netbird server works now. linted the yml files

ansible/files/.env

@@ -2,7 +2,7 @@ HOST=0.0.0.0
 PORT=80
 LOG_LEVEL=WARN
 DEBUG=false
-SQLALCHEMY_DATABASE_URI=postgresql+psycopg://postgres:123456@postgres:5432/petty{{ name }}
+SQLALCHEMY_DATABASE_URI=postgresql+psycopg://postgres:123456@postgres:5432/petty{{ app_name }}
 MODULE_NAME=barker.main
 PROJECT_NAME=barker
 MAX_WORKERS=4

ansible/playbook.yml

@@ -2,7 +2,8 @@
 # DO Community Playbooks: Docker
 #################################################
 ---
-- hosts: barker
+- name: Deploy Barker
+  hosts: barker
   become: true
   vars_files:
     - vars/default.yml

ansible/requirements.yml

@@ -0,0 +1,3 @@
+---
+collections:
+  - name: community.docker

ansible/roles/barker/tasks/main.yaml

@@ -1,30 +1,32 @@
 ---
 # Tasks for docker role
 - name: Log in to Docker registry
-  docker_login:
+  community.docker.docker_login:
     registry: "{{ registry }}"
     username: "{{ username }}"
     password: "{{ password }}"
 
 - name: Pull Barker image
-  docker_image:
+  community.docker.docker_image:
     name: "{{ image_name }}"
     source: pull
     state: present
-    force_source: yes
+    force_source: true
 
 - name: Ensure Host Directory exists
-  file:
-      path: "/var/lib/{{ host_directory }}"
-      state: directory
+  ansible.builtin.file:
+    path: "/var/lib/{{ host_directory }}"
+    state: directory
+    mode: "0755"
 
 - name: Upload the .env file
-  template:
+  ansible.builtin.template:
     src: "files/.env"
     dest: "/var/lib/{{ host_directory }}/.env"
+    mode: "0644"
 
 - name: Create barker container
-  docker_container:
+  community.docker.docker_container:
     name: "{{ host_directory }}"
     image: "{{ image_name }}"
     state: started
@@ -32,5 +34,3 @@
     env_file: "/var/lib/{{ host_directory }}/.env"
     networks:
       - name: "{{ docker_network }}"
-    # volumes:
-    #   - "/var/lib/{{ host_directory }}/frontend:/frontend"

ansible/roles/caddy/defaults/main.yaml

@@ -1,6 +1,6 @@
-
+---
 caddy_container: caddy
-caddyfile_path: /var/lib/caddy/conf/Caddyfile
+caddy_caddyfile_path: /var/lib/caddy/conf/Caddyfile
 # snippet_block: |
 #   {{ host }} {
 #       reverse_proxy {{ barker_container }}:80

ansible/roles/caddy/handlers/main.yaml

@@ -1,7 +1,5 @@
 ---
-# Handlers for Nginx role
-- name: Restart caddy container
-  docker_container:
-    name: "{{ caddy_container }}"
-    state: started
-    restart: true
+- name: Reload Caddy configuration
+  ansible.builtin.command: "docker exec -w /etc/caddy {{ caddy_container }} caddy reload"
+  listen: "Reload Caddy"
+  changed_when: true

ansible/roles/caddy/tasks/main.yaml

@@ -1,26 +1,27 @@
 ---
 - name: Read snippet from template file
-  set_fact:
-    snippet_block: "{{ lookup('template', 'files/Caddyfile.j2') }}"
+  ansible.builtin.set_fact:
+    caddy_snippet_block: "{{ lookup('template', 'files/Caddyfile.j2') }}"
 
 - name: Read current Caddyfile
   ansible.builtin.slurp:
-    path: "{{ caddyfile_path }}"
-  register: caddyfile_raw
+    path: "{{ caddy_caddyfile_path }}"
+  register: caddy_caddyfile_raw
 
