@r8s/netbird 0.3.4

package/dist/index.d.ts

@@ -0,0 +1,245 @@
+import { type DatabaseProps } from '@r8s/recipes';
+/**
+ * Keycloak is the documented IdP (docs.netbird.io → Self-hosted → Identity
+ * providers → Keycloak): a dedicated `netbird` realm with a confidential
+ * OIDC client `netbird`. The
+ * management store uses client credentials (`client_credentials` grant) —
+ * render that client with `<Client groupsClaim>` (the Auth recipe) so
+ * Keycloak puts group memberships in the JWT `groups` claim for
+ * user-group sync; netbird reads the claim, this package only carries the
+ * identity endpoints derived from `issuer`.
+ */
+export interface NetbirdIdpProps {
+    /**
+     * OIDC issuer, e.g. 'https://auth.example.com/realms/netbird'. Token,
+     * JWKS, device-authorize and authorize endpoints are derived from it
+     * (Keycloak realm layout: <issuer>/protocol/openid-connect/...).
+     *
+     * Alternative: pass `realm` + `host` instead and the issuer is derived
+     * as `https://<host>/realms/<realm>` — the Auth recipe's layout. The
+     * two forms are mutually exclusive.
+     */
+    issuer?: string;
+    /** OIDC client id — the confidential `netbird` client in the realm */
+    clientId: string;
+    /**
+     * Reference a pre-created Secret holding the client secret (key:
+     * `client-secret`). Payload: the OIDC client's secret from the
+     * Keycloak realm (Clients → netbird → Credentials). Without it the
+     * secrets backend provisions `${name}-oidc` from the store path.
+     */
+    clientSecretRef?: string;
+    /**
+     * Keycloak realm name — with `host`, derives the issuer as
+     * `https://<host>/realms/<realm>` (mirrors <Realm id="netbird"> in the
+     * Auth recipe on the same host). Mutually exclusive with `issuer`.
+     */
+    realm?: string;
+    /**
+     * Auth hostname (the AUTH host, NOT <Netbird host>) — with `realm`,
+     * derives the issuer as `https://<host>/realms/<realm>`. Mutually
+     * exclusive with `issuer`.
+     */
+    host?: string;
+}
+export interface NetbirdProps {
+    /** Release / chart name (defaults to 'netbird'; also the namespace-internal resource prefix) */
+    name?: string;
+    /** Kubernetes namespace for the release + data (inherited from <Platform> unless set) */
+    namespace?: string;
+    /**
+     * Single public hostname: dashboard, management API/gRPC, signal and
+     * relay are all routed on it (ingress-nginx merges the rules; TLS via
+     * one shared certificate).
+     */
+    host: string;
+    /**
+     * Keycloak OIDC identity provider wired into the management config.
+     *
+     * Group sync with the Auth recipe: give the realm's `netbird` client
+     * <Client groupsClaim> so Keycloak puts group memberships in the JWT
+     * `groups` claim — Netbird auto-creates groups from it (map Netbird
+     * policies to those groups). Netbird's Keycloak group/user reads
+     * authenticate via client_credentials — grant the netbird client's
+     * service account the realm-management view-users/view-groups roles
+     * (a dedicated `netbird-manager` client is the upstream pattern for
+     * splitting those reads onto separate credentials). See the compose
+     * example below.
+     */
+    idp: NetbirdIdpProps;
+    /**
+     * Expose the relay Service as a raw LoadBalancer on this TCP port in
+     * addition to the `rels://host:443/relay` ingress path. The chart's
+     * relay is the TCP websocket relay — it does NOT speak UDP, and the
+     * chart ships no coturn: add an external STUN/TURN server (+ its own
+     * LoadBalancer) separately if peers need it.
+     */
+    relayPort?: number;
+    /**
+     * Chart version (defaults to the pinned '1.9.0'). Flux applies chart
+     * upgrades automatically on the repo interval — bump deliberately.
+     */
+    chartVersion?: string;
+    /** HelmRepository URL (defaults to https://netbirdio.github.io/helms — the gh-pages index of netbirdio/helms) */
+    repoUrl?: string;
+    /** Namespace the HelmRepository lives in (defaults to 'flux-system') */
+    repoNamespace?: string;
+    /**
+     * Image tag for the three core services (management, signal, relay —
+     * netbirdio/{management,signal,relay}). Defaults to '0.46.0', the
+     * chart 1.9.0 appVersion the management.json template is written
+     * against — newer netbird images may expect a different config shape,
+     * so bump chart + images together. PINNED — 'latest' is rejected. The
+     * dashboard keeps its own chart default (v2.13.1, also pinned).
+     */
+    imageTag?: string;
+    /**
+     * Management data PVC sizing. The chart only needs it for the sqlite
+     * store — with the CNPG Postgres contract below the management data
+     * dir is disposable, so the PVC is DISABLED by default. Pass a size
+     * (e.g. '1Gi') to keep it, or `false` to disable it explicitly.
+     */
+    storage?: string | false;
+    /** CNPG cluster name (defaults to 'netbird-db'). Database + owner are 'netbird'. */
+    dbName?: string;
+    /** Number of CNPG instances (defaults to 2) */
+    dbInstances?: number;
+    /** CNPG data volume size (defaults to '10Gi' — management store, small) */
+    dbStorage?: string;
+    /** CNPG storage class (defaults to cluster default) */
+    dbStorageClass?: string;
+    /** CNPG backup passthrough — defaults to **enabled** via the platform S3Provider; `false` opts out */
+    backup?: DatabaseProps['backup'];
+    /**
+     * Reference a pre-created Secret holding the relay auth secret + the
+     * datastore encryption key (keys `relay-secret`,
+     * `datastore-encryption-key`) instead of backend provisioning. The
+     * relay secret also travels to peers in management.json — rotating it
+     * restarts management + relay.
+     */
+    credentialsSecretName?: string;
+    /** User-ID claim netbird matches accounts on (e.g. 'preferred_username' — depends on the IdP mapper) */
+    userIdClaim?: string;
+    /** TLS: one shared cert for every ingress the chart creates (defaults to `netbird-tls` via letsencrypt-prod). The cert-manager annotation sits on the dashboard catch-all ingress only — the other ingresses reference the same secret without triggering duplicate issuances (LE duplicate-cert limit is 5/week). */
+    tls?: {
+        secretName: string;
+        clusterIssuer: string;
+    };
+}
+/**
+ * Netbird — WireGuard-based mesh VPN (management + signal + relay +
+ * dashboard behind one hostname), facit-aligned via the official chart.
+ *
+ * @title Netbird
+ * @category Networking
+ *
+ * The chart owns all app workloads (management/signal/relay/dashboard +
+ * their services and ingresses). This package owns the platform contract
+ * around it:
+ * - Flux `HelmRepository` + `HelmRelease` (pinned chart, facit values).
+ *   netbirdio publishes packaged chart .tgz releases against a gh-pages
+ *   Helm index (no OCI artifact exists) — a plain HelmRepository works.
