New file covering NetBird - a self-hosted WireGuard mesh giving every
fleet host and personal device a stable overlay identity, with a
genuinely-implemented zero-trust policy layer (deny-by-default, groups,
scoped setup keys, peer approval, posture checks).
- Why a mesh over a classic VPN concentrator, illustrated with a real
topology diagram (control plane handles coordination only; actual
data flows peer-to-peer, bypassing it entirely - the literal
distinction from a concentrator, drawn not just asserted)
- Ties back to today's iac-pipeline.md update: this LXC is the first
host ever built through the new Terraform LXC-native path, start to
finish, no manual provisioning step
- Real bring-up incident: gRPC/h2c requirements broke through a naive
proxy chain, and a proxying CDN 403s the agent outright - both root
causes documented, not just the fixes
- Evidence: 3 real command blocks (docker ps, live Caddyfile splitter
config, netbird status --detail from an enrolled peer), 2 real
screenshots (dashboard Peers list, Access Control Policies - port
counts in the screenshot match the real policy detail in the text)
- Second diagram (edge routing chain) for the specific gRPC/h2c/path
split detail, kept separate from the topology diagram since they show
genuinely different shapes of information
- Honest, non-rounded-up rollout status table - several phases still
explicitly open
- Sanitize-checked: no internal IPs/domains/personal email
Also: fixes iac-pipeline.md's forward-reference to this doc to use the
repo's actual link convention ([docs/x.md](x.md)), not descriptive
prose link text.
Terraform gained a second provider (bpg/proxmox) alongside the existing
telmate/proxmox, via a new containers.tf / proxmox_virtual_environment_container
resource - real, live-verified against the actual repo files. Corrects
the doc's previous "Terraform only manages virtual machines... cannot
create or manage LXC containers" claim, which is no longer true.
- Terraform section: VM/LXC comparison table, real containers.tf
excerpt, explains why LXCs need an extra pct-exec bootstrap step
(stock template has no sshd, since it never went through Packer)
- WARNING section: new paragraph noting the LXC-provisioning gap is
closed for new hosts going forward (the three existing exceptions
stay as preserved history, not retroactively fixed) - forward-links
to docs/netbird-zero-trust.md (next commit)
- Fixed now-stale section heading ("one resource type" -> "two
resource types")
- Sanitize-checked: no internal IPs/domains
New export reflecting the user's latest diagram edit. Same white-line
strip as aae1ff2 applied fresh to this export (variant this time: flat
#1C1D1E plus inverted light-dark(#1C1D1E, #d3d4d5)) - verified 0 broken
patterns remain, valid XML, all 8 correct span backgrounds preserved.
Same fix as orchestration-flow-patterns.svg (8772564), applied after a
comprehensive re-check that found the bug wasn't limited to the 6 files
originally caught by a narrower pattern match - architecture-overview.svg
and firewall-and-network-docker-bypass.svg were also affected.
Confirmed via a control test on orchestration-flow-patterns.svg that the
.drawio source's labelBackgroundColor property was never the actual
cause (reverted it, re-exported, still broken, still fixed cleanly by
the same strip) - this is a draw.io export-time quirk, not a content or
convention problem, so no CLAUDE.md changes needed.
Each file: stripped the same broken wrapper-div background-color
declarations (flat #1C1D1E / #ffffff, or the equivalent light-dark()/
var(--ge-adaptive-bg) variants - not consistent across exports of the
same file), verified 0 remain, valid XML, and the correct adaptive span
background count unchanged before/after in every file.
Files: architecture-overview.svg, firewall-and-network-docker-bypass.svg,
iac-pipeline-tools-flow.svg, observability-pipeline.svg,
readme-trust-boundaries-blast-radius.svg, secret-distribution-flows.svg,
secrets-and-pki-lifecycle.svg
The exported SVG's 4 edge labels (no/yes/approve/decline) had two extra,
non-adaptive background-color declarations stamped onto their wrapper
divs by the draw.io exporter (flat #ffffff, and an undefined
var(--ge-adaptive-bg) CSS variable that falls back to #ffffff) -
independent of both the .drawio source content and the export dialog's
Appearance setting (tested Automatic and Light, both showed it).
Surgically stripped just those two declarations from the exported SVG,
verified count (4+4 removed, 0 remaining), confirmed the correct
adaptive span background (light-dark(white, #1C1D1E)) and every other
color in the diagram were untouched, confirmed still valid XML.
- Replaced both mermaid diagrams with real Nextcloud diagrams; the
Ansible-stages rebuild caught a real omission - the old diagram showed
only 2 stages (init/compliance) when there are genuinely 3
(provisioning.yml exists too, currently just clamav/rocky-docker)
- Live-verified against the real iac repo: roles_metadata.yml (9
cis_hardening + 6 other compliance roles, 1 provisioning role),
kickstart partitioning/packages/SSH config, both Packer bootstrap
scripts, terraform.tfvars, pct list on both hypervisors, a real
rendered host_tags.yml
- KB fix: LXC Strategy note's PBS row was wrong, not just stale - PBS
genuinely has a populated vm_tags list and live compliance roles
(confirmed via real artifacts on the host itself), not 'never
Ansible-managed' as it said; corrected and re-verified via re-fetch
- Added real content not previously in the doc: the deliberately
permissive build-time SSH window closed by ssh_hardening, the
admin/ansible identity split baked into the image at build time, and a
third pipeline exception (PBS) that's genuinely different in kind from
the other two, including a real Rocky-vs-Debian PAM ordering bug found
onboarding it
- Considered two screenshot candidates (Proxmox template list, VM/LXC
mix) - declined as low-value; command evidence covers this
source-driven topic well on its own
- Sanitize-checked: no internal IPs/MACs/domains/personal info/forbidden
app names
- Replaced mermaid diagram with real Nextcloud diagram; rebuild caught a
real bug in the old one (showed Kopia/Bazarr flowing through the App
Router, which flows.json disproves - they bypass it entirely)
- Live-verified Mosquitto broker config/ACL, Node-RED flow routing (16
switch rules = 15 apps + unknown fallback, 2 dedicated endpoints),
mqtt-monitor.sh check count against the real script
- Named NetBox and Kestra directly (previously generic) after the real
Node-RED screenshot made them visible anyway; Postiz/nocodb-content
stay generic per standing instruction
- Added real evidence: routing-table command output, the real
topic-agnostic Inventory Parse function source, real Mosquitto
ACL/config, real check-count grep, a real Node-RED flow canvas
screenshot, and a real Mosquitto connection log screenshot (the
kestra-notify client is live proof of the MQTT-not-HTTP claim)
- KB fix: Ansible mqtt_client Role note was missing a 23rd real check
(crash-looping systemd units, distinct from the failed-units check,
added to the script after a real vault-agent crash-loop incident)
- Sanitize-checked: no internal IPs/domains/personal info/forbidden app
names
thesabear