 - name: Decode Caddyfile content
-  set_fact:
-    caddyfile_content: "{{ caddyfile_raw['content'] | b64decode }}"
+  ansible.builtin.set_fact:
+    caddy_caddyfile_content: "{{ caddy_caddyfile_raw['content'] | b64decode }}"
 
 - name: Check if snippet already exists
-  set_fact:
-    snippet_present: "{{ snippet_block in caddyfile_content }}"
+  ansible.builtin.set_fact:
+    caddy_snippet_present: "{{ caddy_snippet_block in caddy_caddyfile_content }}"
 
 - name: Add snippet if missing
   ansible.builtin.blockinfile:
-    path: "{{ caddyfile_path }}"
+    path: "{{ caddy_caddyfile_path }}"
     marker: "# {mark} Ansible managed Caddy snippet for {{ host }}"
-    block: "{{ snippet_block }}"
-    create: yes
-  when: not snippet_present
+    block: "{{ caddy_snippet_block }}"
+    create: true
+    mode: "0644"
+  when: not caddy_snippet_present
   notify: Restart caddy container

ansible/roles/network/tasks/main.yaml

@@ -1,10 +1,10 @@
 ---
 - name: Ensure 'barker' Docker network exists
-  docker_network:
+  community.docker.docker_network:
     name: "{{ docker_network }}"
     state: present
     connected:
       - caddy
       - valkey
       - postgres
-    appends: yes
+    appends: true

ansible/vars/chd.yml

@@ -1,8 +1,8 @@
 ---
-name: chd
+app_name: chd
 secret_key: d9e4facec94d7e0bf3d63ca03b1d78d834b158627b6593274f7fe27f6aed6db4
 middleware_key: 8d5f28b083
 
 host: knox.greatbear.in
-host_directory: "barker-{{ name }}"
-docker_network: "{{ host_directory}}_net"
+host_directory: "barker-{{ app_name }}"
+docker_network: "{{ host_directory }}_net"

ansible/vars/hin.yml

@@ -1,8 +1,8 @@
 ---
-name: hin
+app_name: hin
 secret_key: 029858927beda45d76317729824ae500d0938f04d4ca955f3afa95061c9a9298
 middleware_key: c4b0b98ff9
 
 host: knox.mozimo.in
-host_directory: "barker-{{ name }}"
-docker_network: "{{ host_directory}}_net"
+host_directory: "barker-{{ app_name }}"
+docker_network: "{{ host_directory }}_net"

ansible/vars/mhl.yml

@@ -1,8 +1,8 @@
 ---
-name: mhl
+app_name: mhl
 secret_key: 8b7f704ad1bbee3caa683a57440a6a371937fe5f64a7712a6a15bf3165c3c598
 middleware_key: 1aa5487223
 
 host: knox.hngmohali.com
-host_directory: "barker-{{ name }}"
-docker_network: "{{ host_directory}}_net"
+host_directory: "barker-{{ app_name }}"
+docker_network: "{{ host_directory }}_net"

ansible/vars/pkl.yml

@@ -1,8 +1,8 @@
 ---
-name: pkl
+app_name: pkl
 secret_key: bd6e5dee0f3b8a6f0db50f7aa08e91d55b2ae5ab6df126defa37e80602481002
 middleware_key: 1d34ef6597
 
 host: knox.hopsngrains.com
-host_directory: "barker-{{ name }}"
-docker_network: "{{ host_directory}}_net"
+host_directory: "barker-{{ app_name }}"
+docker_network: "{{ host_directory }}_net"

frank/ansible/bake-pies.yml

@@ -2,7 +2,8 @@
 # DO Community Playbooks: Docker
 #################################################
 ---
-- hosts: all
+- name: Bake pies
+  hosts: all
   become: true
   vars_files:
     - vars/pies.yml
@@ -19,161 +20,185 @@
     #   when: lcd_rotate_test.stdout == "0"
 
