Skip to content

Commit 0826396

Browse files
onelrianonelrian
committed
Clean up Ansible templates, fix variable escaping, and remove redundant Terraform mappings.
1 parent 1c5c7bb commit 0826396

File tree

5 files changed

+252
-94
lines changed

5 files changed

+252
-94
lines changed

‎infrastructure/ansible-stack/ha.tfvars.example‎

Lines changed: 60 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,60 @@
1+
# =============================================================================
2+
# NETBIRD HIGH-AVAILABILITY DEPLOYMENT (MULTI-NODE + MANAGED DB)
3+
# =============================================================================
4+
# Production-ready configuration with separate roles and High Availability.
5+
# =============================================================================
6+
7+
# 1. Main Configuration
8+
netbird_domain = "vpn.example.com"
9+
environment = "prod"
10+
aws_region = "us-east-1" # Only needed if creating AWS RDS
11+
12+
# 2. Host Configuration (Distributed roles)
13+
netbird_hosts = {
14+
"management-01" = {
15+
public_ip = "1.2.3.10"
16+
private_ip = "10.0.1.10"
17+
roles = ["management"]
18+
ssh_user = "ubuntu"
19+
},
20+
"relay-01" = {
21+
public_ip = "1.2.3.20"
22+
private_ip = "10.0.1.20"
23+
roles = ["relay"]
24+
ssh_user = "ubuntu"
25+
},
26+
"proxy-01" = {
27+
public_ip = "1.2.3.30"
28+
private_ip = "10.0.1.30"
29+
roles = ["proxy"]
30+
ssh_user = "ubuntu"
31+
}
32+
}
33+
34+
# 3. Database (Using Managed AWS RDS PostgreSQL)
35+
database_type = "postgresql"
36+
database_mode = "create"
37+
cloud_provider = "aws"
38+
postgresql_instance_class = "db.t3.medium"
39+
postgresql_storage_gb = 50
40+
postgresql_password = "REPLACE_WITH_SECURE_DB_PASSWORD"
41+
postgresql_multi_az = true
42+
postgresql_backup_retention_days = 30
43+
enable_ha = true
44+
45+
# 4. Identity Provider (Keycloak)
46+
keycloak_url = "https://keycloak.example.com"
47+
keycloak_admin_username = "admin"
48+
keycloak_admin_password = "REPLACE_WITH_KEYCLOAK_ADMIN_PASSWORD"
49+
realm_name = "netbird"
50+
51+
# 5. NetBird Admin Dashboard
52+
netbird_admin_email = "admin@example.com"
53+
netbird_admin_password = "REPLACE_WITH_SECURE_ADMIN_PASSWORD"
54+
55+
# 6. SSH Credentials for Ansible
56+
ssh_private_key_path = "~/.ssh/id_rsa"
57+
58+
# 7. (Optional) Service secrets - Generated automatically if left empty
59+
# relay_auth_secret = ""
60+
# netbird_encryption_key = ""

‎infrastructure/ansible-stack/main.tf‎

Lines changed: 5 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -64,9 +64,11 @@ resource "random_id" "netbird_encryption_key" {
6464

6565
resource "local_file" "ansible_inventory" {
6666
content = templatefile("${path.module}/templates/inventory.yaml.tpl", {
67-
netbird_domain = var.netbird_domain
68-
netbird_version = var.netbird_version
69-
netbird_log_level = var.netbird_log_level
67+
netbird_domain = var.netbird_domain
68+
netbird_version = var.netbird_version
69+
netbird_log_level = var.netbird_log_level
70+
caddy_version = var.caddy_version
71+
docker_compose_version = var.docker_compose_version
7072

7173
# Database
7274
database_type = module.database.database_type
@@ -90,10 +92,6 @@ resource "local_file" "ansible_inventory" {
9092

