{"id":20789245,"url":"https://github.com/instabug/netbird-gitops","last_synced_at":"2026-04-28T04:03:17.684Z","repository":{"id":255594724,"uuid":"847297552","full_name":"Instabug/netbird-gitops","owner":"Instabug","description":null,"archived":false,"fork":false,"pushed_at":"2025-01-08T18:28:16.000Z","size":60,"stargazers_count":0,"open_issues_count":0,"forks_count":1,"subscribers_count":4,"default_branch":"main","last_synced_at":"2025-12-27T13:15:45.667Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"Go","has_issues":false,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"bsd-3-clause","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/Instabug.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":"CODE_OF_CONDUCT.md","threat_model":null,"audit":null,"citation":null,"codeowners":"CODEOWNERS","security":"SECURITY.md","support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2024-08-25T12:28:01.000Z","updated_at":"2025-11-19T18:18:51.000Z","dependencies_parsed_at":"2024-09-06T07:28:24.110Z","dependency_job_id":"306f5849-f650-4cad-9f5a-6ed80adf9965","html_url":"https://github.com/Instabug/netbird-gitops","commit_stats":null,"previous_names":["instabug/netbird-gitops"],"tags_count":1,"template":false,"template_full_name":null,"purl":"pkg:github/Instabug/netbird-gitops","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Instabug%2Fnetbird-gitops","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Instabug%2Fnetbird-gitops/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Instabug%2Fnetbird-gitops/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Instabug%2Fnetbird-gitops/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/Instabug","download_url":"https://codeload.github.com/Instabug/netbird-gitops/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Instabug%2Fnetbird-gitops/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":32365519,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-04-27T20:07:02.737Z","status":"online","status_checked_at":"2026-04-28T02:00:07.250Z","response_time":56,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-11-17T15:21:33.341Z","updated_at":"2026-04-28T04:03:17.668Z","avatar_url":"https://github.com/Instabug.png","language":"Go","funding_links":[],"categories":[],"sub_categories":[],"readme":"# NetBird GitOps\n\n[![Go Reference](https://pkg.go.dev/badge/github.com/Instabug/netbird-gitops.svg)](https://pkg.go.dev/github.com/Instabug/netbird-gitops)\n![CodeQL](https://github.com/instabug/netbird-gitops/actions/workflows/github-code-scanning/codeql/badge.svg)\n![Build](https://github.com/instabug/netbird-gitops/actions/workflows/docker-publish.yml/badge.svg)\n\nThis program is made to synchronize [Netbird](https://netbird.io) configuration \nwith a source-controller git repository.\n\n## Installation\n\nYou can deploy this as a container alongside NetBird management service or as a \nstandalone docker container\n\n### Docker Compose\n\n```yaml\nservices:\n  gitops:\n    image: instabug/netbird-gitops:latest\n    restart: unless-stopped\n    commands:\n      - --notify-services-path=/notify.yaml\n    volumes:\n      - ./notify.yaml:/\n      # SSH key used in case of SSH auth method\n      # - ./key.pem:/key.pem\n    environment:\n      # Repository Clone URL\n      - GIT_AUTH_METHOD=basic # Valid options (none, basic, ssh)\n      - GIT_REPO_URL=https://github.com/Instabug/netbird-gitops.git\n      # Path within repository for configurations, leave empty for root\n      - GIT_RELATIVE_PATH=netbird-configs\n      # HTTPS Username (Set to anything in case of access token)\n      - GIT_USERNAME=someone\n      # HTTPS Password/Access Token\n      - GIT_PASSWORD=password\n      # Uncomment in case of SSH key\n      # - GIT_PRIVATE_KEY_PATH=/key.pem\n      # - GIT_PRIVATE_KEY_PASSWORD=somepassword\n      - NETBIRD_TOKEN=abcdef\n      - NETBIRD_MANAGEMENT_API=https://api.netbird.io\n      - LOG_LEVEL=info\n\n```\n\n## Configuration\n\nConfiguration files are written in YAML and can be written in 1 or more files \nwithin the directory specified\n\n### Schema\n\nYou can check the [example](./example) for a configuration example.\n\n\u003e Note: All Group, and PostureCheck names are names, not IDs, NetBird GitOps does the translation\n\n#### NetBird GitOps Config\n\nConfiguration for NetBird GitOps itself\n\n```yaml\nconfig:\n  # autoSync behavior\n  # - manual: only sync if --sync-and-exit is set\n  # - update: only sync if Git is updated\n  # - enforce: always sync\n  autoSync: (\"manual\", \"update\", \"enforce\")\n  # Set peer groups individually\n  # When set to false, peers that belong to users are given the user's autogroups\n  individualPeerGroups: false\n```\n\n#### DNS Settings\n\nConfiguration for NetBird DNS \n\n```yaml\ndns:\n  disable_for:\n  - group1\n  - group2\n\nnameservers:\n- name: Google DNS\n  description: Google DNS servers\n  nameservers:\n    - ip: 8.8.8.8\n      ns_type: udp\n      port: 53\n  enabled: true\n  groups:\n    - group1\n    - group2\n  primary: true\n  domains:\n    - example.com\n  search_domains_enabled: true\n```\n\n#### Network Routes\n\n```yaml\nnetwork_routes:\n- network_type: (\"IPv4\"|\"IPv6\"|\"Domain\")\n  description: Route Description # Optional\n  network_id: Route 1 # Required\n  enabled: true # Optional, defaults to false\n  # peer_groups and peer are mutually exclusive\n  peer_groups: # Optional, must be set if peer is not set\n    - g2\n  peer: c2312515613213 # Optional, must be set if peer_groups not set\n  # domains and network are mutually exclusive\n  domains:\n    - example.com\n  network: 0.0.0.0/0 \n  metric: 9999 # Required\n  masquerade: true # Optional, defaults to false\n  groups: # Required\n    - g1\n  keep_route: true # Optional, deafults to false\n```\n\n#### Peers\n\nSince peers cannot be added from API, this is used to manage Peer Groups and settings\n\n```yaml\npeers:\n- id: cr6ibk8pcsa9d3fncct0 # Required\n  name: \"Test\" # Required\n  groups: # Optional, All is implicitly included\n  - g2\n  ssh_enabled: true # Optional, defaults to false\n  expiration_disabled: true # Optional, defaults to false\n```\n\n#### Policies\n\n```yaml\npolicies:\n- name: Production # Required\n  description: Production machines access # Required\n  enabled: false # Optional, defaults to false\n  source_posture_checks: # Optional\n  - pc1\n  action: accept # Required\n  bidirectional: false # Optional, defaults to false\n  protocol: all # Required (all|tcp|udp|icmp)\n  sources: # Required\n  - g1\n  destinations: # Required\n  - g3\n```\n\n#### Posture Checks\n\n```yaml\nposture_checks:\n- name: pc1 # Required\n  description: Something # Required\n  checks:\n    nb_version_check: # Optional\n      min_version: \"14.3\" # Required\n    os_version_check: # Optional\n      android: # Optional\n        min_version: \"13\" # Required\n      ios: # Optional\n        min_version: 17.3.1 # Required\n      darwin: # Optional\n        min_version: 14.2.1 # Required\n      linux: # Optional\n        min_kernel_version: 5.3.3 # Required\n      windows: # Optional\n        min_kernel_version: 10.0.1234 # Required\n    geo_location_check: # Optional\n      locations: # Required\n        - country_code: DE # Required\n          city_name: Berlin # Optional\n      action: allow # Required (allow|block)\n    peer_network_range_check: # Optional\n      ranges: # Required\n          - 192.168.1.0/24\n          - 10.0.0.0/8\n          - 2001:db8:1234:1a00::/56\n      action: allow # Required (allow|block)\n    process_check: # Optional\n      processes: # Required\n        - linux_path: /usr/local/bin/netbird # Optional\n          mac_path: /Applications/NetBird.app/Contents/MacOS/netbird # Optional\n          windows_path: \"C:\\ProgramData\\\\NetBird\\\\netbird.exe\" # Optional\n```\n\n#### Users\n\n```yaml\nusers:\n- email: someone@somewhere.com # Required\n  groups: # Required\n  - g1\n  - g2\n  role: admin # Optional, defaults to user (user|admin|owner)\n```\n\n### Notification Services\n\nThis projects supports sending notifications to any services supported by [nikoksr/notify](https://github.com/nikoksr/notify), however only Slack is implemented currently.\n\n#### Configuration schema\n\nConfiguring notification services exists in `notify.yaml` by default and can be overridden with `--notify-services-path`\n\n```yaml\nslack:\n  token: xoxb-....\n  channels:\n  - channel-a\n  - channel-b\n```\n\n## Usage\n\nnetbird-gitops can run in enforce mode where only Git configuration is the source of truth, it also supports manual syncing through the `--sync-and-exit` flag, which will pull the configuration, apply them and exit.\n\n```bash\n  -git-auth-method string\n    \tbasic (username-password/access token), or ssh (private key), or none (default \"none\")\n  -git-branch string\n    \tName of branch to pull changes from (default \"main\")\n  -git-password string\n    \tgit basic auth password, must be defined if --git-auth-method is basic\n  -git-private-key-password string\n    \tgit SSH private key password (if any)\n  -git-private-key-path string\n    \tgit SSH private key path, must be defined if --git-auth-method is ssh\n  -git-relative-path string\n    \tRelative path of NetBird configuration within the git repo\n  -git-repo-url string\n    \tGit Repo URL (ssh/https) (Required)\n  -git-username string\n    \tgit basic auth username, must be defined if --git-auth-method is basic\n  -log-level string\n    \tLog level (debug, info, warn, error)\n  -netbird-mgmt-api string\n    \tNetBird Management API URL\n  -netbird-token string\n    \tNetBird Management API token (default \"nbp_woIGracLxicjqDafocrFpKPZYO4KCN3HOcE5\")\n  -notify-services-path string\n    \tPath to notification services configuration yaml (default \"notify.yaml\")\n  -sync-and-exit\n    \tForce sync once and exit\n```\n\n## Legal\n\nNetBird is a [registered trademark](https://netbird.io/terms) of [Wiretrustee UG (haftungsbeschränkt)](https://netbird.io/) \u0026 [AUTHORS](https://github.com/netbirdio/netbird/blob/main/AUTHORS)","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Finstabug%2Fnetbird-gitops","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Finstabug%2Fnetbird-gitops","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Finstabug%2Fnetbird-gitops/lists"}