     - name: Update the hostname file
-      replace:
+      ansible.builtin.replace:
         path: /etc/hostname
-        regexp: '(\s*)raspberrypi(\s+.*)?$'
+        regexp: "(\\s*)raspberrypi(\\s+.*)?$"
         replace: "\\1{{ hostname }}\\2"
-        backup: yes
+        backup: true
 
     - name: Update the hosts file
-      replace:
+      ansible.builtin.replace:
         path: /etc/hosts
-        regexp: '(\s+)raspberrypi(\s+.*)?$'
+        regexp: "(\\s+)raspberrypi(\\s+.*)?$"
         replace: "\\1{{ hostname }}\\2"
-        backup: yes
+        backup: true
 
     - name: Ensure SSH Directory exists
-      file:
-          path: "/home/{{ user }}/.ssh"
-          state: directory
-          group: "{{ user }}"
-          owner: "{{ user }}"
-          mode: 0700
-
-    - name: Ensure authorized_keys file exists
-      copy:
-        content: ""
-        dest: "/home/{{ user }}/.ssh/authorized_keys"
-        force: no
+      ansible.builtin.file:
+        path: "/home/{{ user }}/.ssh"
+        state: directory
         group: "{{ user }}"
         owner: "{{ user }}"
-        mode: 0644
+        mode: "0700"
+
+    - name: Ensure authorized_keys file exists
+      ansible.builtin.copy:
+        content: ""
+        dest: "/home/{{ user }}/.ssh/authorized_keys"
+        force: false
+        group: "{{ user }}"
+        owner: "{{ user }}"
+        mode: "0644"
 
     - name: Check Terminus public key
-      shell: "grep -c \"{{ terminus_key }}\" /home/{{ user }}/.ssh/authorized_keys || true"
+      ansible.builtin.shell: "grep -c \"{{ terminus_key }}\" /home/{{ user }}/.ssh/authorized_keys || true"
       register: terminuskey_test
+      changed_when: false
 
     - name: Add Terminus public key
-      lineinfile:
+      ansible.builtin.lineinfile:
         dest: "/home/{{ user }}/.ssh/authorized_keys"
         line: "{{ terminus_key }}"
       when: terminuskey_test.stdout == "0"
 
     - name: Check clair public key
-      shell: "grep -c \"{{ clair_key }}\" /home/{{ user }}/.ssh/authorized_keys || true"
+      ansible.builtin.shell: "grep -c \"{{ clair_key }}\" /home/{{ user }}/.ssh/authorized_keys || true"
       register: clairkey_test
+      changed_when: false
 
     - name: Add clair public key
-      lineinfile:
+      ansible.builtin.lineinfile:
         dest: "/home/{{ user }}/.ssh/authorized_keys"
         line: "{{ clair_key }}"
       when: clairkey_test.stdout == "0"
 
     - name: Check Anjin public key
-      shell: "grep -c \"{{ anjin_key }}\" /home/{{ user }}/.ssh/authorized_keys || true"
+      ansible.builtin.shell: "grep -c \"{{ anjin_key }}\" /home/{{ user }}/.ssh/authorized_keys || true"
       register: anjin_key_test
+      changed_when: false
 
     - name: Add Anjin public key
-      lineinfile:
+      ansible.builtin.lineinfile:
         dest: "/home/{{ user }}/.ssh/authorized_keys"
         line: "{{ anjin_key }}"
       when: anjin_key_test.stdout == "0"
 
     - name: Update the sshd config file to disable password logins
-      replace:
+      ansible.builtin.replace:
         path: /etc/ssh/sshd_config
-        regexp: '(\s+)#PasswordAuthentication yes(\s+.*)?$'
+        regexp: "(\\s+)#PasswordAuthentication yes(\\s+.*)?$"
         replace: "\\1PasswordAuthentication no\\2"
-        backup: yes
+        backup: true
 
     - name: Check if .ssh config file exists
-      stat:
+      ansible.builtin.stat:
         path: "/home/{{ user }}/.ssh/config"
       register: config_status
 
     - name: No need to upload the .ssh config
-      when: config_status.stat.exists == true
-      debug:
+      when: config_status.stat.exists
+      ansible.builtin.debug:
         msg: No need to upload the .ssh config as it already exists.
 