+ * - external CNPG cluster (`credentialsMode: 'cnpg'`): the management
+ *   store reads the DSN from the CNPG-generated `<db>-app` secret's
+ *   `fqdn-uri` key via `management.envFromSecret` — the raw DSN never
+ *   appears in rendered YAML beyond its secretKeyRef
+ * - management.json rendered into the chart's `management.configmap`
+ *   with `{{ .VAR }}` env placeholders (netbird ≥ 0.30.1 substitutes
+ *   them from process env — the chart's own IdP examples rely on it)
+ * - IdP credentials + relay secret + datastore encryption key via the
+ *   Platform secrets backend (pre-created Secret references win)
+ * - cert-manager TLS on the dashboard catch-all ingress; the management/
+ *   gRPC/signal/relay ingresses reference the same TLS secret
+ * - optional raw LoadBalancer face for the relay via `relayPort`
+ *
+ * Encoded decisions (do not "fix" these):
+ * - NO Stuns/TURNConfig entries: the chart deploys no coturn server and
+ *   pointing peers at a dead `host:3478` is worse than none — peers
+ *   connect via the relay (rels://host:443/relay); add an external
+ *   STUN/TURN server if you need direct hairpin/wifi-less connectivity
+ * - `useBackwardsGrpcService: true` (the chart's own tested example):
+ *   the management gRPC ingress routes to the dedicated 33073 listener
+ * - `persistentVolume.enabled: false` (facit: postgres-backed store —
+ *   the docker-compose template also ships `"Datadir": ""` for postgres)
+ * - images pinned to the chart appVersion (0.46.0); chart 1.9.0's
+ *   management.json schema matches that generation — bump together
+ *
+ * @example
+ * import { Platform, S3Provider, MinIO } from '@r8s/recipes'
+ * import { Netbird } from '@r8s/netbird'
+ *
+ * // CNPG backups derive from the S3Provider; the IdP client secret +
+ * // relay/datastore credentials provision from the openbao store
+ * export default (
+ *   <S3Provider
+ *     provider={
+ *       <MinIO endpoint="https://rustfs:9000" bucket="infra" credentialsSecret="infra-s3-creds" />
+ *     }
+ *   >
+ *     <Platform secrets={{ backend: 'openbao', mount: 'secret', path: 'apps' }}>
+ *       <Netbird
+ *         host="netbird.example.com"
+ *         idp={{
+ *           issuer: 'https://auth.example.com/realms/netbird',
+ *           clientId: 'netbird',
+ *         }}
+ *       />
+ *     </Platform>
+ *   </S3Provider>
+ * )
+ *
+ * @example
+ * // Compose with the Auth recipe — realm-level group sync for policies
+ * import { Platform, S3Provider, MinIO, Auth } from '@r8s/recipes'
+ * import { Realms, Realm, Clients, Client } from '@r8s/recipes/auth'
+ * import { Netbird } from '@r8s/netbird'
+ *
+ * // groupsClaim puts Keycloak group memberships in the JWT `groups`
+ * // claim — Netbird auto-creates groups from it (map Netbird policies
+ * // to those groups). Netbird's group/user reads authenticate via
+ * // client_credentials — grant the netbird client's service account
+ * // realm-management view-users/view-groups; `netbird-manager` is the
+ * // upstream pattern for splitting those reads onto separate
+ * // credentials. localhost:53000 is the netbird CLI/desktop PKCE
+ * // redirect; the auth host gets TLS so the https issuer is reachable.
+ * export default (
+ *   <S3Provider
+ *     provider={
+ *       <MinIO endpoint="https://rustfs:9000" bucket="infra" credentialsSecret="infra-s3-creds" />
+ *     }
+ *   >
+ *     <Platform secrets={{ backend: 'openbao', mount: 'secret', path: 'apps' }}>
+ *       <Auth
+ *         name="auth"
+ *         host="auth.example.com"
+ *         tls={{ secretName: 'auth-tls', clusterIssuer: 'letsencrypt-prod' }}
+ *       >
+ *         <Realms>
+ *           <Realm id="netbird" displayName="Netbird">
+ *             <Clients>
+ *               <Client
+ *                 id="netbird"
+ *                 type="confidential"
+ *                 redirectUris={['https://netbird.example.com/*', 'http://localhost:53000']}
+ *                 groupsClaim
+ *                 clientScopes={['api']}
+ *               />
+ *               <Client id="netbird-manager" type="confidential" />
+ *             </Clients>
+ *           </Realm>
+ *         </Realms>
+ *       </Auth>
+ *       <Netbird
+ *         host="netbird.example.com"
+ *         idp={{
+ *           issuer: 'https://auth.example.com/realms/netbird',
+ *           clientId: 'netbird',
+ *           clientSecretRef: 'netbird-oidc',
+ *         }}
+ *       />
+ *     </Platform>
+ *   </S3Provider>
+ * )
+ */
+export declare function Netbird(props: NetbirdProps): import("@r8s/core").r8sElement;
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.tsx"],"names":[],"mappings":"AAEA,OAAO,EAML,KAAK,aAAa,EACnB,MAAM,cAAc,CAAA;AAErB;;;;;;;;;GASG;AACH,MAAM,WAAW,eAAe;IAC9B;;;;;;;;OAQG;IACH,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,sEAAsE;IACtE,QAAQ,EAAE,MAAM,CAAA;IAChB;;;;;OAKG;IACH,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB;;;;OAIG;IACH,KAAK,CAAC,EAAE,MAAM,CAAA;IACd;;;;OAIG;IACH,IAAI,CAAC,EAAE,MAAM,CAAA;CACd;AAED,MAAM,WAAW,YAAY;IAC3B,gGAAgG;IAChG,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,yFAAyF;IACzF,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB;;;;OAIG;IACH,IAAI,EAAE,MAAM,CAAA;IACZ;;;;;;;;;;;;OAYG;IACH,GAAG,EAAE,eAAe,CAAA;IACpB;;;;;;OAMG;IACH,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB;;;OAGG;IACH,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,iHAAiH;IACjH,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,wEAAwE;IACxE,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB;;;;;;;OAOG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB;;;;;OAKG;IACH,OAAO,CAAC,EAAE,MAAM,GAAG,KAAK,CAAA;IACxB,oFAAoF;IACpF,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,+CAA+C;IAC/C,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,2EAA2E;IAC3E,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,uDAAuD;IACvD,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,sGAAsG;IACtG,MAAM,CAAC,EAAE,aAAa,CAAC,QAAQ,CAAC,CAAA;IAChC;;;;;;OAMG;IACH,qBAAqB,CAAC,EAAE,MAAM,CAAA;IAC9B,wGAAwG;IACxG,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,sTAAsT;IACtT,GAAG,CAAC,EAAE;QACJ,UAAU,EAAE,MAAM,CAAA;QAClB,aAAa,EAAE,MAAM,CAAA;KACtB,CAAA;CACF;AAaD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkHG;AACH,wBAAgB,OAAO,CAAC,KAAK,EAAE,YAAY,kCAwd1C"}

package/dist/index.js

@@ -0,0 +1,539 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.Netbird = Netbird;
+const core_1 = require("@r8s/core");
+const defaults_1 = require("@r8s/core/defaults");
+const recipes_1 = require("@r8s/recipes");
+/**
+ * One env entry backed by a secretKeyRef (the chart's `envRaw` contract —
+ * structured valueFrom objects, the plaintext-free way to inject secrets).
+ */
+function secretEnv(name, secretName, key) {
+    return {
+        name,
+        valueFrom: { secretKeyRef: { name: secretName, key } },
+    };
+}
+/**
+ * Netbird — WireGuard-based mesh VPN (management + signal + relay +
+ * dashboard behind one hostname), facit-aligned via the official chart.
+ *
+ * @title Netbird
+ * @category Networking
+ *
+ * The chart owns all app workloads (management/signal/relay/dashboard +
+ * their services and ingresses). This package owns the platform contract
+ * around it:
+ * - Flux `HelmRepository` + `HelmRelease` (pinned chart, facit values).
+ *   netbirdio publishes packaged chart .tgz releases against a gh-pages
+ *   Helm index (no OCI artifact exists) — a plain HelmRepository works.
