You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
55 lines
2.5 KiB
55 lines
2.5 KiB
[Unit]
|
|
Description=NetBird Management Service
|
|
Documentation=https://docs.netbird.io/selfhosted/selfhosted-guide
|
|
After=network.target var-lib-virtiofs-data.mount postgresql.target
|
|
Requires=var-lib-virtiofs-data.mount
|
|
Wants=postgresql.target
|
|
|
|
# Only start once NetBird has been configured. management.json carries the OIDC settings,
|
|
# the TURN/relay secrets and the data-store encryption key; management.env carries the
|
|
# PostgreSQL DSN (with the database password). Half-configured must not start.
|
|
ConditionPathExists=/etc/quadlets/netbird/management.json
|
|
ConditionPathExists=/etc/quadlets/netbird/management.env
|
|
|
|
# Start/stop this unit when the target is started/stopped
|
|
PartOf=netbird.target
|
|
|
|
[Container]
|
|
ContainerName=netbird-management
|
|
Image=netbird-management.image
|
|
AutoUpdate=registry
|
|
|
|
# No need for root privileges: the management server binds 33073 (> 1024) as UID 10035.
|
|
# It reaches PostgreSQL over host networking on 127.0.0.1:5432, which is why it does not
|
|
# use a separate network namespace (the loopback convention across this repository).
|
|
User=10035
|
|
Group=10000
|
|
Network=host
|
|
|
|
# PostgreSQL DSN (NETBIRD_STORE_ENGINE_POSTGRES_DSN) is injected here so the password is
|
|
# not baked into the world-readable management.json.
|
|
EnvironmentFile=/etc/quadlets/netbird/management.env
|
|
|
|
# Configuration (read-only) and the management data directory (precious: it holds key
|
|
# material that peers pin, so it lives on the virtiofs mount).
|
|
Volume=/etc/quadlets/netbird/management.json:/etc/netbird/management.json:ro,Z
|
|
Volume=/var/lib/virtiofs/data/netbird/management:/var/lib/netbird:z
|
|
|
|
# The image entrypoint is "netbird-mgmt management"; Exec provides the arguments.
|
|
# Management serves the HTTP API and gRPC (ManagementService) on the SAME port 33073 via
|
|
# HTTP/2; Traefik reaches it on 127.0.0.1:33073 (h2c for gRPC, http for /api). The store
|
|
# engine is set to postgres in management.json; the schema is migrated by the management
|
|
# process itself on start, so no separate init unit is required.
|
|
Exec=--port 33073 --log-file console --log-level info --metrics-port 9090 --dns-domain netbird.selfhosted --single-account-mode-domain netbird.selfhosted
|
|
|
|
[Service]
|
|
Restart=always
|
|
RestartSec=10
|
|
TimeoutStartSec=120
|
|
TimeoutStopSec=30
|
|
|
|
# Wait for PostgreSQL to accept connections on localhost before starting.
|
|
ExecStartPre=/bin/sh -c 'exec 2>/dev/null; for try in $(seq 0 12); do if ! /bin/true 5<> /dev/tcp/127.0.0.1/5432; then echo "Waiting for PostgreSQL to be available..."; sleep 5; else exit 0; fi; done; exit 1'
|
|
|
|
[Install]
|
|
WantedBy=netbird.target
|
|
|