     - name: Upload the .ssh config file
-      when: config_status.stat.exists == false
-      template:
+      when: not config_status.stat.exists
+      ansible.builtin.template:
         src: "files/config"
         dest: "/home/{{ user }}/.ssh/config"
         group: "{{ user }}"
         owner: "{{ user }}"
-        mode: 0644
+        mode: "0644"
 
     - name: Check if ed25519 key exists
-      stat:
+      ansible.builtin.stat:
         path: "/home/{{ user }}/.ssh/id_ed25519"
       register: key_status
 
     - name: No need to generate new ed25519 key
-      when: key_status.stat.exists == true
-      debug:
+      when: key_status.stat.exists
+      ansible.builtin.debug:
         msg: No need to generate new ed25519 key as it already exists.
 
     - name: Generate new id_ed25519 key
-      when: key_status.stat.exists == false
-      become: yes
+      when: not key_status.stat.exists
+      become: true
       become_user: "{{ user }}"
-      shell: ssh-keygen -t ed25519 -q -f "/home/{{ user }}/.ssh/id_ed25519" -C "{{ user }}@{{ hostname }} $(date '+%Y.%m.%d')" -N ""
+      ansible.builtin.shell: ssh-keygen -t ed25519 -q -f "/home/{{ user }}/.ssh/id_ed25519" -C "{{ user }}@{{ hostname }} $(date '+%Y.%m.%d')" -N ""
+      changed_when: true
 
     - name: Install Docker
-      shell: curl -sSL https://get.docker.com | sh
+      ansible.builtin.shell: curl -sSL https://get.docker.com | sh # noqa command-instead-of-module risky-shell-pipe
+      changed_when: true
 
     - name: Install matchbox-keyboard
-      package:
+      ansible.builtin.package:
         name: matchbox-keyboard
-        state: latest
+        state: present
 
     - name: Install python3-docker
-      package:
+      ansible.builtin.package:
         name: python3-docker
-        state: latest
+        state: present
 
-    - name: adding user to group docker
-      user:
+    - name: Adding user to group docker
+      ansible.builtin.user:
         name: "{{ user }}"
         groups: docker
-        append: yes
+        append: true
 
-    - name: adding user to group lp (line printers)
-      user:
+    - name: Adding user to group lp (line printers)
+      ansible.builtin.user:
         name: "{{ user }}"
         groups: lp
-        append: yes
+        append: true
 
-    - name: install nats-tunnel systemd unit file
-      template:
+    - name: Install nats-tunnel systemd unit file
+      ansible.builtin.template:
         src: "files/nats-tunnel.service"
         dest: "/etc/systemd/system/nats-tunnel.service"
+        mode: "0644"
 
-    - name: enable service nats-tunnel and ensure it is not masked
-      systemd:
+    - name: Enable service nats-tunnel and ensure it is not masked
+      ansible.builtin.systemd:
         name: nats-tunnel
-        enabled: yes
-        masked: no
+        enabled: true
+        masked: false
 
     - name: Make sure nats-tunnel service is running
-      systemd:
+      ansible.builtin.systemd:
         state: started
         name: nats-tunnel
 
-    - name: install leardal systemd unit file
-      template:
+    - name: Install leardal systemd unit file
+      ansible.builtin.template:
         src: "files/leardal.service"
         dest: "/etc/systemd/system/leardal.service"
+        mode: "0644"
 
-    - name: enable service leardal and ensure it is not masked
-      systemd:
+    - name: Enable service leardal and ensure it is not masked
+      ansible.builtin.systemd:
         name: leardal
-        enabled: yes
-        masked: no
+        enabled: true
+        masked: false
 