+ * - external CNPG cluster (`credentialsMode: 'cnpg'`): the management
+ *   store reads the DSN from the CNPG-generated `<db>-app` secret's
+ *   `fqdn-uri` key via `management.envFromSecret` — the raw DSN never
+ *   appears in rendered YAML beyond its secretKeyRef
+ * - management.json rendered into the chart's `management.configmap`
+ *   with `{{ .VAR }}` env placeholders (netbird ≥ 0.30.1 substitutes
+ *   them from process env — the chart's own IdP examples rely on it)
+ * - IdP credentials + relay secret + datastore encryption key via the
+ *   Platform secrets backend (pre-created Secret references win)
+ * - cert-manager TLS on the dashboard catch-all ingress; the management/
+ *   gRPC/signal/relay ingresses reference the same TLS secret
+ * - optional raw LoadBalancer face for the relay via `relayPort`
+ *
+ * Encoded decisions (do not "fix" these):
+ * - NO Stuns/TURNConfig entries: the chart deploys no coturn server and
+ *   pointing peers at a dead `host:3478` is worse than none — peers
+ *   connect via the relay (rels://host:443/relay); add an external
+ *   STUN/TURN server if you need direct hairpin/wifi-less connectivity
+ * - `useBackwardsGrpcService: true` (the chart's own tested example):
+ *   the management gRPC ingress routes to the dedicated 33073 listener
+ * - `persistentVolume.enabled: false` (facit: postgres-backed store —
+ *   the docker-compose template also ships `"Datadir": ""` for postgres)
+ * - images pinned to the chart appVersion (0.46.0); chart 1.9.0's
+ *   management.json schema matches that generation — bump together
+ *
+ * @example
+ * import { Platform, S3Provider, MinIO } from '@r8s/recipes'
+ * import { Netbird } from '@r8s/netbird'
+ *
+ * // CNPG backups derive from the S3Provider; the IdP client secret +
+ * // relay/datastore credentials provision from the openbao store
+ * export default (
+ *   <S3Provider
+ *     provider={
+ *       <MinIO endpoint="https://rustfs:9000" bucket="infra" credentialsSecret="infra-s3-creds" />
+ *     }
+ *   >
+ *     <Platform secrets={{ backend: 'openbao', mount: 'secret', path: 'apps' }}>
+ *       <Netbird
+ *         host="netbird.example.com"
+ *         idp={{
+ *           issuer: 'https://auth.example.com/realms/netbird',
+ *           clientId: 'netbird',
+ *         }}
+ *       />
+ *     </Platform>
+ *   </S3Provider>
+ * )
+ *
+ * @example
+ * // Compose with the Auth recipe — realm-level group sync for policies
+ * import { Platform, S3Provider, MinIO, Auth } from '@r8s/recipes'
+ * import { Realms, Realm, Clients, Client } from '@r8s/recipes/auth'
+ * import { Netbird } from '@r8s/netbird'
+ *
+ * // groupsClaim puts Keycloak group memberships in the JWT `groups`
+ * // claim — Netbird auto-creates groups from it (map Netbird policies
+ * // to those groups). Netbird's group/user reads authenticate via
+ * // client_credentials — grant the netbird client's service account
+ * // realm-management view-users/view-groups; `netbird-manager` is the
+ * // upstream pattern for splitting those reads onto separate
+ * // credentials. localhost:53000 is the netbird CLI/desktop PKCE
+ * // redirect; the auth host gets TLS so the https issuer is reachable.
+ * export default (
+ *   <S3Provider
+ *     provider={
+ *       <MinIO endpoint="https://rustfs:9000" bucket="infra" credentialsSecret="infra-s3-creds" />
+ *     }
+ *   >
+ *     <Platform secrets={{ backend: 'openbao', mount: 'secret', path: 'apps' }}>
+ *       <Auth
+ *         name="auth"
+ *         host="auth.example.com"
+ *         tls={{ secretName: 'auth-tls', clusterIssuer: 'letsencrypt-prod' }}
+ *       >
+ *         <Realms>
+ *           <Realm id="netbird" displayName="Netbird">
+ *             <Clients>
+ *               <Client
+ *                 id="netbird"
+ *                 type="confidential"
+ *                 redirectUris={['https://netbird.example.com/*', 'http://localhost:53000']}
+ *                 groupsClaim
+ *                 clientScopes={['api']}
+ *               />
+ *               <Client id="netbird-manager" type="confidential" />
+ *             </Clients>
+ *           </Realm>
+ *         </Realms>
+ *       </Auth>
+ *       <Netbird
+ *         host="netbird.example.com"
+ *         idp={{
+ *           issuer: 'https://auth.example.com/realms/netbird',
+ *           clientId: 'netbird',
+ *           clientSecretRef: 'netbird-oidc',
+ *         }}
+ *       />
+ *     </Platform>
+ *   </S3Provider>
+ * )
+ */
+function Netbird(props) {
+    const { name = 'netbird', namespace: namespaceProp, host, idp, relayPort, chartVersion = '1.9.0', repoUrl = 'https://netbirdio.github.io/helms', repoNamespace = 'flux-system', imageTag = '0.46.0', storage, dbName = 'netbird-db', dbInstances = 2, dbStorage = '10Gi', dbStorageClass, backup, credentialsSecretName, userIdClaim = '', tls = { secretName: `${name}-tls`, clusterIssuer: 'letsencrypt-prod' }, } = props;
+    const namespace = (0, defaults_1.useNamespace)(namespaceProp);
+    const secretProvider = (0, core_1.useContext)(defaults_1.SecretContext);
+    const resources_ = [];
+    // --- IdP issuer (explicit, or derived from the Auth recipe's realm layout) ---
+    if (idp.issuer && (idp.realm || idp.host)) {
+        throw new Error(`Netbird "${name}": idp.issuer and idp.realm + idp.host are mutually exclusive.\n` +
+            `\n` +
+            `Both describe the same Keycloak OIDC issuer — mixing them is\n` +
+            `ambiguous about which realm actually backs the mesh.\n` +
+            `\n` +
+            `Fix: keep one form —\n` +
+            `  idp={{ issuer: 'https://auth.example.com/realms/netbird', ... }}  or\n` +
+            `  idp={{ realm: 'netbird', host: 'auth.example.com', ... }}`);
+    }
+    if (!idp.issuer && !(idp.realm && idp.host)) {
+        throw new Error(`Netbird "${name}": the OIDC issuer is required — give idp.issuer, or\n` +
+            `idp.realm + idp.host to derive it as https://<host>/realms/<realm>\n` +
+            `(the Auth recipe's <Realm id=...> on the <Auth host>).\n` +
+            `\n` +
+            `Fix: idp={{ realm: 'netbird', host: 'auth.example.com', clientId: 'netbird' }}`);
+    }
+    const issuer = idp.issuer ??
