homelab/apps
Watch
2
0
Fork
You've already forked apps
 0
Code Issues 1 Pull requests 2 Projects Releases Packages Wiki Activity

feat(netbird): add an in-cluster routing peer for the Home network #187

Merged
morten-olsen merged 1 commit from feat/homeit-498-netbird-router into main 2026-10-30 10:31:42 +01:00
Conversation 0 Commits 1 Files changed 3 +137
morten-olsen commented 2026-10-30 10:19:59 +01:00
Owner

Mission Control: HOMEIT-498. Adds netbird-router: the NetBird client 0.81.5 with kernel WireGuard (NET_ADMIN/NET_RAW, ip_forward via the allowed net.ipv4.* sysctls) and no Istio sidecar. Client routes and DNS are disabled, so the 0.0.0.0/0 exit routes sent to All never apply to the pod. It enrolls once with a sealed single-use, 24h setup key into the cluster-routers group, which the Home network now uses as a router at metric 100, ahead of the desktop at 9999. Its identity persists on a 64Mi local-path PVC, so the key is worthless after first use. The NetBird side was applied through base scripts/netbird-router.py. The key expires 24h after creation (2026-10-30 ~09:15 UTC), so this needs to merge before then.

Mission Control: HOMEIT-498. Adds netbird-router: the NetBird client 0.81.5 with kernel WireGuard (NET_ADMIN/NET_RAW, ip_forward via the allowed net.ipv4.* sysctls) and no Istio sidecar. Client routes and DNS are disabled, so the 0.0.0.0/0 exit routes sent to All never apply to the pod. It enrolls once with a sealed single-use, 24h setup key into the cluster-routers group, which the Home network now uses as a router at metric 100, ahead of the desktop at 9999. Its identity persists on a 64Mi local-path PVC, so the key is worthless after first use. The NetBird side was applied through base scripts/netbird-router.py. The key expires 24h after creation (2026-10-30 ~09:15 UTC), so this needs to merge before then.
feat(netbird): add an in-cluster routing peer for the Home network
All checks were successful
ci/woodpecker/pr/charts Pipeline was successful
Details
b41de52436
 
A NetBird client (0.81.5, kernel WireGuard, no sidecar) enrolls once with a
sealed single-use setup key into cluster-routers, which now routes Home at
metric 100 ahead of the desktop router. Client routes and DNS are off so the
exit routes never take over the pod's networking; identity persists on a
64Mi volume.

Refs HOMEIT-498
morten-olsen force-pushed feat/homeit-498-netbird-router from b41de52436
All checks were successful
ci/woodpecker/pr/charts Pipeline was successful
Details
to 7142a9abdf
All checks were successful
ci/woodpecker/pr/charts Pipeline was successful
Details
ci/woodpecker/push/scan Pipeline was successful
Details
2026-10-30 10:30:20 +01:00 Compare
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels   
bug
Something isn't working

  
documentation
Improvements or additions to documentation

  
duplicate
This issue or pull request already exists

  
enhancement
New feature or request

  
good first issue
Good for newcomers

  
help wanted
Extra attention is needed

  
invalid
This doesn't seem right

  
question
Further information is requested

  
wontfix
This will not be worked on

No labels
bug
documentation
duplicate
enhancement
good first issue
help wanted
invalid
question
wontfix
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
homelab/apps!187
No description provided.