# Persistent, non-secret configuration for the official SideroLabs NetBird
# system extension. Apply this patch to every Talos node alongside its normal
# role-specific patches.
#
# Enrollment still requires NB_SETUP_KEY, but that short-lived credential must
# never be committed to this public repository. Supply it separately from a
# silent shell prompt during first enrollment, revoke it after all nodes join,
# then remove it from the live ExtensionServiceConfig.
apiVersion: v1alpha1
kind: ExtensionServiceConfig
name: netbird
environment:
  # Both endpoints use this installation's combined self-hosted NetBird URL.
  - NB_MANAGEMENT_URL=https://netbird.ahmza.com
  - NB_ADMIN_URL=https://netbird.ahmza.com
  # Talos mounts /etc read-only. Prevent NetBird from repeatedly trying to
  # rewrite resolv.conf and the OpenSSH client configuration there. Overlay
  # networking remains active; NetBird-managed DNS is deliberately disabled.
  - NB_DISABLE_DNS=true
  - NB_DISABLE_SSH_CONFIG=true