From 850200ab29798e98b96540c369f609ab76b72eb6 Mon Sep 17 00:00:00 2001
From: Krzysztof Nazarewski <gpg@kdn.im>
Date: Thu, 18 Sep 2025 17:35:45 +0200
Subject: [PATCH 1/3] nixos/netbird: add SYSTEMD_UNIT to pick up logs in debug
 bundles

---
 nixos/modules/services/networking/netbird.nix | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/nixos/modules/services/networking/netbird.nix b/nixos/modules/services/networking/netbird.nix
index 7c3fe93a5678..7640632b5966 100644
--- a/nixos/modules/services/networking/netbird.nix
+++ b/nixos/modules/services/networking/netbird.nix
@@ -414,6 +414,9 @@ in
               NB_LOG_LEVEL = client.logLevel;
               NB_SERVICE = client.service.name;
               NB_WIREGUARD_PORT = toString client.port;
+              # for gathering journald logs into debug bundles
+              # see https://github.com/netbirdio/netbird/blob/2c87fa623654c5eef76bc0226062290201eef13a/client/internal/debug/debug_linux.go#L50-L51
+              SYSTEMD_UNIT = client.service.name;
             }
             // optionalAttrs (client.dns-resolver.address != null) {
               NB_DNS_RESOLVER_ADDRESS = "${client.dns-resolver.address}:${builtins.toString client.dns-resolver.port}";

From eee5067f19a883e9125164e0a4c9f3de4bb7dfd3 Mon Sep 17 00:00:00 2001
From: Krzysztof Nazarewski <gpg@kdn.im>
Date: Fri, 19 Sep 2025 11:31:56 +0200
Subject: [PATCH 2/3] nixos/netbird: move `netbird debug bundle` tweaks to one
 place

---
 nixos/modules/services/networking/netbird.nix | 32 ++++++++++++-------
 1 file changed, 21 insertions(+), 11 deletions(-)

diff --git a/nixos/modules/services/networking/netbird.nix b/nixos/modules/services/networking/netbird.nix
index 7640632b5966..f6708907b667 100644
--- a/nixos/modules/services/networking/netbird.nix
+++ b/nixos/modules/services/networking/netbird.nix
@@ -414,9 +414,6 @@ in
               NB_LOG_LEVEL = client.logLevel;
               NB_SERVICE = client.service.name;
               NB_WIREGUARD_PORT = toString client.port;
-              # for gathering journald logs into debug bundles
-              # see https://github.com/netbirdio/netbird/blob/2c87fa623654c5eef76bc0226062290201eef13a/client/internal/debug/debug_linux.go#L50-L51
-              SYSTEMD_UNIT = client.service.name;
             }
             // optionalAttrs (client.dns-resolver.address != null) {
               NB_DNS_RESOLVER_ADDRESS = "${client.dns-resolver.address}:${builtins.toString client.dns-resolver.port}";
@@ -545,14 +542,7 @@ in
           after = [ "network.target" ];
           wantedBy = [ "multi-user.target" ];
 
-          path =
-            optionals (!config.services.resolved.enable) [ pkgs.openresolv ]
-            # useful for `netbird debug` system info gathering
-            ++ optionals config.networking.nftables.enable [ pkgs.nftables ]
-            ++ optionals (!config.networking.nftables.enable) [
-              pkgs.iptables
-              pkgs.ipset
-            ];
+          path = optionals (!config.services.resolved.enable) [ pkgs.openresolv ];
 
           serviceConfig = {
             ExecStart = "${getExe client.wrapper} service run";
@@ -576,6 +566,26 @@ in
         }
       );
     }
+    # netbird debug bundle related configurations
+    {
+      systemd.services = toClientAttrs (
+        client:
+        nameValuePair client.service.name {
+          /*
+            lets NetBird daemon know which systemd service to gather logs for
+            see https://github.com/netbirdio/netbird/blob/2c87fa623654c5eef76bc0226062290201eef13a/client/internal/debug/debug_linux.go#L50-L51
+          */
+          environment.SYSTEMD_UNIT = client.service.name;
+
+          path =
+            optionals config.networking.nftables.enable [ pkgs.nftables ]
+            ++ optionals (!config.networking.nftables.enable) [
+              pkgs.iptables
+              pkgs.ipset
+            ];
+        }
+      );
+    }
     # Hardening section
     (mkIf (hardenedClients != { }) {
       users.groups = toHardenedClientAttrs (client: nameValuePair client.user.group { });

From dd7b3992506debed272b96b21c31891264004a87 Mon Sep 17 00:00:00 2001
From: Krzysztof Nazarewski <gpg@kdn.im>
Date: Fri, 19 Sep 2025 11:39:50 +0200
Subject: [PATCH 3/3] nixos/netbird: allow reading journald messages

2025-09-19T10:50:03+02:00 ERRO client/internal/debug/debug.go:338: failed to add systemd logs: get systemd logs for netbird-priv: execute journalctl: exit status 1 (stderr: Hint: You are currently not seeing messages from other users and the system.
      Users in groups 'adm', 'systemd-journal', 'wheel' can see all messages.
      Pass -q to turn off this notice.
No journal files were opened due to insufficient permissions.
)
---
 nixos/modules/services/networking/netbird.nix | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/nixos/modules/services/networking/netbird.nix b/nixos/modules/services/networking/netbird.nix
index f6708907b667..036db3124562 100644
--- a/nixos/modules/services/networking/netbird.nix
+++ b/nixos/modules/services/networking/netbird.nix
@@ -585,6 +585,18 @@ in
             ];
         }
       );
+      users.users = toHardenedClientAttrs (
+        client:
+        nameValuePair client.user.name {
+          extraGroups = [
+            /*
+              allows debug bundles to gather systemd logs for `netbird*.service`
+              this is not ideal for hardening as it grants access to the whole journal, not just own logs
+            */
+            "systemd-journal"
+          ];
+        }
+      );
     }
     # Hardening section
     (mkIf (hardenedClients != { }) {