     - name: Make sure leardal service is running
-      systemd:
+      ansible.builtin.systemd:
         state: started
         name: leardal
+
+    - name: Check if NetBird is installed
+      ansible.builtin.command: netbird --version
+      register: netbird_installed
+      ignore_errors: true
+      changed_when: false
+
+    - name: Install NetBird client
+      ansible.builtin.shell: curl -fsSL https://pkgs.netbird.io/install.sh | sh
+      when: netbird_installed.rc != 0
+      changed_when: true
+
+    - name: Connect NetBird to management server
+      ansible.builtin.command: >
+        netbird up --management-url {{ netbird_management_url }} --setup-key {{ netbird_setup_key }}
+      when: netbird_installed.rc != 0
+      changed_when: true

frank/ansible/playbook.yml

@@ -2,7 +2,8 @@
 # DO Community Playbooks: Docker
 #################################################
 ---
-- hosts: frank
+- name: Deploy Frank
+  hosts: frank
   become: true
   vars_files:
     - vars/registry.yml

frank/ansible/requirements.yml

@@ -0,0 +1,3 @@
+---
+collections:
+  - name: community.docker

frank/ansible/roles/frank/tasks/main.yml

@@ -8,28 +8,28 @@
     msg: "No need to upload the frank .env file as it already exists."
 
 - name: Upload the frank .env file
-  when: status.stat.exists == false
+  when: not status.stat.exists
   template:
     src: files/frank.env
     dest: "/home/{{ user }}/frank.env"
     group: "{{ user }}"
     owner: "{{ user }}"
-    mode: 0644
+    mode: "0644"
 
 - name: Log into registry
-  docker_login:
+  community.docker.docker_login:
     registry: "{{ registry }}"
     username: "{{ username }}"
     password: "{{ password }}"
 
 - name: Pull frank image
-  docker_image:
+  community.docker.docker_image:
     name: "registry.tanshu.com/frank:{{ frank_version | default('latest') }}"
     source: pull
-    force_source: yes
+    force_source: true
 
 - name: Create frank worker container
-  docker_container:
+  community.docker.docker_container:
     name: "frank"
     image: "registry.tanshu.com/frank:{{ frank_version | default('latest') }}"
     pull: true
@@ -44,14 +44,32 @@
   template:
     src: "files/frank.service"
     dest: "/etc/systemd/system/frank.service"
+    mode: "0644"
 
 - name: enable service frank and ensure it is not masked
   systemd:
     name: frank
-    enabled: yes
-    masked: no
+    enabled: true
+    masked: false
 
 - name: Make sure frank service is running
   systemd:
     state: started
     name: frank
+
+- name: Check if NetBird is installed
+  ansible.builtin.command: netbird --version
+  register: netbird_installed
+  ignore_errors: true
+  changed_when: false
+
+- name: Install NetBird client
+  ansible.builtin.shell: curl -fsSL https://pkgs.netbird.io/install.sh | sh
+  when: netbird_installed.rc != 0
+  changed_when: true
+
+- name: Connect NetBird to management server
+  ansible.builtin.command: >
+    netbird up --management-url {{ netbird_management_url }} --setup-key {{ netbird_setup_key }}
+  when: netbird_installed.rc != 0
+  changed_when: true

frank/ansible/roles/tunnels/tasks/main.yml

@@ -1,32 +1,34 @@
 ---
-- name: install nats-tunnel systemd unit file
-  template:
+- name: Install nats-tunnel systemd unit file
+  ansible.builtin.template:
     src: "files/nats-tunnel.service"
     dest: "/etc/systemd/system/nats-tunnel.service"
+    mode: "0644"
 
-- name: enable service nats-tunnel and ensure it is not masked
-  systemd:
+- name: Enable service nats-tunnel and ensure it is not masked
+  ansible.builtin.systemd:
     name: nats-tunnel
-    enabled: yes
-    masked: no
+    enabled: true
+    masked: false
 