9193
relay_auth_secret = var.relay_auth_secret != "" ? var.relay_auth_secret : random_password.relay_auth_secret.result
9294
netbird_encryption_key = var.netbird_encryption_key != "" ? var.netbird_encryption_key : random_id.netbird_encryption_key.b64_std
93-
netbird_log_level = var.netbird_log_level
94-
netbird_version = var.netbird_version
95-
caddy_version = var.caddy_version
96-
docker_compose_version = var.docker_compose_version
9795

9896

9997
# Compute relay addresses list for management.json (rels://IP:443 format)

‎infrastructure/ansible-stack/single-node.tfvars.example‎

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
# =============================================================================
2+
# NETBIRD SINGLE-NODE DEPLOYMENT (DOCKER + SQLITE)
3+
# =============================================================================
4+
# Simplest possible configuration for testing or small-scale use.
5+
# All roles (management, signal, dashboard, relay, proxy) on a single server.
6+
# =============================================================================
7+
8+
# 1. Main Configuration
9+
netbird_domain = "vpn.example.com"
10+
environment = "dev"
11+
12+
# 2. Host Configuration (One VM for everything)
13+
netbird_hosts = {
14+
"netbird-all-in-one" = {
15+
public_ip = "1.2.3.4"
16+
roles = ["management", "relay", "proxy"] # Includes all NetBird services
17+
ssh_user = "ubuntu"
18+
}
19+
}
20+
21+
# 3. Database (SQLite is local to the server)
22+
database_type = "sqlite"
23+
sqlite_database_path = "/var/lib/netbird/store.db"
24+
25+
# 4. Identity Provider (Keycloak)
26+
keycloak_url = "https://keycloak.example.com"
27+
keycloak_admin_username = "admin"
28+
keycloak_admin_password = "REPLACE_WITH_KEYCLOAK_ADMIN_PASSWORD"
29+
30+
# 5. NetBird Admin Dashboard
31+
netbird_admin_email = "admin@example.com"
32+
netbird_admin_password = "REPLACE_WITH_SECURE_ADMIN_PASSWORD"
33+
34+
# 6. SSH Credentials for Ansible
35+
ssh_private_key_path = "~/.ssh/id_rsa"

‎infrastructure/ansible-stack/terraform.tfvars‎

Lines changed: 78 additions & 28 deletions
Original file line numberDiff line numberDiff line change
@@ -1,43 +1,93 @@
1-
# ============================================
2-
# NETBIRD DEPLOYMENT CONFIGURATION
3-
# ============================================
1+
# =============================================================================
2+
# NETBIRD TERRAFORM + ANSIBLE STACK - CONFIGURATION EXAMPLE
3+
# =============================================================================
4+
# Use this file as a template for your deployment.
5+
# Copy it to 'terraform.tfvars' and update the values.
6+
# =============================================================================
47

5-
# Define your hosts and their roles here
6-
# Roles: management, relay, proxy
7-
# For single-node deployment, assign all roles to one host
8+
# -----------------------------------------------------------------------------
9+
# 1. Environment & Network
10+
# -----------------------------------------------------------------------------
11+
environment = "prod"
12+
aws_region = "us-east-1"
13+
netbird_domain = "vpn.example.com"
14+
15+
# -----------------------------------------------------------------------------
16+
# 2. Inventory Configuration
17+
# -----------------------------------------------------------------------------
18+
# Map your servers to roles: management, relay, proxy
19+
# For a single-node setup, assign all roles to one host.
820
netbird_hosts = {
9-
"netbird-server" = {
10-
public_ip = "1.2.3.4"
11-
private_ip = "10.0.0.1"
21+
"netbird-main" = {
22+
public_ip = "1.2.3.4" # Public IP reachable by clients and Ansible
23+
private_ip = "10.0.0.1" # Optional: Internal IP for inter-service communication
1224
roles = ["management", "relay", "proxy"]
13-
ssh_user = "ubuntu"
25+
ssh_user = "ubuntu" # Default user for Ansible connection
1426
}
1527
}
1628

