feat(rescue01): Deploy a netbird relay

machines/nixos/rescue01/_configuration.nix

@@ -12,6 +12,7 @@ lib.extra.mkConfig {
 
   enabledServices = [
     # List of services to enable
+    "netbird-relay"
     "uptime-kuma"
   ];
 

machines/nixos/rescue01/netbird-relay.nix

@@ -0,0 +1,34 @@
+# SPDX-FileCopyrightText: 2024 Tom Hubrecht <tom.hubrecht@dgnum.eu>
+#
+# SPDX-License-Identifier: EUPL-1.2
+
+{
+  config,
+  nixpkgs,
+  ...
+}:
+
+let
+  domain = "nb-relay01.dgnum.eu";
+in
+
+{
+  services = {
+    netbird.server.relay = {
+      enable = true;
+
+      package = nixpkgs.nixos.unstable.netbird;
+
+      inherit domain;
+      enableNginx = true;
+
+      environmentFile = config.age.secrets."netbird-relay_environment_file".path;
+      metricsPort = 9094;
+    };
+
+    nginx.virtualHosts.${domain} = {
+      enableACME = true;
+      forceSSL = true;
+    };
+  };
+}

machines/nixos/rescue01/secrets/secrets.nix

@@ -6,5 +6,6 @@
   [ "rescue01" ]
   [
     # List of secrets for rescue01
+    "netbird-relay_environment_file"
     "stateless-uptime-kuma-password"
   ]

machines/nixos/storage01/netbird.nix

@@ -69,7 +69,10 @@ in
           };
 
           Relay = {
-            Addresses = [ "rels://${domain}:443" ];
+            Addresses = builtins.map (host: "rels://${host}:443") [
+              domain
+              "nb-relay01.dgnum.eu"
+            ];
             CredentialsTTL = "24h";
             Secret._secret = s "netbird-relay_secret_file";
           };

meta/dns.nix

@@ -113,6 +113,7 @@ let
         ];
 
         rescue01.dual = [
+          "nb-relay01" # Netbird Relay
           "status" # Uptime Kuma
         ];
 

meta/nodes/nixos.nix

@@ -181,6 +181,10 @@
       version = "24.11";
       system = "nixos";
     };
+
+    nix-modules = [
+      "services/netbird/server.nix"
+    ];
   };
 
   storage01 = {