add NetBird connectivity to Talos nodes

talos/patch-netbird.yaml

@@ -0,0 +1,20 @@
+# Persistent, non-secret configuration for the official SideroLabs NetBird
+# system extension. Apply this patch to every Talos node alongside its normal
+# role-specific patches.
+#
+# Enrollment still requires NB_SETUP_KEY, but that short-lived credential must
+# never be committed to this public repository. Supply it separately from a
+# silent shell prompt during first enrollment, revoke it after all nodes join,
+# then remove it from the live ExtensionServiceConfig.
+apiVersion: v1alpha1
+kind: ExtensionServiceConfig
+name: netbird
+environment:
+  # Both endpoints use this installation's combined self-hosted NetBird URL.
+  - NB_MANAGEMENT_URL=https://netbird.ahmza.com
+  - NB_ADMIN_URL=https://netbird.ahmza.com
+  # Talos mounts /etc read-only. Prevent NetBird from repeatedly trying to
+  # rewrite resolv.conf and the OpenSSH client configuration there. Overlay
+  # networking remains active; NetBird-managed DNS is deliberately disabled.
+  - NB_DISABLE_DNS=true
+  - NB_DISABLE_SSH_CONFIG=true