17-
# Database Backend Selection
29+
# -----------------------------------------------------------------------------
30+
# 3. Database Selection
31+
# -----------------------------------------------------------------------------
32+
33+
# --- OPTION A: SQLite (Simpler, local file) ---
1834
database_type = "sqlite"
19-
database_mode = "existing"
2035
sqlite_database_path = "/var/lib/netbird/store.db"
21-
enable_ha = false
2236

23-
# Common Variables
24-
netbird_domain = "vpn.example.com"
25-
environment = "prod"
37+
# --- OPTION B: Existing PostgreSQL (Recommended for production) ---
38+
# database_type = "postgresql"
39+
# database_mode = "existing"
40+
# existing_postgresql_host = "db.example.com"
41+
# existing_postgresql_port = 5432
42+
# existing_postgresql_database = "netbird"
43+
# existing_postgresql_username = "netbird_user"
44+
# existing_postgresql_password = "REPLACE_WITH_SECURE_PASSWORD"
45+
# existing_postgresql_sslmode = "require"
2646

27-
# Keycloak Configuration
28-
keycloak_url = "https://keycloak.example.com/auth"
47+
# --- OPTION C: Create Managed PostgreSQL (Cloud-native) ---
48+
# database_type = "postgresql"
49+
# database_mode = "create"
50+
# cloud_provider = "aws" # options: aws, gcp, azure
51+
# postgresql_instance_class = "db.t3.medium"
52+
# postgresql_storage_gb = 20
53+
# postgresql_database_name = "netbird"
54+
# postgresql_username = "netbird_admin"
55+
# postgresql_password = "REPLACE_WITH_SECURE_PASSWORD"
56+
# postgresql_multi_az = false # set to true for high availability
57+
# postgresql_backup_retention_days = 7
58+
59+
# -----------------------------------------------------------------------------
60+
# 4. Identity Provider (Keycloak) Configuration
61+
# -----------------------------------------------------------------------------
62+
# NetBird requires an OIDC provider. This module configures a Keycloak realm.
63+
keycloak_url = "https://keycloak.example.com"
2964
keycloak_admin_username = "admin"
30-
keycloak_admin_password = "CHANGE_ME"
65+
keycloak_admin_password = "REPLACE_WITH_KEYCLOAK_ADMIN_PASSWORD"
3166
keycloak_use_existing_realm = false
67+
realm_name = "netbird"
68+
69+
# -----------------------------------------------------------------------------
70+
# 5. NetBird Application Secrets
71+
# -----------------------------------------------------------------------------
72+
# Default NetBird Dashboard Administrator
73+
netbird_admin_email = "admin@example.com"
74+
netbird_admin_password = "REPLACE_WITH_SECURE_ADMIN_PASSWORD"
3275

33-
# Authentication Secrets (Leave empty to generate automatically)
34-
relay_auth_secret = ""
35-
netbird_encryption_key = ""
36-
netbird_log_level = "info"
76+
# Secrets generation:
77+
# If left empty, Terraform will generate secure random strings automatically.
78+
relay_auth_secret = ""
79+
netbird_encryption_key = "" # 32-byte base64 key for sensitive data at rest
80+
netbird_log_level = "info"
3781

38-
# Default Administrator
39-
netbird_admin_email = "admin@example.com"
40-
netbird_admin_password = "CHANGE_ME"
82+
# -----------------------------------------------------------------------------
83+
# 6. Version Pinning
84+
# -----------------------------------------------------------------------------
85+
netbird_version = "latest"
86+
caddy_version = "latest"
87+
docker_compose_version = "v2.24.0"
4188

42-
# SSH Configuration for Ansible
43-
ssh_private_key_path = "~/.ssh/id_rsa"
89+
# -----------------------------------------------------------------------------
90+
# 7. Ansible Connection Settings
91+
# -----------------------------------------------------------------------------
92+
# Path to the private key used to SSH into 'netbird_hosts'
93+
ssh_private_key_path = "~/.ssh/id_rsa"

0 commit comments

Comments
 (0)