner account.

Type
plaintext
string
Default
nix
"NetBird Admin"
Declaration
<nps/modules/netbird-management>

nps.stacks.netbird-management.adminProvisioning.passwordFile ​

File containing the initial NetBird owner password.

Type
plaintext
absolute path
Declaration
<nps/modules/netbird-management>

nps.stacks.netbird-management.authSecretFile ​

File containing the relay authentication secret.

Type
plaintext
absolute path
Declaration
<nps/modules/netbird-management>

nps.stacks.netbird-management.enable ​

Whether to enable netbird-management.

Type
plaintext
boolean
Default
nix
false
Example
nix
true
Declaration
<nps/modules/netbird-management>

nps.stacks.netbird-management.oidc.clientSecretFile ​

The file containing the client secret for the OIDC client that will be registered in Authelia.

For examples on how to generate a client secret, see

https://www.authelia.com/integration/openid-connect/frequently-asked-questions/#client-secret

Type
plaintext
absolute path
Example
nix
config.sops.secrets."immich/authelia/client_secret".path"
Declaration
<nps/modules/netbird-management>

nps.stacks.netbird-management.oidc.clientSecretHash ​

The client secret hash. For examples on how to generate a client secret, see https://www.authelia.com/integration/openid-connect/frequently-asked-questions/#client-secret

The value can be passed in multiple ways:

  1. As a literal string
  2. As an absolute path to a file containing the hash (toFile)
  3. As an absolute oath to a file containing the client_secret, in which case the hash will be automatically computed (toHash)
  4. As null

If left unset (null), the client secret will be read from the file specified in the clientSecretFile option and hashed automatically before being passed to the Authelia container.

Type
plaintext
null or string or (submodule)
Default
nix
null
Example
nix
# Literal String:
"$pbkdf2-sha512$310000$cbOAIWbfz3vCVXIPIp6d2A$J0klwULa6TvPRCU1HAfuKua/dMKTl8gbTYJz2N73ejGUu0LUGz/y3kwmJLuKuAYGg3WQOT0q9ZzVHHUvpKpgvQ"

# Client secret hash stored in a file
{ fromFile = config.sops.secrets."immich/client_secret_hash".path; }

# Client secret stored in a file: Hash will be computed dynamically
{ toHash = config.sops.secrets."immich/client_secret".path; }

# Null (default): Hash will be computed automatically based on the clientSecretFile option
# Equivalent to { toHash = cfg.oidc.clientSecretFile; }
null
Declaration
<nps/modules/netbird-management>

nps.stacks.netbird-management.oidc.enable ​

Enable Authelia OIDC integration. The provider is registered only during NetBird's initial setup.

Type
plaintext
boolean
Default
nix
false
Declaration
<nps/modules/netbird-management>

nps.stacks.netbird-management.oidc.userGroup ​

Group allowed to log in.

Type
plaintext
string
Default
nix
"netbird-management_user"
Declaration
<nps/modules/netbird-management>

nps.stacks.netbird-management.settings ​

NetBird server settings, templated with gomplate.

Type
plaintext
YAML 1.1 value
Default
nix
null
Declaration
<nps/modules/netbird-management>

nps.stacks.netbird-management.storeEncryptionKeyFile ​

File containing the 32-byte encryption key for stored data.

Type
plaintext
absolute path
Declaration
<nps/modules/netbird-management>

Container Aliases ​

nps.stacks.netbird-management.containers.netbird-management-dashboard ​

Alias of {option}services.podman.containers.netbird-management-dashboard.

Type
plaintext
submodule
Declaration
<nps/modules/netbird-management>

nps.stacks.netbird-management.containers.netbird-management-server ​

Alias of {option}services.podman.containers.netbird-management-server.

Type
plaintext
submodule
Declaration
<nps/modules/netbird-management>