thesabear 8ceadab38a netbird-zero-trust.md: new doc for the zero-trust mesh overlay ...

New file covering NetBird - a self-hosted WireGuard mesh giving every
fleet host and personal device a stable overlay identity, with a
genuinely-implemented zero-trust policy layer (deny-by-default, groups,
scoped setup keys, peer approval, posture checks).

- Why a mesh over a classic VPN concentrator, illustrated with a real
  topology diagram (control plane handles coordination only; actual
  data flows peer-to-peer, bypassing it entirely - the literal
  distinction from a concentrator, drawn not just asserted)
- Ties back to today's iac-pipeline.md update: this LXC is the first
  host ever built through the new Terraform LXC-native path, start to
  finish, no manual provisioning step
- Real bring-up incident: gRPC/h2c requirements broke through a naive
  proxy chain, and a proxying CDN 403s the agent outright - both root
  causes documented, not just the fixes
- Evidence: 3 real command blocks (docker ps, live Caddyfile splitter
  config, netbird status --detail from an enrolled peer), 2 real
  screenshots (dashboard Peers list, Access Control Policies - port
  counts in the screenshot match the real policy detail in the text)
- Second diagram (edge routing chain) for the specific gRPC/h2c/path
  split detail, kept separate from the topology diagram since they show
  genuinely different shapes of information
- Honest, non-rounded-up rollout status table - several phases still
  explicitly open
- Sanitize-checked: no internal IPs/domains/personal email

Also: fixes iac-pipeline.md's forward-reference to this doc to use the
repo's actual link convention ([docs/x.md](x.md)), not descriptive
prose link text.

2026-09-01 00:21:06 +03:00

147 KiB

Raw Blame History