From f91234c8fb70a3e0459afcbc58cd75b01bfe1f89 Mon Sep 17 00:00:00 2001 From: mates Date: Sat, 1 Aug 2026 20:51:01 +0200 Subject: [PATCH] fix: NetBird je samostatna aplikace (apt balicek), ne Docker sluzba roles/netbird/tasks/main.yml: - apt balicek 'netbird' (oficialni NetBird Linux klient) - neni Docker, neni sluzba - je to VPN klient roles/netbird/defaults/main.yml: - odebrano netbird_run_as_system_service (nepotreba) - pridana poznamka o instalaci playbook priprav-novy-server.yml: - hlavicka: 'NetBird (mesh VPN klient - apt balicek, NE Docker)' group_vars/all.yml.example: - pridana dokumentace https://docs.netbird.io/get-started/install - komentare rikaji, ze to neni Docker sluzba README.md: - tabulka roli: 'apt balicek, ne Docker' - krok 8: 'NetBird (mesh VPN klient - apt balicek)' Postup instalace: - Linux server: ansible role -> apt install netbird - macOS workstation: brew install --cask netbird (v Brewfile) - Windows: instalator z netbird.io - Registrace: netbird up --setup-key (z app.netbird.io) --- README.md | 4 ++-- group_vars/all.yml.example | 12 +++++++++--- playbooks/priprav-novy-server.yml | 4 ++-- roles/netbird/defaults/main.yml | 20 +++++++++++++------- roles/netbird/tasks/main.yml | 24 ++++++++++++++++-------- 5 files changed, 42 insertions(+), 22 deletions(-) diff --git a/README.md b/README.md index 60cc020..049c777 100644 --- a/README.md +++ b/README.md @@ -44,7 +44,7 @@ a Ansible to udělá **na všech serverech** najednou. | `ssh-klice` | Nasadí SSH klíč pro `deploy` (heslo = klíč, ne heslo) | | `docker` | Docker Engine + Compose plugin + nastavení daemon.json | | `adresare` | `/home/deploy/{docker,scripts,backups,logs,~/.local/bin}` + 14 složek pro služby | -| `netbird` | Nainstaluje NetBird (mesh VPN klient) a registruje přes setup key | +| `netbird` | Nainstaluje NetBird klienta (mesh VPN) – apt balíček, ne Docker | ### ⚙️ Konfigurace @@ -134,7 +134,7 @@ ansible-playbook -i inventory.yml playbooks/priprav-novy-server.yml 7. ✅ Nainstaluje Docker Engine + Compose plugin 8. ✅ Přidá `deploy` do `docker` group (docker **bez sudo**) 7. ✅ Vytvoří adresářovou strukturu pro 14 Docker služeb -8. ✅ Nainstaluje NetBird (mesh VPN) a registruje přes setup key +8. ✅ Nainstaluje NetBird (mesh VPN klient – apt balíček) 9. ✅ Nainstaluje fail2ban (ochrana proti brute-force SSH) **Trvání:** 5-10 minut. diff --git a/group_vars/all.yml.example b/group_vars/all.yml.example index feb3feb..9bfd42d 100644 --- a/group_vars/all.yml.example +++ b/group_vars/all.yml.example @@ -19,13 +19,19 @@ deploy_ssh_public_keys: - "ssh-ed25519 AAAAC3Nz... hermes@mac" # <-- nahrad svym klicem # ============================================ -# NETBIRD (mesh VPN - klient) +# NETBIRD (mesh VPN - samostatna aplikace) # ============================================ +# NetBird je WireGuard-based mesh VPN klient. +# Ne Docker sluzba - instaluje se jako apt balicek (Linux) nebo brew cask (mac). +# Dokumentace: https://docs.netbird.io/get-started/install +# # Setup key z NetBird dashboardu: https://app.netbird.io/ -> Setup Keys # Napr: AAAA-BBBB-CCCC-DDDD-EEEE -# Prazdne = NetBird se nainstaluje ale nezaregistruje (setup rucne) +# +# Pokud je prazdne, NetBird se pouze nainstaluje - registraci provedes rucne: +# sudo netbird up --setup-key +# netbird_setup_key: "" -netbird_run_as_system_service: true netbird_management_url: "https://api.netbird.io" # ============================================ diff --git a/playbooks/priprav-novy-server.yml b/playbooks/priprav-novy-server.yml index c56077f..adeca3a 100644 --- a/playbooks/priprav-novy-server.yml +++ b/playbooks/priprav-novy-server.yml @@ -9,7 +9,7 @@ # 5. Docker Engine + Compose plugin # 6. Uzivatel deploy v docker group (docker bez sudo) # 7. Adresarova struktura (/home/deploy/{docker,scripts,backups,logs,...