Join a fresh host to NetBird idempotently with the keyring, the management URL and the interface blacklist from the vars, and edit the blacklist and log level of a joined one

2026-10-23 20:54:30 +00:00
parent a64d082c0c
commit a4648e0ea7
6 changed files with 97 additions and 14 deletions
@@ -0,0 +1,49 @@
+- name: Read netbird config
+  slurp:
+    src: /var/lib/netbird/default.json
+  register: netbird_config_file
+  when: netbird_client.iface_blacklist_extra | default([]) | length > 0
+  tags: netbird_client_config
+
+- name: Add the extra interface prefixes to IFaceBlackList
+  when: netbird_config_file.content is defined
+  vars:
+    netbird_config: "{{ netbird_config_file.content | b64decode | from_json }}"
+    netbird_blacklist_missing: "{{ netbird_client.iface_blacklist_extra | difference(netbird_config.IFaceBlackList | default([])) }}"
+  tags: netbird_client_config
+  block:
+    # netbird writes its in-memory config back on exit, so edit only while it is stopped
+    - name: Stop netbird to edit its config
+      systemd:
+        name: netbird
+        state: stopped
+      when: netbird_blacklist_missing | length > 0
+      notify: restart_netbird
+      register: netbird_stopped
+
+    - name: Re-read netbird config after stop
+      slurp:
+        src: /var/lib/netbird/default.json
+      register: netbird_config_stopped
+      when: netbird_stopped is changed
+
+    - name: Write IFaceBlackList
+      copy:
+        dest: /var/lib/netbird/default.json
+        content: "{{ cfg | combine({'IFaceBlackList': cfg.IFaceBlackList | default([]) + netbird_client.iface_blacklist_extra | difference(cfg.IFaceBlackList | default([]))}) | to_nice_json(indent=4, sort_keys=False) }}\n"
+        mode: "0600"
+      vars:
+        cfg: "{{ netbird_config_stopped.content | b64decode | from_json }}"
+      when: netbird_stopped is changed
+
+- name: Set netbird log level
+  copy:
+    dest: /etc/systemd/system/netbird.service.d/20-log-level.conf
+    content: |
+      [Service]
+      ExecStart=
+      ExecStart=/usr/bin/netbird service run --log-level {{ netbird_client.log_level }} --daemon-addr unix:///var/run/netbird.sock --log-file /var/log/netbird/client.log
+    mode: "0644"
+  when: netbird_client.log_level | default('') != ''
+  notify: restart_netbird
+  tags: netbird_client_config