diff --git a/nixos/doc/manual/from_md/release-notes/rl-2211.section.xml b/nixos/doc/manual/from_md/release-notes/rl-2211.section.xml index f525e6a7fc4d..c3c3a5d92ecf 100644 --- a/nixos/doc/manual/from_md/release-notes/rl-2211.section.xml +++ b/nixos/doc/manual/from_md/release-notes/rl-2211.section.xml @@ -205,6 +205,13 @@ services.outline. + + + netbird, a zero + configuration VPN. Available as + services.netbird. + + persistent-evdev, diff --git a/nixos/doc/manual/release-notes/rl-2211.section.md b/nixos/doc/manual/release-notes/rl-2211.section.md index f0a0a026d8aa..0e0ae598b342 100644 --- a/nixos/doc/manual/release-notes/rl-2211.section.md +++ b/nixos/doc/manual/release-notes/rl-2211.section.md @@ -76,6 +76,9 @@ In addition to numerous new and upgraded packages, this release has the followin - [Outline](https://www.getoutline.com/), a wiki and knowledge base similar to Notion. Available as [services.outline](#opt-services.outline.enable). +- [netbird](https://netbird.io), a zero configuration VPN. + Available as [services.netbird](options.html#opt-services.netbird.enable). + - [persistent-evdev](https://github.com/aiberia/persistent-evdev), a daemon to add virtual proxy devices that mirror a physical input device but persist even if the underlying hardware is hot-plugged. Available as [services.persistent-evdev](#opt-services.persistent-evdev.enable). - [schleuder](https://schleuder.org/), a mailing list manager with PGP support. Enable using [services.schleuder](#opt-services.schleuder.enable). diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix index 31a4107b3eeb..e632a760f892 100644 --- a/nixos/modules/module-list.nix +++ b/nixos/modules/module-list.nix @@ -861,6 +861,7 @@ ./services/networking/nbd.nix ./services/networking/ndppd.nix ./services/networking/nebula.nix + ./services/networking/netbird.nix ./services/networking/networkmanager.nix ./services/networking/nextdns.nix ./services/networking/nftables.nix diff --git a/nixos/modules/services/networking/netbird.nix b/nixos/modules/services/networking/netbird.nix new file mode 100644 index 000000000000..806b72d5f3a7 --- /dev/null +++ b/nixos/modules/services/networking/netbird.nix @@ -0,0 +1,64 @@ +{ config, lib, pkgs, ... }: + +with lib; + +let + cfg = config.services.netbird; + kernel = config.boot.kernelPackages; + interfaceName = "wt0"; +in { + meta.maintainers = with maintainers; [ misuzu ]; + + options.services.netbird = { + enable = mkEnableOption "Netbird daemon"; + package = mkOption { + type = types.package; + default = pkgs.netbird; + defaultText = literalExpression "pkgs.netbird"; + description = "The package to use for netbird"; + }; + }; + + config = mkIf cfg.enable { + boot.extraModulePackages = optional (versionOlder kernel.kernel.version "5.6") kernel.wireguard; + + environment.systemPackages = [ cfg.package ]; + + networking.dhcpcd.denyInterfaces = [ interfaceName ]; + + systemd.network.networks."50-netbird" = mkIf config.networking.useNetworkd { + matchConfig = { + Name = interfaceName; + }; + linkConfig = { + Unmanaged = true; + ActivationPolicy = "manual"; + }; + }; + + systemd.services.netbird = { + description = "A WireGuard-based mesh network that connects your devices into a single private network"; + documentation = [ "https://netbird.io/docs/" ]; + after = [ "network.target" ]; + wantedBy = [ "multi-user.target" ]; + serviceConfig = { + AmbientCapabilities = [ "CAP_NET_ADMIN" ]; + DynamicUser = true; + Environment = [ + "NB_CONFIG=/var/lib/netbird/config.json" + "NB_LOG_FILE=console" + ]; + ExecStart = "${cfg.package}/bin/netbird service run"; + Restart = "always"; + RuntimeDirectory = "netbird"; + StateDirectory = "netbird"; + WorkingDirectory = "/var/lib/netbird"; + }; + unitConfig = { + StartLimitInterval = 5; + StartLimitBurst = 10; + }; + stopIfChanged = false; + }; + }; +} diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix index b6192a5f26ad..7e1ba8f5ed91 100644 --- a/nixos/tests/all-tests.nix +++ b/nixos/tests/all-tests.nix @@ -358,6 +358,7 @@ in { ncdns = handleTest ./ncdns.nix {}; ndppd = handleTest ./ndppd.nix {}; nebula = handleTest ./nebula.nix {}; + netbird = handleTest ./netbird.nix {}; neo4j = handleTest ./neo4j.nix {}; netdata = handleTest ./netdata.nix {}; networking.networkd = handleTest ./networking.nix { networkd = true; }; diff --git a/nixos/tests/netbird.nix b/nixos/tests/netbird.nix new file mode 100644 index 000000000000..ef793cfe9881 --- /dev/null +++ b/nixos/tests/netbird.nix @@ -0,0 +1,21 @@ +import ./make-test-python.nix ({ pkgs, lib, ... }: +{ + name = "netbird"; + + meta = with pkgs.lib.maintainers; { + maintainers = [ misuzu ]; + }; + + nodes = { + node = { ... }: { + services.netbird.enable = true; + }; + }; + + testScript = '' + start_all() + node.wait_for_unit("netbird.service") + node.wait_for_file("/var/run/netbird/sock") + node.succeed("netbird status | grep -q 'Daemon status: NeedsLogin'") + ''; +}) diff --git a/pkgs/tools/networking/netbird/default.nix b/pkgs/tools/networking/netbird/default.nix new file mode 100644 index 000000000000..0cd3972cc0c7 --- /dev/null +++ b/pkgs/tools/networking/netbird/default.nix @@ -0,0 +1,91 @@ +{ stdenv, lib, nixosTests, buildGoModule, fetchFromGitHub, installShellFiles +, pkg-config +, libayatana-appindicator, libX11, libXcursor, libXxf86vm +, Cocoa, IOKit, Kernel, UserNotifications, WebKit +, ui ? false }: +let + modules = if ui then { + "client/ui" = "netbird-ui"; + } else { + client = "netbird"; + management = "netbird-mgmt"; + signal = "netbird-signal"; + }; +in +buildGoModule rec { + pname = "netbird"; + version = "0.8.9"; + + src = fetchFromGitHub { + owner = "netbirdio"; + repo = pname; + rev = "v${version}"; + sha256 = "sha256-bQrfYbzYd6T9PD2lLuldp1pGoZKpU71bO1D1SXcoZ7M="; + }; + + vendorSha256 = "sha256-KtRQwrCBsOX7Jk9mKdDNOD7zfssADfBXCO1RPZbp5Aw="; + + nativeBuildInputs = [ installShellFiles ] ++ lib.optional ui pkg-config; + + buildInputs = lib.optionals (stdenv.isLinux && ui) [ + libayatana-appindicator + libX11 + libXcursor + libXxf86vm + ] ++ lib.optionals (stdenv.isDarwin && ui) [ + Cocoa + IOKit + Kernel + UserNotifications + WebKit + ]; + + subPackages = lib.attrNames modules; + + ldflags = [ + "-s" + "-w" + "-X github.com/netbirdio/netbird/client/system.version=${version}" + "-X main.builtBy=nix" + ]; + + # needs network access + doCheck = false; + + postPatch = '' + # make it compatible with systemd's RuntimeDirectory + substituteInPlace client/cmd/root.go \ + --replace 'unix:///var/run/netbird.sock' 'unix:///var/run/netbird/sock' + substituteInPlace client/ui/client_ui.go \ + --replace 'unix:///var/run/netbird.sock' 'unix:///var/run/netbird/sock' + ''; + + postInstall = lib.concatStringsSep "\n" (lib.mapAttrsToList + (module: binary: '' + mv $out/bin/${lib.last (lib.splitString "/" module)} $out/bin/${binary} + '' + lib.optionalString (!ui) '' + installShellCompletion --cmd ${binary} \ + --bash <($out/bin/${binary} completion bash) \ + --fish <($out/bin/${binary} completion fish) \ + --zsh <($out/bin/${binary} completion zsh) + '') + modules) + lib.optionalString (stdenv.isLinux && ui) '' + mkdir -p $out/share/pixmaps + cp $src/client/ui/disconnected.png $out/share/pixmaps/netbird.png + + mkdir -p $out/share/applications + cp $src/client/ui/netbird.desktop $out/share/applications/netbird.desktop + + substituteInPlace $out/share/applications/netbird.desktop \ + --replace "Exec=/usr/bin/netbird-ui" "Exec=$out/bin/netbird-ui" + ''; + + passthru.tests.netbird = nixosTests.netbird; + + meta = with lib; { + homepage = "https://netbird.io"; + description = "Connect your devices into a single secure private WireGuard®-based mesh network with SSO/MFA and simple access controls"; + license = licenses.bsd3; + maintainers = with maintainers; [ misuzu ]; + }; +} diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix index af3f931288b4..e0c305eefd1f 100644 --- a/pkgs/top-level/all-packages.nix +++ b/pkgs/top-level/all-packages.nix @@ -5150,6 +5150,14 @@ with pkgs; inherit (xorg) libXaw; }; + netbird = callPackage ../tools/networking/netbird { + inherit (darwin.apple_sdk_11_0.frameworks) Cocoa IOKit Kernel UserNotifications WebKit; + }; + + netbird-ui = netbird.override { + ui = true; + }; + netevent = callPackage ../tools/inputmethods/netevent { }; netplan = callPackage ../tools/admin/netplan { };