+        `https://${idp.host.replace(/\/+$/, '')}/realms/${idp.realm.replace(/^\/+|\/+$/g, '')}`;
+    // --- Pinned-version policy ---------------------------------------------------
+    if (chartVersion === 'latest') {
+        throw new Error(`Netbird "${name}" requires a pinned chartVersion.\n` +
+            `\n` +
+            `A rejected floating chart breaks the pinned-images invariant (the\n` +
+            `chart's management.json template moves with its appVersion) and an\n` +
+            `untested upgrade can strand every peer.\n` +
+            `\n` +
+            `Fix: <Netbird chartVersion="1.9.0" ... />  (pin the imageTag to match)`);
+    }
+    if (imageTag === 'latest') {
+        throw new Error(`Netbird "${name}" requires a pinned imageTag.\n` +
+            `\n` +
+            `Chart ${chartVersion} renders management.json for its appVersion\n` +
+            `generation — floating netbird images can expect a different config\n` +
+            `shape on the next pull.\n` +
+            `\n` +
+            `Fix: <Netbird imageTag="0.46.0" ... />  (bump chart + images together)`);
+    }
+    if (storage !== undefined &&
+        storage !== false &&
+        // k8s quantity suffixes: binary (Ki/Mi/Gi/Ti/Pi/Ei) + decimal
+        // (k/M/G/T/P/E — note decimal kilo is LOWERCASE k; 'K' is invalid)
+        !/^\d+(\.\d+)?(Ei|Pi|Ti|Gi|Mi|Ki|E|P|T|G|M|k)$/.test(storage)) {
+        throw new Error(`Netbird "${name}": storage must be a Kubernetes (binary or decimal) quantity\n` +
+            `(e.g. '1Gi', '1G', '100M', '2.5Ti'), got "${storage}".`);
+    }
+    // --- IdP client secret (pre-created wins; else backend provisions) ----------
+    const oidcSecretName = idp.clientSecretRef ?? `${name}-oidc`;
+    if (!idp.clientSecretRef) {
+        if (!(0, recipes_1.canProvisionSecrets)(secretProvider)) {
+            throw (0, recipes_1.secretsRequiredError)('Netbird', name, 'the OIDC client secret for the Keycloak netbird client (key client-secret)', {
+                propName: 'idp.clientSecretRef',
+                exampleValue: `${name}-oidc`,
+                keys: ['client-secret'],
+            });
+        }
+        resources_.push((0, core_1.jsx)(recipes_1.StaticSecret, {
+            name: `${name}-oidc`,
+            namespace,
+            path: `${secretProvider.path ?? name}/${name}/oidc`,
+            secretName: oidcSecretName,
+            keys: { 'client-secret': 'client_secret' },
+            restart: [{ kind: 'Deployment', name: `${name}-management` }],
+        }));
+    }
+    // --- Relay secret + datastore encryption key bundle ---------------------------
+    const credentialsName = credentialsSecretName ?? `${name}-credentials`;
+    if (!credentialsSecretName) {
+        if (!(0, recipes_1.canProvisionSecrets)(secretProvider)) {
+            throw (0, recipes_1.secretsRequiredError)('Netbird', name, 'the relay auth secret + datastore encryption key (keys relay-secret, datastore-encryption-key)', {
+                propName: 'credentialsSecretName',
+                exampleValue: `${name}-credentials`,
+                keys: ['relay-secret', 'datastore-encryption-key'],
+            });
+        }
+        resources_.push((0, core_1.jsx)(recipes_1.StaticSecret, {
+            name: `${name}-credentials`,
+            namespace,
+            path: `${secretProvider.path ?? name}/${name}/credentials`,
+            secretName: credentialsName,
+            keys: {
+                'relay-secret': 'relay_secret',
+                'datastore-encryption-key': 'datastore_encryption_key',
+            },
+            restart: [
+                { kind: 'Deployment', name: `${name}-management` },
+                { kind: 'Deployment', name: `${name}-relay` },
+            ],
+        }));
+    }
+    // --- CNPG cluster (CNPG-managed credentials: the -app fqdn-uri is the DSN) ---
+    const dbCredentialsRef = (0, recipes_1.databaseCredentialsRef)(dbName, secretProvider, 'cnpg');
+    resources_.push((0, core_1.jsx)(recipes_1.Database, {
+        backup: backup ?? true,
+        name: dbName,
+        namespace,
+        database: 'netbird',
+        owner: 'netbird',
+        instances: dbInstances,
+        storage: dbStorage,
+        ...(dbStorageClass ? { storageClass: dbStorageClass } : {}),
+        parameters: {
+            shared_buffers: '128MB',
+            max_connections: '100',
+        },
+        credentialsMode: 'cnpg',
+    }));
+    // --- Derived identity endpoints (Keycloak realm layout) -----------------------
+    const jwks = `${issuer.replace(/\/$/, '')}/protocol/openid-connect/certs`;
+    const tokenEndpoint = `${issuer.replace(/\/$/, '')}/protocol/openid-connect/token`;
+    const oidcConfigEndpoint = `${issuer.replace(/\/$/, '')}/.well-known/openid-configuration`;
+    // management.json — {{ .VAR }} placeholders are substituted by the
+    // management binary from process env (netbird ≥ 0.30.1), the mechanism
+    // the chart's own IdP examples rely on. Secrets stay env-only: the
+    // rendered configmap carries placeholders, never values.
+    const managementConfig = JSON.stringify({
+        Stuns: [],
+        TURNConfig: {
+            Turns: [],
+            CredentialsTTL: '12h0m0s',
+            Secret: 'secret',
+            TimeBasedCredentials: false,
+        },
+        Relay: {
+            // The chart's relay ingress terminates TLS at host:443
+            Addresses: [`rels://${host}:443/relay`],
+            CredentialsTTL: '24h',
+            Secret: '{{ .RELAY_PASSWORD }}',
+        },
+        Signal: {
+            Proto: 'https',
+            URI: `${host}:443`,
+            Username: '',
+            Password: '',
+        },
+        ReverseProxy: {
+            TrustedHTTPProxies: null,
+            TrustedHTTPProxiesCount: 0,
+            TrustedPeers: null,
+        },
+        Datadir: '',
+        DataStoreEncryptionKey: '{{ .DATASTORE_ENCRYPTION_KEY }}',
+        StoreConfig: {
+            // external CNPG Postgres — the DSN travels via env only
+            Engine: 'postgres',
+        },
+        HttpConfig: {
+            LetsEncryptDomain: '',
+            CertFile: '',
+            CertKey: '',
+            AuthAudience: '{{ .IDP_CLIENT_ID }}',
+            AuthIssuer: '{{ .NETBIRD_AUTH_ISSUER }}',
+            AuthUserIDClaim: userIdClaim,
+            AuthKeysLocation: '{{ .NETBIRD_AUTH_JWT_CERTS }}',
+            IdpSignKeyRefreshEnabled: false,
+            OIDCConfigEndpoint: '{{ .NETBIRD_AUTH_OIDC_CONFIGURATION_ENDPOINT }}',
+        },
+        IdpManagerConfig: {
+            ManagerType: 'keycloak',
+            ClientConfig: {
+                Issuer: '{{ .NETBIRD_AUTH_ISSUER }}',
+                TokenEndpoint: '{{ .NETBIRD_AUTH_TOKEN_ENDPOINT }}',
+                ClientID: '{{ .IDP_CLIENT_ID }}',
+                ClientSecret: '{{ .IDP_CLIENT_SECRET }}',
+                GrantType: 'client_credentials',
+            },
+            KeycloakClientCredentials: {
+                ClientID: '{{ .IDP_CLIENT_ID }}',
+                ClientSecret: '{{ .IDP_CLIENT_SECRET }}',
+                GrantType: 'client_credentials',
+            },
+            ExtraConfig: null,
+            Auth0ClientCredentials: null,
+            AzureClientCredentials: null,
+            ZitadelClientCredentials: null,
+        },
+        DeviceAuthorizationFlow: {
+            Provider: 'hosted',
+            ProviderConfig: {
+                ClientID: '{{ .IDP_CLIENT_ID }}',
+                ClientSecret: '',
+                Domain: '',
+                Audience: '{{ .IDP_CLIENT_ID }}',
+                TokenEndpoint: '{{ .NETBIRD_AUTH_TOKEN_ENDPOINT }}',
+                DeviceAuthEndpoint: `${issuer.replace(/\/$/, '')}/protocol/openid-connect/auth/device`,
+                AuthorizationEndpoint: '',
+                Scope: 'openid',
+                UseIDToken: false,
+                RedirectURLs: null,
+            },
+        },
+        PKCEAuthorizationFlow: {
+            Provider: 'hosted',
+            ProviderConfig: {
+                ClientID: '{{ .IDP_CLIENT_ID }}',
+                ClientSecret: '{{ .IDP_CLIENT_SECRET }}',
+                Domain: '',
+                Audience: '{{ .IDP_CLIENT_ID }}',
+                TokenEndpoint: '{{ .NETBIRD_AUTH_TOKEN_ENDPOINT }}',
+                DeviceAuthEndpoint: '',
+                AuthorizationEndpoint: `${issuer.replace(/\/$/, '')}/protocol/openid-connect/auth`,
+                Scope: 'openid profile email offline_access api',
+                UseIDToken: false,
+                DisablePromptLogin: true,
+                // netbird ≥ 0.44 models LoginFlag as common.LoginFlag (uint8 enum:
+                // 0 = LoginFlagPrompt, 1 = LoginFlagMaxAge0; no custom
+                // UnmarshalJSON) — management 0.46.0 rejects a raw bool at
+                // config parse ("cannot unmarshal bool into Go struct field
+                // ... LoginFlag of type common.LoginFlag"). 0 (LoginFlagPrompt)
+                // is the Go zero value and behavior-neutral behind
+                // DisablePromptLogin: only consumed in client/internal/auth/
+                // pkce_flow.go when DisablePromptLogin is false.
