Deploy the NetBird control plane as separate containers on Fedora CoreOS:
management, signal, relay and dashboard (netbirdio/*) plus a coturn STUN/TURN
server. This is the advanced (multi-container) self-hosted layout, so it can
be pointed at an external OIDC provider; no identity provider is bundled.
- Depends on postgresql (management store, via other/postgresql/netbird.sql)
and traefik (TLS + HTTP/gRPC/WebSocket ingress on 443, via
other/traefik/netbird.yaml). NetBird obtains no certificates of its own
(LETSENCRYPT_DOMAIN=none); management, signal, dashboard and relay share the
443 host name and Traefik dispatches by path prefix, gRPC over h2c.
- coturn is published directly (3478/udp+tcp and the TURN relay UDP range
cannot go through an HTTP reverse proxy).
- Runs as a dedicated UID 10035 / GID 10000. The dashboard uses the rootful
upstream image mapped to the non-root host UID via UIDMap/GIDMap (like
nextcloud), in its own network namespace with the HTTP port published only on
loopback for Traefik.
- Operator provides management.json, management.env, dashboard.env, relay.env
and turnserver.conf; the target and units are gated with ConditionPathExists
so a half-configured VM stays idle. Working-but-insecure examples ship under
config/examples/ so make install and the tests run without operator secrets.
- Images pinned to arm64-capable tags (management/signal/relay 0.79.0,
dashboard v2.92.0, coturn 4.6.2), verified for the aarch64 target.
Verified: make dryrun, make install (dev VM), make package, make -C cookbooks
package (all cookbooks), butane --strict, and make pytest on a clean Fedora
CoreOS VM (19 passed, 2 skipped).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01UjEeBApAoL8Z7PZmBo7ekU
Nicolas Massé
c470c2cec3