update netbird server modules

maintainers/maintainer-list.nix

@@ -25089,6 +25089,12 @@
     github = "shunueda";
     githubId = 62182668;
   };
+  shuuri-labs = {
+    name = "Ashley Mensah";
+    email = "ashley@netbird.io";
+    github = "shuuri-labs";
+    githubId = 61762328;
+  };
   shved = {
     name = "Yury Shvedov";
     email = "mestofel13@gmail.com";

nixos/doc/manual/redirects.json

@@ -1202,6 +1202,41 @@
   "module-services-netbird-customization": [
     "index.html#module-services-netbird-customization"
   ],
+  "module-services-netbird-features": [
+    "index.html#module-services-netbird-features",
+    "index.html#module-services-netbird-dns",
+    "index.html#module-services-netbird-routing",
+    "index.html#module-services-netbird-security",
+    "index.html#module-services-netbird-rosenpass",
+    "index.html#module-services-netbird-ssh",
+    "index.html#module-services-netbird-connection",
+    "index.html#module-services-netbird-selfhosted",
+    "index.html#module-services-netbird-advanced"
+  ],
+  "module-services-netbird-server-quickstart-coturn": [
+    "index.html#module-services-netbird-server-quickstart-coturn"
+  ],
+  "module-services-netbird-server-quickstart-relay": [
+    "index.html#module-services-netbird-server-quickstart-relay"
+  ],
+  "module-services-netbird-server-relay-vs-coturn": [
+    "index.html#module-services-netbird-server-relay-vs-coturn"
+  ],
+  "module-services-netbird-server-embedded-idp": [
+    "index.html#module-services-netbird-server-embedded-idp"
+  ],
+  "module-services-netbird-server-database": [
+    "index.html#module-services-netbird-server-database"
+  ],
+  "module-services-netbird-server-database-postgres": [
+    "index.html#module-services-netbird-server-database-postgres"
+  ],
+  "module-services-netbird-server-relay-config": [
+    "index.html#module-services-netbird-server-relay-config"
+  ],
+  "module-services-netbird-server-complete-example": [
+    "index.html#module-services-netbird-server-complete-example"
+  ],
   "module-services-mosquitto": [
     "index.html#module-services-mosquitto"
   ],

nixos/modules/services/networking/netbird.md

@@ -89,3 +89,36 @@ See the option description for more information.
 [environment](#opt-services.netbird.clients._name_.environment) allows you to pass additional configurations
 through environment variables, but special care needs to be taken for overriding config location and
 daemon address due [hardened](#opt-services.netbird.clients._name_.hardened) option.
+
+## Feature Configuration {#module-services-netbird-features}
+
+NetBird features (DNS, routing, SSH, Rosenpass, etc.) are configured via `NB_*` environment variables
+using the [extraEnvironment](#opt-services.netbird.clients._name_.extraEnvironment) option.
+Settings that affect the [config.json](#opt-services.netbird.clients._name_.config) (e.g. MTU, management URL)
+can be set via the `config` option.
+
+```nix
+{
+  services.netbird.clients.work = {
+    port = 51820;
+
+    # Feature flags via environment variables
+    extraEnvironment = {
+      NB_DISABLE_DNS = "true";
+      NB_ALLOW_SERVER_SSH = "true";
+      NB_ENABLE_ROSENPASS = "true";
+      NB_HOSTNAME = "my-peer";
+    };
+
+    # Config.json overrides
+    config = {
+      ManagementURL = "https://management.example.com:443";
+      Mtu = 1280;
+    };
+  };
+}
+```
+
+The NetBird client reads its full set of `NB_*` flags via `setFlagsFromEnvVars()`.
+Consult the [upstream source](https://github.com/netbirdio/netbird/blob/main/client/internal/connect.go)
+for the complete list of supported variables.

nixos/modules/services/networking/netbird.nix

@@ -180,6 +180,27 @@ in
                 '';
               };
 
+              extraEnvironment = mkOption {
+                type = attrsOf str;
+                default = { };
+                example = literalExpression ''
+                  {
+                    NB_DISABLE_DNS = "true";
+                    NB_ALLOW_SERVER_SSH = "true";
+                    NB_ENABLE_ROSENPASS = "true";
+                  }
+                '';
+                description = ''
+                  Additional environment variables to pass to the NetBird service.
+
+                  NetBird features are configured via `NB_*` environment variables
+                  (e.g. `NB_DISABLE_DNS`, `NB_ALLOW_SERVER_SSH`, `NB_ENABLE_ROSENPASS`).
+
+                  These are merged with the computed environment variables, with
+                  values from this option taking precedence on conflicts.
+                '';
+              };
+
               interface = mkOption {
                 type = str;
                 default = "nb-${client.name}";
@@ -208,6 +229,7 @@ in
                   } // optionalAttrs (client.dns-resolver.address != null) {
                     NB_DNS_RESOLVER_ADDRESS = "''${client.dns-resolver.address}:''${toString client.dns-resolver.port}";
                   }
+                  // client.extraEnvironment
                 '';
                 description = ''
                   Environment for the netbird service, used to pass configuration options.
@@ -275,10 +297,7 @@ in
                   - `CAP_NET_RAW`, `CAP_NET_ADMIN` and `CAP_BPF` still give unlimited network manipulation possibilites,
                   - older kernels don't have `CAP_BPF` and use `CAP_SYS_ADMIN` instead,
 
-                  Known security features that are not (yet) integrated into the module:
-                  - 2024-02-14: `rosenpass` is an experimental feature configurable solely
-                    through `--enable-rosenpass` flag on the `netbird up` command,
-                    see [the docs](https://docs.netbird.io/how-to/enable-post-quantum-cryptography)
+                  For post-quantum cryptography, set `NB_ENABLE_ROSENPASS = "true"` in `extraEnvironment`.
                 '';
               };
 
@@ -447,7 +466,8 @@ in
             }
             // optionalAttrs (client.dns-resolver.address != null) {
               NB_DNS_RESOLVER_ADDRESS = "${client.dns-resolver.address}:${toString client.dns-resolver.port}";
-            };
+            }
+            // client.extraEnvironment;
 
             config.config = {
               DisableAutoConnect = !client.autoStart;