+                LoginFlag: 0,
+                RedirectURLs: ['http://localhost:53000'],
+            },
+        },
+    }, null, '  ');
+    // --- Common ingress config -----------------------------------------------------
+    const grpcTimeouts = {
+        'nginx.ingress.kubernetes.io/backend-protocol': 'GRPC',
+        'nginx.ingress.kubernetes.io/ssl-redirect': 'true',
+        'nginx.ingress.kubernetes.io/proxy-read-timeout': '3600',
+        'nginx.ingress.kubernetes.io/proxy-send-timeout': '3600',
+    };
+    const tlsEntry = [{ secretName: tls.secretName, hosts: [host] }];
+    // --- Flux: HelmRepository + HelmRelease (facit values, decisions encoded) ------
+    resources_.push((0, core_1.jsx)('HelmRepository', {
+        apiVersion: 'source.toolkit.fluxcd.io/v1',
+        kind: 'HelmRepository',
+        metadata: { name, namespace: repoNamespace },
+        spec: { interval: '24h', url: repoUrl },
+    }), (0, core_1.jsx)('HelmRelease', {
+        apiVersion: 'helm.toolkit.fluxcd.io/v2',
+        kind: 'HelmRelease',
+        metadata: { name, namespace },
+        spec: {
+            interval: '30m',
+            chart: {
+                spec: {
+                    chart: 'netbird',
+                    version: chartVersion,
+                    sourceRef: { kind: 'HelmRepository', name, namespace: repoNamespace },
+                    interval: '12h',
+                },
+            },
+            values: {
+                management: {
+                    ...(storage
+                        ? {
+                            persistentVolume: {
+                                enabled: true,
+                                size: storage,
+                                accessModes: ['ReadWriteOnce'],
+                            },
+                        }
+                        : { persistentVolume: { enabled: false } }),
+                    useBackwardsGrpcService: true,
+                    // The dashboard catch-all carries the cert-manager annotation —
+                    // one Certificate for the host; the remaining ingresses only
+                    // reference the same secret (5 identical LE orders = at the
+                    // duplicate-cert rate limit the chart's tested example dodges)
+                    ingress: {
+                        enabled: true,
+                        className: 'nginx',
+                        annotations: {
+                            'external-dns.alpha.kubernetes.io/hostname': host,
+                        },
+                        hosts: [{ host, paths: [{ path: '/api', pathType: 'ImplementationSpecific' }] }],
+                        tls: tlsEntry,
+                    },
+                    ingressGrpc: {
+                        enabled: true,
+                        className: 'nginx',
+                        annotations: {
+                            ...grpcTimeouts,
+                            'external-dns.alpha.kubernetes.io/hostname': host,
+                        },
+                        hosts: [
+                            {
+                                host,
+                                paths: [
+                                    { path: '/management.ManagementService', pathType: 'ImplementationSpecific' },
+                                ],
+                            },
+                        ],
+                        tls: tlsEntry,
+                    },
+                    configmap: managementConfig,
+                    env: {
+                        NETBIRD_DOMAIN: host,
+                        NETBIRD_AUTH_ISSUER: issuer,
+                        NETBIRD_AUTH_JWT_CERTS: jwks,
+                        NETBIRD_AUTH_TOKEN_ENDPOINT: tokenEndpoint,
+                        NETBIRD_AUTH_OIDC_CONFIGURATION_ENDPOINT: oidcConfigEndpoint,
+                        IDP_CLIENT_ID: idp.clientId,
+                    },
+                    // envRaw = the chart's structured-var block (standard
+                    // valueFrom.secretKeyRef contract — the DSN and every secret
+                    // value stays reference-only, never a rendered literal)
+                    envRaw: [
+                        secretEnv('IDP_CLIENT_SECRET', oidcSecretName, 'client-secret'),
+                        secretEnv('DATASTORE_ENCRYPTION_KEY', credentialsName, 'datastore-encryption-key'),
+                        secretEnv('RELAY_PASSWORD', credentialsName, 'relay-secret'),
+                        // CNPG generates <db>-app incl. the full fqdn-uri DSN —
+                        // netbird's postgres store reads it via this env var
+                        secretEnv('NETBIRD_STORE_ENGINE_POSTGRES_DSN', dbCredentialsRef.name, 'fqdn-uri'),
+                    ],
+                    image: {
+                        repository: 'netbirdio/management',
+                        tag: imageTag,
+                        pullPolicy: 'IfNotPresent',
+                    },
+                },
+                signal: {
+                    enabled: true,
+                    ingress: {
+                        enabled: true,
+                        className: 'nginx',