 - name: Make sure nats-tunnel service is running
-  systemd:
+  ansible.builtin.systemd:
     state: started
     name: nats-tunnel
 
-- name: install leardal systemd unit file
-  template:
+- name: Install leardal systemd unit file
+  ansible.builtin.template:
     src: "files/leardal.service"
     dest: "/etc/systemd/system/leardal.service"
+    mode: "0644"
 
-- name: enable service leardal and ensure it is not masked
-  systemd:
+- name: Enable service leardal and ensure it is not masked
+  ansible.builtin.systemd:
     name: leardal
-    enabled: yes
-    masked: no
+    enabled: true
+    masked: false
 
 - name: Make sure leardal service is running
-  systemd:
+  ansible.builtin.systemd:
     state: started
     name: leardal

frank/ansible/vars/devices/chd1.yml

@@ -2,4 +2,6 @@
 hostname: chd1
 ssh_port: 22341
 user: pi
+queue_name: moz-elante
 printer_port: "/dev/usb/lp0"
+ip_address: 10.3.4.1

frank/ansible/vars/devices/chd2.yml

@@ -2,4 +2,5 @@
 hostname: chd2
 ssh_port: 22342
 user: pi
+queue_name: moz-elante
 printer_port: "/dev/usb/lp0"

frank/ansible/vars/devices/mhl1.yml

@@ -2,4 +2,5 @@
 hostname: mhl1
 ssh_port: 22441
 user: pi
+queue_name: moz-elante
 printer_port: "/dev/usb/lp0"

frank/ansible/vars/devices/mhl2.yml

@@ -2,4 +2,5 @@
 hostname: mhl2
 ssh_port: 22442
 user: pi
+queue_name: moz-elante
 printer_port: "/dev/usb/lp0"

frank/ansible/vars/devices/mhl3.yml

@@ -2,4 +2,5 @@
 hostname: mhl3
 ssh_port: 22443
 user: pi
+queue_name: moz-elante
 printer_port: "/dev/usb/lp0"

frank/ansible/vars/devices/mhl4.yml

@@ -2,4 +2,5 @@
 hostname: mhl4
 ssh_port: 22444
 user: pi
+queue_name: moz-elante
 printer_port: "/dev/usb/lp0"

frank/ansible/vars/devices/moz1.yml

@@ -2,4 +2,5 @@
 hostname: moz1
 ssh_port: 22541
 user: vari
+queue_name: moz-elante
 printer_port: "/dev/usb/lp0"

frank/ansible/vars/devices/moz2.yml

@@ -2,4 +2,5 @@
 hostname: moz2
 ssh_port: 22542
 user: vari
+queue_name: moz-elante
 printer_port: "/dev/usb/lp0"

frank/ansible/vars/devices/pkl1.yml

@@ -2,4 +2,5 @@
 hostname: pkl1
 ssh_port: 22241
 user: pi
+queue_name: moz-elante
 printer_port: "/dev/usb/lp0"

frank/ansible/vars/devices/pkl2.yml

@@ -2,4 +2,5 @@
 hostname: pkl2
 ssh_port: 22242
 user: pi
+queue_name: moz-elante
 printer_port: "/dev/usb/lp0"

frank/ansible/vars/devices/pkl3.yml

@@ -2,4 +2,5 @@
 hostname: pkl3
 ssh_port: 22243
 user: pi
+queue_name: moz-elante
 printer_port: "/dev/usb/lp0"

frank/ansible/vars/pies.yml

@@ -3,3 +3,5 @@ terminus_key: "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIK8WQHla0uCcNwmN0DUE49lbjNWa6
 clair_key: "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBeTz3weHvjJRTlBg+ovP3KfQNDvyn9mVsekAGwX1HMn tanshu@clair 2025-06-30"
 anjin_key: "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMlvalE0JqKyjpEsGTgtf/N1d9QK2MgNFJib+e8O2h9M tanshu@anjin 2024.09.28"
 server: "clair"
+netbird_management_url: "https://netbird.tanshu.com"
+netbird_setup_key: "REPLACE_ME_WITH_SETUP_KEY"