}) -# 8. NetBird (mesh VPN - klient + setup key) +# 8. NetBird (mesh VPN klient - apt balicek, NE Docker) # 9. fail2ban (SSH jail) # # Poznamka: firewall (UFW) se nenastavuje - podle pozadavku uzivatele. @@ -113,7 +113,7 @@ SSH pristup: deploy@{{ ansible_host | default(inventory_hostname) }}:{{ ssh_port }} Docker: docker --version (bez sudo) - NetBird: netbird status (mesh VPN) + NetBird: netbird status (mesh VPN klient, ne Docker) Sluzby: /home/{{ deploy_user }}/docker// Dalsi kroky: diff --git a/roles/netbird/defaults/main.yml b/roles/netbird/defaults/main.yml index 0030bca..2a2efc6 100644 --- a/roles/netbird/defaults/main.yml +++ b/roles/netbird/defaults/main.yml @@ -1,15 +1,21 @@ --- # Promenne pro netbird roli -# NetBird - WireGuard-based mesh VPN (https://netbird.io) - -# Setup klice pro NetBird registraci +# NetBird - WireGuard-based mesh VPN klient (https://netbird.io) +# +# POZNAMKA: NetBird je samostatna aplikace (klient), NE Docker sluzba. +# - Linux: instaluje se jako apt balicek (netbird) +# - macOS: instaluje se pres brew cask (netbird) +# - Windows: instalator z netbird.io +# Viz: https://docs.netbird.io/get-started/install +# +# Setup key pro automatickou registraci (po prvnim spusteni). # Najdes v NetBird dashboardu: https://app.netbird.io/ -> Setup Keys # Napr: AAAA-BBBB-CCCC-DDDD-EEEE +# +# Pokud je prazdne, NetBird se pouze nainstaluje - registraci provedes rucne: +# netbird up --setup-key +# netbird_setup_key: "" -# NetBird spust jako systemova sluzba (root) -# Pro user-level: netbird up --setup-key XXX (interaktivni) -netbird_run_as_system_service: true - # Vychozi Management Server (self-hosted nebo oficialni) netbird_management_url: "https://api.netbird.io" diff --git a/roles/netbird/tasks/main.yml b/roles/netbird/tasks/main.yml index c63234d..88f997f 100644 --- a/roles/netbird/tasks/main.yml +++ b/roles/netbird/tasks/main.yml @@ -1,19 +1,19 @@ --- -- name: Stahnout NetBird GPG klic +- name: Stahnout NetBird GPG klic (oficialni repo) ansible.builtin.get_url: url: https://pkgs.netbird.io/deb/public.key dest: /etc/apt/keyrings/netbird.asc mode: "0644" force: true -- name: Pridat NetBird repo +- name: Pridat NetBird APT repo ansible.builtin.apt_repository: repo: "deb [signed-by=/etc/apt/keyrings/netbird.asc] https://pkgs.netbird.io/deb stable main" filename: netbird state: present update_cache: true -- name: Nainstalovat NetBird +- name: Nainstalovat NetBird klienta (apt balicek) ansible.builtin.apt: name: - netbird @@ -27,11 +27,12 @@ - ansible.builtin.debug: msg: "NetBird nainstalovan: {{ netbird_version_output.stdout }}" -- name: Spust NetBird s setup key (system service) - ansible.builtin.command: netbird up --setup-key {{ netbird_setup_key }} --management-url {{ netbird_management_url }} - when: - - netbird_setup_key | length > 0 - - netbird_run_as_system_service | bool +- name: Registrace NetBird pomoci setup key (volitelne) + ansible.builtin.command: > + netbird up + --setup-key {{ netbird_setup_key }} + --management-url {{ netbird_management_url }} + when: netbird_setup_key | length > 0 register: netbird_up_result changed_when: netbird_up_result.rc == 0 failed_when: false @@ -44,3 +45,10 @@ - ansible.builtin.debug: msg: "NetBird status: {{ netbird_status_output.stdout }}" when: netbird_setup_key | length > 0 +- ansible.builtin.debug: + msg: > + NetBird nainstalovan, ale nezaregistrovany. + Pro registraci spust rucne: + sudo netbird up --setup-key + Dashboard: https://app.netbird.io/ + when: netbird_setup_key | length == 0