feat(netbird): Update

machines/storage01/netbird.nix

@@ -0,0 +1,82 @@
+{
+  config,
+  lib,
+  nixpkgs,
+  ...
+}:
+
+let
+  domain = "netbird.dgnum.eu";
+
+  s = name: config.age.secrets.${name}.path;
+in
+{
+  services = {
+    netbird.server = {
+      enable = true;
+
+      package = nixpkgs.unstable.netbird;
+
+      inherit domain;
+
+      enableNginx = true;
+
+      coturn.enable = lib.mkForce false;
+
+      relay = {
+        environmentFile = s "netbird-relay_environment_file";
+        metricsPort = 9094;
+      };
+
+      dashboard = {
+        settings = {
+          AUTH_AUTHORITY = "https://sso.dgnum.eu/oauth2/openid/dgn_netbird";
+          AUTH_AUDIENCE = "dgn_netbird";
+          AUTH_CLIENT_ID = "dgn_netbird";
+        };
+      };
+
+      management = {
+        oidcConfigEndpoint = "https://sso.dgnum.eu/oauth2/openid/dgn_netbird/.well-known/openid-configuration";
+
+        dnsDomain = "dgnum";
+
+        metricsPort = 9092;
+
+        settings = {
+          DataStoreEncryptionKey._secret = s "netbird-data_store_encryption_key_file";
+
+          PKCEAuthorizationFlow.ProviderConfig = {
+            Audience = "dgn_netbird";
+            ClientID = "dgn_netbird";
+            AuthorizationEndpoint = "https://sso.dgnum.eu/ui/oauth2";
+            TokenEndpoint = "https://sso.dgnum.eu/oauth2/token";
+          };
+
+          IdpManagerConfig.ClientConfig.ClientID = "dgn_netbird";
+
+          DeviceAuthorizationFlow = {
+            Provider = "none";
+            ProviderConfig = {
+              Audience = "dgn_netbird";
+              ClientID = "dgn_netbird";
+            };
+          };
+
+          Relay = {
+            Addresses = [ "rels://${domain}:443" ];
+            CredentialsTTL = "24h";
+            Secret._secret = s "netbird-relay_secret_file";
+          };
+        };
+      };
+    };
+
+    nginx.virtualHosts.${domain} = {
+      enableACME = true;
+      forceSSL = true;
+    };
+  };
+
+  dgn-backups.jobs.netbird.settings.paths = [ "/var/lib/netbird-mgmt" ];
+}