lint.sh

@@ -14,3 +14,6 @@ uv run ruff check . --fix
 uv run bandit --recursive barker
 uv run bandit --recursive .
 uv run safety check
+uvx ansible-lint ../ansible --fix
+uvx ansible-lint ../netbird --fix
+uvx ansible-lint ../frank/ansible --fix

netbird/playbook.yml

@@ -0,0 +1,9 @@
+---
+- name: Deploy Netbird and Caddy
+  hosts: clair # Replace with the actual host running the Netbird control plane
+  become: true
+  vars_files:
+    - vars/default.yml
+  roles:
+    - netbird
+    - caddy

netbird/requirements.yml

@@ -0,0 +1,3 @@
+---
+collections:
+  - name: community.docker

netbird/roles/caddy/defaults/main.yml

@@ -0,0 +1,2 @@
+---
+caddy_container: caddy

netbird/roles/caddy/files/Caddyfile.j2

@@ -0,0 +1,9 @@
+{{ netbird_domain }} {
+    @grpc header Content-Type application/grpc*
+    reverse_proxy @grpc h2c://netbird-server:80
+
+    @backend path /relay* /ws-proxy/* /api/* /oauth2/*
+    reverse_proxy @backend netbird-server:80
+
+    reverse_proxy /* netbird-dashboard:80
+}

netbird/roles/caddy/handlers/main.yml

@@ -0,0 +1,5 @@
+---
+- name: Reload Caddy configuration
+  ansible.builtin.command: "docker exec -w /etc/caddy {{ caddy_container }} caddy reload"
+  listen: "Reload Caddy"
+  changed_when: true

netbird/roles/caddy/tasks/main.yml

@@ -0,0 +1,36 @@
+---
+- name: Ensure 'caddy' container is connected to netbird_net
+  community.docker.docker_network:
+    name: netbird_net
+    state: present
+    connected:
+      - caddy
+    appends: true
+
+- name: Read current Caddyfile
+  ansible.builtin.slurp:
+    path: "/var/lib/caddy/conf/Caddyfile"
+  register: caddy_caddyfile_raw
+  ignore_errors: true
+
+- name: Decode Caddyfile content
+  ansible.builtin.set_fact:
+    caddy_caddyfile_content: "{{ caddy_caddyfile_raw['content'] | b64decode }}"
+
+- name: Read snippet from template file
+  ansible.builtin.set_fact:
+    caddy_netbird_caddy_snippet: "{{ lookup('template', 'files/Caddyfile.j2') }}"
+
+- name: Check if Netbird snippet already exists
+  ansible.builtin.set_fact:
+    caddy_snippet_present: "{{ caddy_netbird_caddy_snippet in caddy_caddyfile_content }}"
+
+- name: Add Netbird snippet to Caddyfile
+  ansible.builtin.blockinfile:
+    path: "/var/lib/caddy/conf/Caddyfile"
+    marker: "# {mark} Ansible managed Caddy snippet for Netbird"
+    block: "{{ caddy_netbird_caddy_snippet }}"
+    create: true
+    mode: "0644"
+  when: not caddy_snippet_present
+  notify: Reload Caddy

netbird/roles/netbird/defaults/main.yml

@@ -0,0 +1,8 @@
+---
+netbird_domain: netbird.tanshu.com
+netbird_mgmt_api_port: 33073
+netbird_signal_port: 10000
+netbird_coturn_port: 3478
+# Note: As of NetBird v0.62+, it includes an integrated local Identity Provider!
+# You no longer need an external IdP like Authentik, Zitadel, or Auth0 to get started.
+# You can set up your first admin account directly in the NetBird Dashboard UI.