+                        annotations: {
+                            ...grpcTimeouts,
+                            'external-dns.alpha.kubernetes.io/hostname': host,
+                        },
+                        hosts: [
+                            {
+                                host,
+                                paths: [
+                                    {
+                                        path: '/signalexchange.SignalExchange',
+                                        pathType: 'ImplementationSpecific',
+                                    },
+                                ],
+                            },
+                        ],
+                        tls: tlsEntry,
+                    },
+                    image: {
+                        repository: 'netbirdio/signal',
+                        tag: imageTag,
+                        pullPolicy: 'IfNotPresent',
+                    },
+                },
+                relay: {
+                    enabled: true,
+                    env: {
+                        NB_LOG_LEVEL: 'info',
+                        NB_LISTEN_ADDRESS: ':33080',
+                        NB_EXPOSED_ADDRESS: `rels://${host}:443/relay`,
+                    },
+                    envRaw: [secretEnv('NB_AUTH_SECRET', credentialsName, 'relay-secret')],
+                    ...(relayPort
+                        ? { service: { type: 'LoadBalancer', port: relayPort, name: 'http' } }
+                        : {}),
+                    ingress: {
+                        enabled: true,
+                        className: 'nginx',
+                        annotations: {
+                            'external-dns.alpha.kubernetes.io/hostname': host,
+                        },
+                        hosts: [{ host, paths: [{ path: '/relay', pathType: 'ImplementationSpecific' }] }],
+                        tls: tlsEntry,
+                    },
+                    image: {
+                        repository: 'netbirdio/relay',
+                        tag: imageTag,
+                        pullPolicy: 'IfNotPresent',
+                    },
+                },
+                dashboard: {
+                    enabled: true,
+                    ingress: {
+                        enabled: true,
+                        className: 'nginx',
+                        annotations: {
+                            // Sole cert-manager annotation — the shared secret's issuer
+                            'cert-manager.io/cluster-issuer': tls.clusterIssuer,
+                            'external-dns.alpha.kubernetes.io/hostname': host,
+                        },
+                        hosts: [{ host, paths: [{ path: '/', pathType: 'ImplementationSpecific' }] }],
+                        tls: tlsEntry,
+                    },
+                    env: {
+                        NETBIRD_MGMT_API_ENDPOINT: `https://${host}`,
+                        NETBIRD_MGMT_GRPC_API_ENDPOINT: `https://${host}`,
+                        AUTH_AUTHORITY: issuer,
+                        AUTH_CLIENT_ID: idp.clientId,
+                        AUTH_AUDIENCE: idp.clientId,
+                        AUTH_SUPPORTED_SCOPES: 'openid profile email offline_access api',
+                        NETBIRD_TOKEN_SOURCE: 'accessToken',
+                        USE_AUTH0: 'false',
+                    },
+                    image: {
+                        repository: 'netbirdio/dashboard',
+                        tag: 'v2.13.1',
+                        pullPolicy: 'IfNotPresent',
+                    },
+                },
+            },
+        },
+    }));
+    return (0, core_1.jsx)(core_1.Fragment, { children: resources_ });
+}
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.tsx"],"names":[],"mappings":";;AA0QA,0BAwdC;AAluBD,oCAAqD;AACrD,iDAAgE;AAChE,0CAOqB;AAmIrB;;;GAGG;AACH,SAAS,SAAS,CAAC,IAAY,EAAE,UAAkB,EAAE,GAAW;IAC9D,OAAO;QACL,IAAI;QACJ,SAAS,EAAE,EAAE,YAAY,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,EAAE,EAAE;KACvD,CAAA;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkHG;AACH,SAAgB,OAAO,CAAC,KAAmB;IACzC,MAAM,EACJ,IAAI,GAAG,SAAS,EAChB,SAAS,EAAE,aAAa,EACxB,IAAI,EACJ,GAAG,EACH,SAAS,EACT,YAAY,GAAG,OAAO,EACtB,OAAO,GAAG,mCAAmC,EAC7C,aAAa,GAAG,aAAa,EAC7B,QAAQ,GAAG,QAAQ,EACnB,OAAO,EACP,MAAM,GAAG,YAAY,EACrB,WAAW,GAAG,CAAC,EACf,SAAS,GAAG,MAAM,EAClB,cAAc,EACd,MAAM,EACN,qBAAqB,EACrB,WAAW,GAAG,EAAE,EAChB,GAAG,GAAG,EAAE,UAAU,EAAE,GAAG,IAAI,MAAM,EAAE,aAAa,EAAE,kBAAkB,EAAE,GACvE,GAAG,KAAK,CAAA;IAET,MAAM,SAAS,GAAG,IAAA,uBAAY,EAAC,aAAa,CAAC,CAAA;IAC7C,MAAM,cAAc,GAAG,IAAA,iBAAU,EAAC,wBAAa,CAAC,CAAA;IAChD,MAAM,UAAU,GAA6B,EAAE,CAAA;IAE/C,gFAAgF;IAChF,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,KAAK,IAAI,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1C,MAAM,IAAI,KAAK,CACb,YAAY,IAAI,kEAAkE;YAChF,IAAI;YACJ,gEAAgE;YAChE,wDAAwD;YACxD,IAAI;YACJ,wBAAwB;YACxB,0EAA0E;YAC1E,6DAA6D,CAChE,CAAA;IACH,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC,KAAK,IAAI,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5C,MAAM,IAAI,KAAK,CACb,YAAY,IAAI,wDAAwD;YACtE,sEAAsE;YACtE,0DAA0D;YAC1D,IAAI;YACJ,gFAAgF,CACnF,CAAA;IACH,CAAC;IACD,MAAM,MAAM,GACV,GAAG,CAAC,MAAM;QACV,WAAW,GAAG,CAAC,IAAK,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,WAAW,GAAG,CAAC,KAAM,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,EAAE,CAAA;IAE3F,gFAAgF;IAChF,IAAI,YAAY,KAAK,QAAQ,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CACb,YAAY,IAAI,qCAAqC;YACnD,IAAI;YACJ,qEAAqE;YACrE,sEAAsE;YACtE,2CAA2C;YAC3C,IAAI;YACJ,wEAAwE,CAC3E,CAAA;IACH,CAAC;IACD,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CACb,YAAY,IAAI,iCAAiC;YAC/C,IAAI;YACJ,SAAS,YAAY,+CAA+C;YACpE,sEAAsE;YACtE,2BAA2B;YAC3B,IAAI;YACJ,wEAAwE,CAC3E,CAAA;IACH,CAAC;IACD,IACE,OAAO,KAAK,SAAS;QACrB,OAAO,KAAK,KAAK;QACjB,8DAA8D;QAC9D,mEAAmE;QACnE,CAAC,8CAA8C,CAAC,IAAI,CAAC,OAAO,CAAC,EAC7D,CAAC;QACD,MAAM,IAAI,KAAK,CACb,YAAY,IAAI,gEAAgE;YAC9E,6CAA6C,OAAO,IAAI,CAC3D,CAAA;IACH,CAAC;IAED,+EAA+E;IAC/E,MAAM,cAAc,GAAG,GAAG,CAAC,eAAe,IAAI,GAAG,IAAI,OAAO,CAAA;IAC5D,IAAI,CAAC,GAAG,CAAC,eAAe,EAAE,CAAC;QACzB,IAAI,CAAC,IAAA,6BAAmB,EAAC,cAAc,CAAC,EAAE,CAAC;YACzC,MAAM,IAAA,8BAAoB,EACxB,SAAS,EACT,IAAI,EACJ,4EAA4E,EAC5E;gBACE,QAAQ,EAAE,qBAAqB;gBAC/B,YAAY,EAAE,GAAG,IAAI,OAAO;gBAC5B,IAAI,EAAE,CAAC,eAAe,CAAC;aACxB,CACF,CAAA;QACH,CAAC;QACD,UAAU,CAAC,IAAI,CACb,IAAA,UAAG,EAAC,sBAAY,EAAE;YAChB,IAAI,EAAE,GAAG,IAAI,OAAO;YACpB,SAAS;YACT,IAAI,EAAE,GAAG,cAAc,CAAC,IAAI,IAAI,IAAI,IAAI,IAAI,OAAO;YACnD,UAAU,EAAE,cAAc;YAC1B,IAAI,EAAE,EAAE,eAAe,EAAE,eAAe,EAAE;YAC1C,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,GAAG,IAAI,aAAa,EAAE,CAAC;SAC9D,CAAC,CACH,CAAA;IACH,CAAC;IAED,iFAAiF;IACjF,MAAM,eAAe,GAAG,qBAAqB,IAAI,GAAG,IAAI,cAAc,CAAA;IACtE,IAAI,CAAC,qBAAqB,EAAE,CAAC;QAC3B,IAAI,CAAC,IAAA,6BAAmB,EAAC,cAAc,CAAC,EAAE,CAAC;YACzC,MAAM,IAAA,8BAAoB,EACxB,SAAS,EACT,IAAI,EACJ,gGAAgG,EAChG;gBACE,QAAQ,EAAE,uBAAuB;gBACjC,YAAY,EAAE,GAAG,IAAI,cAAc;gBACnC,IAAI,EAAE,CAAC,cAAc,EAAE,0BAA0B,CAAC;aACnD,CACF,CAAA;QACH,CAAC;QACD,UAAU,CAAC,IAAI,CACb,IAAA,UAAG,EAAC,sBAAY,EAAE;YAChB,IAAI,EAAE,GAAG,IAAI,cAAc;YAC3B,SAAS;YACT,IAAI,EAAE,GAAG,cAAc,CAAC,IAAI,IAAI,IAAI,IAAI,IAAI,cAAc;YAC1D,UAAU,EAAE,eAAe;YAC3B,IAAI,EAAE;gBACJ,cAAc,EAAE,cAAc;gBAC9B,0BAA0B,EAAE,0BAA0B;aACvD;YACD,OAAO,EAAE;gBACP,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,GAAG,IAAI,aAAa,EAAE;gBAClD,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,GAAG,IAAI,QAAQ,EAAE;aAC9C;SACF,CAAC,CACH,CAAA;IACH,CAAC;IAED,gFAAgF;IAChF,MAAM,gBAAgB,GAAG,IAAA,gCAAsB,EAAC,MAAM,EAAE,cAAc,EAAE,MAAM,CAAC,CAAA;IAC/E,UAAU,CAAC,IAAI,CACb,IAAA,UAAG,EAAC,kBAAQ,EAAE;QACZ,MAAM,EAAE,MAAM,IAAI,IAAI;QACtB,IAAI,EAAE,MAAM;QACZ,SAAS;QACT,QAAQ,EAAE,SAAS;QACnB,KAAK,EAAE,SAAS;QAChB,SAAS,EAAE,WAAW;QACtB,OAAO,EAAE,SAAS;QAClB,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3D,UAAU,EAAE;YACV,cAAc,EAAE,OAAO;YACvB,eAAe,EAAE,KAAK;SACvB;QACD,eAAe,EAAE,MAAM;KACxB,CAAC,CACH,CAAA;IAED,iFAAiF;IACjF,MAAM,IAAI,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,gCAAgC,CAAA;IACzE,MAAM,aAAa,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,gCAAgC,CAAA;IAClF,MAAM,kBAAkB,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,mCAAmC,CAAA;IAE1F,mEAAmE;IACnE,uEAAuE;IACvE,mEAAmE;IACnE,yDAAyD;IACzD,MAAM,gBAAgB,GAAG,IAAI,CAAC,SAAS,CACrC;QACE,KAAK,EAAE,EAAE;QACT,UAAU,EAAE;YACV,KAAK,EAAE,EAAE;YACT,cAAc,EAAE,SAAS;YACzB,MAAM,EAAE,QAAQ;YAChB,oBAAoB,EAAE,KAAK;SAC5B;QACD,KAAK,EAAE;YACL,uDAAuD;YACvD,SAAS,EAAE,CAAC,UAAU,IAAI,YAAY,CAAC;YACvC,cAAc,EAAE,KAAK;YACrB,MAAM,EAAE,uBAAuB;SAChC;QACD,MAAM,EAAE;YACN,KAAK,EAAE,OAAO;YACd,GAAG,EAAE,GAAG,IAAI,MAAM;YAClB,QAAQ,EAAE,EAAE;YACZ,QAAQ,EAAE,EAAE;SACb;QACD,YAAY,EAAE;YACZ,kBAAkB,EAAE,IAAI;YACxB,uBAAuB,EAAE,CAAC;YAC1B,YAAY,EAAE,IAAI;SACnB;QACD,OAAO,EAAE,EAAE;QACX,sBAAsB,EAAE,iCAAiC;QACzD,WAAW,EAAE;YACX,wDAAwD;YACxD,MAAM,EAAE,UAAU;SACnB;QACD,UAAU,EAAE;YACV,iBAAiB,EAAE,EAAE;YACrB,QAAQ,EAAE,EAAE;YACZ,OAAO,EAAE,EAAE;YACX,YAAY,EAAE,sBAAsB;YACpC,UAAU,EAAE,4BAA4B;YACxC,eAAe,EAAE,WAAW;YAC5B,gBAAgB,EAAE,+BAA+B;YACjD,wBAAwB,EAAE,KAAK;YAC/B,kBAAkB,EAAE,iDAAiD;SACtE;QACD,gBAAgB,EAAE;YAChB,WAAW,EAAE,UAAU;YACvB,YAAY,EAAE;gBACZ,MAAM,EAAE,4BAA4B;gBACpC,aAAa,EAAE,oCAAoC;gBACnD,QAAQ,EAAE,sBAAsB;gBAChC,YAAY,EAAE,0BAA0B;gBACxC,SAAS,EAAE,oBAAoB;aAChC;YACD,yBAAyB,EAAE;gBACzB,QAAQ,EAAE,sBAAsB;gBAChC,YAAY,EAAE,0BAA0B;gBACxC,SAAS,EAAE,oBAAoB;aAChC;YACD,WAAW,EAAE,IAAI;YACjB,sBAAsB,EAAE,IAAI;YAC5B,sBAAsB,EAAE,IAAI;YAC5B,wBAAwB,EAAE,IAAI;SAC/B;QACD,uBAAuB,EAAE;YACvB,QAAQ,EAAE,QAAQ;YAClB,cAAc,EAAE;gBACd,QAAQ,EAAE,sBAAsB;gBAChC,YAAY,EAAE,EAAE;gBAChB,MAAM,EAAE,EAAE;gBACV,QAAQ,EAAE,sBAAsB;gBAChC,aAAa,EAAE,oCAAoC;gBACnD,kBAAkB,EAAE,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,sCAAsC;gBACtF,qBAAqB,EAAE,EAAE;gBACzB,KAAK,EAAE,QAAQ;gBACf,UAAU,EAAE,KAAK;gBACjB,YAAY,EAAE,IAAI;aACnB;SACF;QACD,qBAAqB,EAAE;YACrB,QAAQ,EAAE,QAAQ;YAClB,cAAc,EAAE;gBACd,QAAQ,EAAE,sBAAsB;gBAChC,YAAY,EAAE,0BAA0B;gBACxC,MAAM,EAAE,EAAE;gBACV,QAAQ,EAAE,sBAAsB;gBAChC,aAAa,EAAE,oCAAoC;gBACnD,kBAAkB,EAAE,EAAE;gBACtB,qBAAqB,EAAE,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,+BAA+B;gBAClF,KAAK,EAAE,yCAAyC;gBAChD,UAAU,EAAE,KAAK;gBACjB,kBAAkB,EAAE,IAAI;gBACxB,mEAAmE;gBACnE,uDAAuD;gBACvD,2DAA2D;gBAC3D,4DAA4D;gBAC5D,gEAAgE;gBAChE,mDAAmD;gBACnD,6DAA6D;gBAC7D,iDAAiD;gBACjD,SAAS,EAAE,CAAC;gBACZ,YAAY,EAAE,CAAC,wBAAwB,CAAC;aACzC;SACF;KACF,EACD,IAAI,EACJ,IAAI,CACL,CAAA;IAED,kFAAkF;IAClF,MAAM,YAAY,GAAG;QACnB,8CAA8C,EAAE,MAAM;QACtD,0CAA0C,EAAE,MAAM;QAClD,gDAAgD,EAAE,MAAM;QACxD,gDAAgD,EAAE,MAAM;KACzD,CAAA;IACD,MAAM,QAAQ,GAAG,CAAC,EAAE,UAAU,EAAE,GAAG,CAAC,UAAU,EAAE,KAAK,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;IAEhE,kFAAkF;IAClF,UAAU,CAAC,IAAI,CACb,IAAA,UAAG,EAAC,gBAAgB,EAAE;QACpB,UAAU,EAAE,6BAA6B;QACzC,IAAI,EAAE,gBAAgB;QACtB,QAAQ,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,aAAa,EAAE;QAC5C,IAAI,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,EAAE;KACxC,CAAC,EACF,IAAA,UAAG,EAAC,aAAa,EAAE;QACjB,UAAU,EAAE,2BAA2B;QACvC,IAAI,EAAE,aAAa;QACnB,QAAQ,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;QAC7B,IAAI,EAAE;YACJ,QAAQ,EAAE,KAAK;YACf,KAAK,EAAE;gBACL,IAAI,EAAE;oBACJ,KAAK,EAAE,SAAS;oBAChB,OAAO,EAAE,YAAY;oBACrB,SAAS,EAAE,EAAE,IAAI,EAAE,gBAAgB,EAAE,IAAI,EAAE,SAAS,EAAE,aAAa,EAAE;oBACrE,QAAQ,EAAE,KAAK;iBAChB;aACF;YACD,MAAM,EAAE;gBACN,UAAU,EAAE;oBACV,GAAG,CAAC,OAAO;wBACT,CAAC,CAAC;4BACE,gBAAgB,EAAE;gCAChB,OAAO,EAAE,IAAI;gCACb,IAAI,EAAE,OAAO;gCACb,WAAW,EAAE,CAAC,eAAe,CAAC;6BAC/B;yBACF;wBACH,CAAC,CAAC,EAAE,gBAAgB,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,CAAC;oBAC7C,uBAAuB,EAAE,IAAI;oBAC7B,gEAAgE;oBAChE,6DAA6D;oBAC7D,4DAA4D;oBAC5D,+DAA+D;oBAC/D,OAAO,EAAE;wBACP,OAAO,EAAE,IAAI;wBACb,SAAS,EAAE,OAAO;wBAClB,WAAW,EAAE;4BACX,2CAA2C,EAAE,IAAI;yBAClD;wBACD,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,wBAAwB,EAAE,CAAC,EAAE,CAAC;wBAChF,GAAG,EAAE,QAAQ;qBACd;oBACD,WAAW,EAAE;wBACX,OAAO,EAAE,IAAI;wBACb,SAAS,EAAE,OAAO;wBAClB,WAAW,EAAE;4BACX,GAAG,YAAY;4BACf,2CAA2C,EAAE,IAAI;yBAClD;wBACD,KAAK,EAAE;4BACL;gCACE,IAAI;gCACJ,KAAK,EAAE;oCACL,EAAE,IAAI,EAAE,+BAA+B,EAAE,QAAQ,EAAE,wBAAwB,EAAE;iCAC9E;6BACF;yBACF;wBACD,GAAG,EAAE,QAAQ;qBACd;oBACD,SAAS,EAAE,gBAAgB;oBAC3B,GAAG,EAAE;wBACH,cAAc,EAAE,IAAI;wBACpB,mBAAmB,EAAE,MAAM;wBAC3B,sBAAsB,EAAE,IAAI;wBAC5B,2BAA2B,EAAE,aAAa;wBAC1C,wCAAwC,EAAE,kBAAkB;wBAC5D,aAAa,EAAE,GAAG,CAAC,QAAQ;qBAC5B;oBACD,sDAAsD;oBACtD,6DAA6D;oBAC7D,wDAAwD;oBACxD,MAAM,EAAE;wBACN,SAAS,CAAC,mBAAmB,EAAE,cAAc,EAAE,eAAe,CAAC;wBAC/D,SAAS,CAAC,0BAA0B,EAAE,eAAe,EAAE,0BAA0B,CAAC;wBAClF,SAAS,CAAC,gBAAgB,EAAE,eAAe,EAAE,cAAc,CAAC;wBAC5D,wDAAwD;wBACxD,qDAAqD;wBACrD,SAAS,CAAC,mCAAmC,EAAE,gBAAgB,CAAC,IAAI,EAAE,UAAU,CAAC;qBAClF;oBACD,KAAK,EAAE;wBACL,UAAU,EAAE,sBAAsB;wBAClC,GAAG,EAAE,QAAQ;wBACb,UAAU,EAAE,cAAc;qBAC3B;iBACF;gBACD,MAAM,EAAE;oBACN,OAAO,EAAE,IAAI;oBACb,OAAO,EAAE;wBACP,OAAO,EAAE,IAAI;wBACb,SAAS,EAAE,OAAO;wBAClB,WAAW,EAAE;4BACX,GAAG,YAAY;4BACf,2CAA2C,EAAE,IAAI;yBAClD;wBACD,KAAK,EAAE;4BACL;gCACE,IAAI;gCACJ,KAAK,EAAE;oCACL;wCACE,IAAI,EAAE,gCAAgC;wCACtC,QAAQ,EAAE,wBAAwB;qCACnC;iCACF;6BACF;yBACF;wBACD,GAAG,EAAE,QAAQ;qBACd;oBACD,KAAK,EAAE;wBACL,UAAU,EAAE,kBAAkB;wBAC9B,GAAG,EAAE,QAAQ;wBACb,UAAU,EAAE,cAAc;qBAC3B;iBACF;gBACD,KAAK,EAAE;oBACL,OAAO,EAAE,IAAI;oBACb,GAAG,EAAE;wBACH,YAAY,EAAE,MAAM;wBACpB,iBAAiB,EAAE,QAAQ;wBAC3B,kBAAkB,EAAE,UAAU,IAAI,YAAY;qBAC/C;oBACD,MAAM,EAAE,CAAC,SAAS,CAAC,gBAAgB,EAAE,eAAe,EAAE,cAAc,CAAC,CAAC;oBACtE,GAAG,CAAC,SAAS;wBACX,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE;wBACtE,CAAC,CAAC,EAAE,CAAC;oBACP,OAAO,EAAE;wBACP,OAAO,EAAE,IAAI;wBACb,SAAS,EAAE,OAAO;wBAClB,WAAW,EAAE;4BACX,2CAA2C,EAAE,IAAI;yBAClD;wBACD,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,wBAAwB,EAAE,CAAC,EAAE,CAAC;wBAClF,GAAG,EAAE,QAAQ;qBACd;oBACD,KAAK,EAAE;wBACL,UAAU,EAAE,iBAAiB;wBAC7B,GAAG,EAAE,QAAQ;wBACb,UAAU,EAAE,cAAc;qBAC3B;iBACF;gBACD,SAAS,EAAE;oBACT,OAAO,EAAE,IAAI;oBACb,OAAO,EAAE;wBACP,OAAO,EAAE,IAAI;wBACb,SAAS,EAAE,OAAO;wBAClB,WAAW,EAAE;4BACX,4DAA4D;4BAC5D,gCAAgC,EAAE,GAAG,CAAC,aAAa;4BACnD,2CAA2C,EAAE,IAAI;yBAClD;wBACD,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,QAAQ,EAAE,wBAAwB,EAAE,CAAC,EAAE,CAAC;wBAC7E,GAAG,EAAE,QAAQ;qBACd;oBACD,GAAG,EAAE;wBACH,yBAAyB,EAAE,WAAW,IAAI,EAAE;wBAC5C,8BAA8B,EAAE,WAAW,IAAI,EAAE;wBACjD,cAAc,EAAE,MAAM;wBACtB,cAAc,EAAE,GAAG,CAAC,QAAQ;wBAC5B,aAAa,EAAE,GAAG,CAAC,QAAQ;wBAC3B,qBAAqB,EAAE,yCAAyC;wBAChE,oBAAoB,EAAE,aAAa;wBACnC,SAAS,EAAE,OAAO;qBACnB;oBACD,KAAK,EAAE;wBACL,UAAU,EAAE,qBAAqB;wBACjC,GAAG,EAAE,SAAS;wBACd,UAAU,EAAE,cAAc;qBAC3B;iBACF;aACF;SACF;KACF,CAAC,CACH,CAAA;IAED,OAAO,IAAA,UAAG,EAAC,eAAQ,EAAE,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC,CAAA;AAChD,CAAC"}

package/package.json

@@ -0,0 +1,47 @@
+{
+  "name": "@r8s/netbird",
+  "version": "0.3.4",
+  "description": "Netbird mesh VPN (management + signal + relay + dashboard) — Flux HelmRelease, CNPG persistence, Keycloak IdP for r8s",
+  "license": "MIT",
+  "author": "Berget AI AB",
+  "homepage": "https://r8s.berget.ai",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/berget-ai/r8s.git",
+    "directory": "packages/netbird"
+  },
+  "bugs": "https://github.com/berget-ai/r8s/issues",
+  "publishConfig": {
+    "access": "public"
+  },
+  "files": [
+    "dist"
+  ],
+  "keywords": [
+    "netbird",
+    "vpn",
+    "mesh",
+    "wireguard",
+    "networking"
+  ],
+  "r8s": {
+    "category": "Networking"
+  },
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "scripts": {
+    "build": "tsc --build",
+    "test": "vitest run",
+    "clean": "rm -rf dist tsconfig.tsbuildinfo"
+  },
+  "dependencies": {
+    "@r8s/core": "^0.3.0",
+    "@r8s/crds": "^0.3.0",
+    "@r8s/k8s-types": "^0.3.0",
+    "@r8s/recipes": "^0.3.0"
+  },
+  "devDependencies": {
+    "typescript": "^5.3.0",
+    "vitest": "^1.0.0"
+  }
+}