From 40b8b50c71384208caebd466806ceb9be7efb852 Mon Sep 17 00:00:00 2001
From: Quinn Unger <quinn.unger@pm.me>
Date: Fri, 31 Jul 2026 22:41:57 +0100
Subject: [PATCH] use latest netbird packages

---
 hosts/lala/netbird.nix | 125 ++++++++++++++++++++++-------------------
 1 file changed, 68 insertions(+), 57 deletions(-)

diff --git a/hosts/lala/netbird.nix b/hosts/lala/netbird.nix
index af2e2be..9c42b58 100644
--- a/hosts/lala/netbird.nix
+++ b/hosts/lala/netbird.nix
@@ -40,11 +40,13 @@ in
       3478
       10000
       relayPort
+      25565
     ];
     allowedUDPPorts = [
       3478
       5349
       relayPort
+      8211
     ];
     allowedUDPPortRanges = [
       {
@@ -151,69 +153,78 @@ in
     }
   ];
 
-  services.netbird.server = {
-    enable = true;
-    enableNginx = false;
-    domain = netbirdDomain;
-    signal.domain = netbirdDomain;
-
-    coturn = {
+  services.netbird = {
+    package = unstable.netbird;
+    server = {
       enable = true;
+      enableNginx = false;
       domain = netbirdDomain;
-      passwordFile = coturnPass;
-    };
 
-    dashboard = {
-      domain = netbirdDomain;
-      enableNginx = true;
-      # https://github.com/netbirdio/netbird/blob/b65ec8b68a6a1ab8aee162a7b9e5147c0375af68/infrastructure_files/getting-started.sh#L931
-      settings = {
-        NETBIRD_MGMT_API_ENDPOINT = netbirdUrl;
-        NETBIRD_MGMT_GRPC_API_ENDPOINT = netbirdUrl;
-        AUTH_AUDIENCE = "netbird-dashboard";
-        AUTH_CLIENT_ID = "netbird-dashboard";
-        AUTH_AUTHORITY = "${netbirdUrl}/oauth2";
-        AUTH_SUPPORTED_SCOPES = "openid profile email groups";
-        AUTH_REDIRECT_URI = "/nb-auth";
-        AUTH_SILENT_REDIRECT_URI = "/nb-silent-auth";
+      signal = {
+        package = unstable.netbird-signal;
+        domain = netbirdDomain;
       };
-    };
 
-    management = {
-      domain = netbirdDomain;
-      turnDomain = netbirdDomain;
-      oidcConfigEndpoint = "${netbirdUrl}/oauth2/.well-known/openid-configuration";
-      settings = {
-        Signal.URI = "${netbirdDomain}:443";
-        TURNConfig = {
-          Secret._secret = coturnPass;
-          CredentialsTTL = "12h";
-          TimeBasedCredentials = false;
-          Turns = [
-            {
-              Password._secret = coturnPass;
-              proto = "udp";
-              URI = "turn:${netbirdDomain}:3478";
-              Username = "netbird";
-            }
-          ];
-        };
-        Relay = {
-          Addresses = [ "rels://${netbirdDomain}:33080" ];
-          CredentialsTTL = "24h";
-          Secret._secret = relaySecret;
+      coturn = {
+        enable = true;
+        domain = netbirdDomain;
+        passwordFile = coturnPass;
+      };
+
+      dashboard = {
+        package = unstable.netbird-dashboard;
+        domain = netbirdDomain;
+        enableNginx = true;
+        # https://github.com/netbirdio/netbird/blob/b65ec8b68a6a1ab8aee162a7b9e5147c0375af68/infrastructure_files/getting-started.sh#L931
+        settings = {
+          NETBIRD_MGMT_API_ENDPOINT = netbirdUrl;
+          NETBIRD_MGMT_GRPC_API_ENDPOINT = netbirdUrl;
+          AUTH_AUDIENCE = "netbird-dashboard";
+          AUTH_CLIENT_ID = "netbird-dashboard";
+          AUTH_AUTHORITY = "${netbirdUrl}/oauth2";
+          AUTH_SUPPORTED_SCOPES = "openid profile email groups";
+          AUTH_REDIRECT_URI = "/nb-auth";
+          AUTH_SILENT_REDIRECT_URI = "/nb-silent-auth";
         };
-        DataStoreEncryptionKey._secret = dataStoreKey;
-        EmbeddedIdP = {
-          Enabled = true;
-          DataDir = "${stateDir}/idp";
-          Issuer = "${netbirdUrl}/oauth2";
-          DashboardRedirectURIs = [
-            "${netbirdUrl}/nb-auth"
-            "${netbirdUrl}/nb-silent-auth"
-          ];
+      };
+
+      management = {
+        package = unstable.netbird-management;
+        domain = netbirdDomain;
+        turnDomain = netbirdDomain;
+        oidcConfigEndpoint = "${netbirdUrl}/oauth2/.well-known/openid-configuration";
+        settings = {
+          Signal.URI = "${netbirdDomain}:443";
+          TURNConfig = {
+            Secret._secret = coturnPass;
+            CredentialsTTL = "12h";
+            TimeBasedCredentials = false;
+            Turns = [
+              {
+                Password._secret = coturnPass;
+                proto = "udp";
+                URI = "turn:${netbirdDomain}:3478";
+                Username = "netbird";
+              }
+            ];
+          };
+          Relay = {
+            Addresses = [ "rels://${netbirdDomain}:33080" ];
+            CredentialsTTL = "24h";
+            Secret._secret = relaySecret;
+          };
+          DataStoreEncryptionKey._secret = dataStoreKey;
+          EmbeddedIdP = {
+            Enabled = true;
+            DataDir = "${stateDir}/idp";
+            Issuer = "${netbirdUrl}/oauth2";
+            DashboardRedirectURIs = [
+              "${netbirdUrl}/nb-auth"
+              "${netbirdUrl}/nb-silent-auth"
+            ];
+          };
+          EncryptionKey._secret = idpKey;
         };
-        EncryptionKey._secret = idpKey;
       };
     };
   };
@@ -239,7 +250,7 @@ in
       };
       serviceConfig = {
         EnvironmentFile = relaySecretEnv;
-        ExecStart = lib.getExe pkgs.netbird-relay;
+        ExecStart = lib.getExe unstable.netbird-relay;
         Restart = "always";
 
         # hardening
-- 
2.54.0