netbird/roles/netbird/tasks/main.yml

@@ -0,0 +1,54 @@
+---
+- name: Create Netbird docker network
+  community.docker.docker_network:
+    name: netbird_net
+    state: present
+
+- name: Create Netbird configuration directories
+  ansible.builtin.file:
+    path: "/var/lib/netbird/{{ item }}"
+    state: directory
+    mode: "0755"
+  loop:
+    - server/etc
+    - server/data
+
+- name: Deploy Netbird server configuration
+  ansible.builtin.template:
+    src: config.yaml.j2
+    dest: /var/lib/netbird/server/etc/config.yaml
+    mode: "0644"
+    force: false
+
+- name: Start Netbird Server Container
+  community.docker.docker_container:
+    name: netbird-server
+    image: netbirdio/netbird-server:latest
+    state: started
+    restart_policy: always
+    network_mode: netbird_net
+    ports:
+      - "{{ netbird_mgmt_api_port }}:80/tcp"
+    volumes:
+      - "/var/lib/netbird/server/etc:/etc/netbird"
+      - "/var/lib/netbird/server/data:/var/lib/netbird"
+    command: "--config /etc/netbird/config.yaml"
+
+- name: Start Netbird Dashboard Container
+  community.docker.docker_container:
+    name: netbird-dashboard
+    image: netbirdio/dashboard:latest
+    state: started
+    restart_policy: always
+    network_mode: netbird_net
+    env:
+      NETBIRD_MGMT_API_ENDPOINT: "https://{{ netbird_domain }}"
+      NETBIRD_MGMT_GRPC_API_ENDPOINT: "https://{{ netbird_domain }}"
+      AUTH_AUDIENCE: "netbird-dashboard"
+      AUTH_CLIENT_ID: "netbird-dashboard"
+      AUTH_CLIENT_SECRET: ""
+      AUTH_AUTHORITY: "https://{{ netbird_domain }}/oauth2"
+      USE_AUTH0: "false"
+      AUTH_SUPPORTED_SCOPES: "openid profile email groups"
+      AUTH_REDIRECT_URI: "/nb-auth"
+      AUTH_SILENT_REDIRECT_URI: "/nb-silent-auth"

netbird/roles/netbird/templates/config.yaml.j2

@@ -0,0 +1,33 @@
+# Combined NetBird Server Configuration
+# Generated by Ansible
+
+server:
+  listenAddress: ":80"
+  exposedAddress: "https://{{ netbird_domain }}:443"
+  stunPorts:
+    - 3478
+  metricsPort: 9090
+  healthcheckAddress: ":9000"
+  logLevel: "info"
+  logFile: "console"
+
+  authSecret: "{{ netbird_relay_secret }}"
+  dataDir: "/var/lib/netbird"
+
+  auth:
+    issuer: "https://{{ netbird_domain }}/oauth2"
+    signKeyRefreshEnabled: true
+    sessionCookieEncryptionKey: "{{ lookup('password', '/dev/null chars=ascii_letters,digits length=32') | b64encode }}"
+    dashboardRedirectURIs:
+      - "https://{{ netbird_domain }}/nb-auth"
+      - "https://{{ netbird_domain }}/nb-silent-auth"
+    cliRedirectURIs:
+      - "http://localhost:53000/"
+
+  reverseProxy:
+    trustedHTTPProxies:
+      - "0.0.0.0/0"
+
+  store:
+    engine: "sqlite"
+    encryptionKey: "{{ netbird_datastore_enc_key }}"

netbird/vars/default.yml

@@ -0,0 +1,3 @@
+netbird_relay_secret: t1MABpanE31W/uHj591cEz6+sONla2u+MQBGNMhSuZA=
+netbird_datastore_enc_key: Km3apaNV5Iy7JtdN6gogqX0EhbdLxPp+5G6RJj4ukSw=
+netbird_cookie_encryption_key: g4srYV9cv5IK3Ct2kNLXwAXgjNL3a0MQmAsK4lejIKs=