bb-open/sextant-overlay-bbopen
1
0
Fork 0
Code Issues Pull requests 2 Projects Releases Packages Wiki Activity Actions

One netbird daemon, and it is the hardened one #2

Open
bbadmin wants to merge 1 commit from fix/one-netbird-daemon into main
pull from: fix/one-netbird-daemon
merge into: bb-open:main
Conversation 0 Commits 1 Files changed 1 +15 -3
bbadmin commented 2026-08-18 13:35:41 +00:00
Owner
Copy link

The station ran two netbird daemons.

dawo.netbird configures services.netbird.clients.dawo: hardened, enrolled from a setup key that stays out of the store, and it is the one carrying the mesh. Alongside it station.nix set services.netbird.enable, which is not a switch for the mesh at all. nixpkgs documents it as the backward-compatible client, equivalent to clients.default with hardened = false on wt0.

Measured on the station, 2026-08-18, before removing it

nb-dawo   100.126.77.128/16     <- the mesh address
wt0       (no IPv4 at all)
netbird status (default socket): Daemon status: NeedsLogin

So the second daemon had never joined anything. It is a service to keep patched and a second place to look during an incident, and it is explicitly the less hardened of the two.

It also cost an hour of the wrong answer today: asking the default socket for the mesh state answers NeedsLogin while the fleet is connected on the other one. That is how this was found.

After the change

services.netbird.enable   false
clients                   ["dawo"]
clients.dawo.interface    nb-dawo

Both device classes still evaluate: dawo-inspoelstraat and e2e5 on 26.05.20260809.fcb8fcd.

Nothing moves on a device until a ring is promoted.

The station ran two netbird daemons. `dawo.netbird` configures `services.netbird.clients.dawo`: hardened, enrolled from a setup key that stays out of the store, and it is the one carrying the mesh. Alongside it `station.nix` set `services.netbird.enable`, which is not a switch for the mesh at all. nixpkgs documents it as the backward-compatible client, equivalent to `clients.default` with `hardened = false` on `wt0`. ## Measured on the station, 2026-08-18, before removing it ``` nb-dawo 100.126.77.128/16 <- the mesh address wt0 (no IPv4 at all) netbird status (default socket): Daemon status: NeedsLogin ``` So the second daemon had never joined anything. It is a service to keep patched and a second place to look during an incident, and it is explicitly the less hardened of the two. It also cost an hour of the wrong answer today: asking the default socket for the mesh state answers `NeedsLogin` while the fleet is connected on the other one. That is how this was found. ## After the change ``` services.netbird.enable false clients ["dawo"] clients.dawo.interface nb-dawo ``` Both device classes still evaluate: `dawo-inspoelstraat` and `e2e5` on `26.05.20260809.fcb8fcd`. Nothing moves on a device until a ring is promoted.
fix(station): one netbird daemon, and it is the hardened one
Some checks failed
ci / evaluate (push) Failing after 15s
Details
ci / update-owned-inputs (push) Has been skipped
Details
ci / evaluate (pull_request) Failing after 1s
Details
ci / update-owned-inputs (pull_request) Has been skipped
Details
1ba152d602 
The station ran two. dawo.netbird configures services.netbird.clients.dawo,
hardened and enrolled from a setup key outside the store, and that is the one
carrying the mesh. Alongside it station.nix set services.netbird.enable,
which nixpkgs documents as the backward-compatible client: clients.default,
hardened = false, on wt0.

Measured on the station on 2026-08-18 before removing it: the mesh address
sits on nb-dawo, wt0 carries no IPv4 at all, and netbird status on the
default socket answers NeedsLogin. So the second daemon had never joined
anything.

It also cost an hour of the wrong answer: asking the default socket for the
mesh state says NeedsLogin while the fleet is connected on the other one.

Evaluated after the change: services.netbird.enable false, clients ["dawo"]
on nb-dawo, and both device classes still evaluate.
Some checks failed
ci / evaluate (push) Failing after 15s
Details
ci / update-owned-inputs (push) Has been skipped
Details
ci / evaluate (pull_request) Failing after 1s
Details
ci / update-owned-inputs (pull_request) Has been skipped
Details
This pull request can be merged automatically.
You are not authorized to merge this pull request.
View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.
git fetch -u origin fix/one-netbird-daemon:fix/one-netbird-daemon
git switch fix/one-netbird-daemon

Merge

Merge the changes and update on Forgejo.

Warning: The "Autodetect manual merge" setting is not enabled for this repository, you will have to mark this pull request as manually merged afterwards.

git switch main
git merge --no-ff fix/one-netbird-daemon
git switch fix/one-netbird-daemon
git rebase main
git switch main
git merge --ff-only fix/one-netbird-daemon
git switch fix/one-netbird-daemon
git rebase main
git switch main
git merge --no-ff fix/one-netbird-daemon
git switch main
git merge --squash fix/one-netbird-daemon
git switch main
git merge --ff-only fix/one-netbird-daemon
git switch main
git merge fix/one-netbird-daemon
git push origin main
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
bb-open/sextant-overlay-bbopen!2
No description provided.