GREEN · RED · BLUE PACKAGE SKILL · VULTR · NETBIRD · AUTHENTIK

NetBird Package Skill

A reproducible Green, Red, and Blue workflow for a self-hosted NetBird control plane and its identity provider — Traefik, the combined netbird-server, the dashboard and Authentik — behind Cloudflare on a guarded Vultr instance.

One process, four services. Management, signal, relay and STUN are a single netbird-server multiplexed behind Traefik on 443, so the firewall opens 22, 80, 443 and one UDP port — and nothing else. Authentik gets its own hostname through the same Traefik, rather than the sidecar-and-routing-peer tunnel the upstream guide builds by hand: that needs a setup key which only exists after a human has logged in, and it makes NetBird's auth callbacks depend on a service reachable only through NetBird.

Quick start

npx skills add getcolors/netbird
cp .agents/skills/package-netbird-green/green ./green
chmod +x green
./green build
./green create --dry-run

Equivalent Red and Blue skills ship red and blue launchers.

Build renders reproducible output and dry-run walks the workflow without provider side effects. Real creation and deletion require explicit authorization.

Architecture

Compute

One Vultr instance and a firewall opening 22, 80 and 443, plus UDP 3478 for STUN. In keygen mode the account SSH key resource is named after the profile and lives in this deployment's state.

DNS

Two unproxied Cloudflare A records, one per hostname; Traefik obtains TLS from Let's Encrypt over TLS-ALPN-01. Proxying would break both UDP STUN and the challenge.

Server

Docker Compose: Traefik, the combined netbird-server, the dashboard, and Authentik with its Postgres and Redis — every image pinned by its own key in colors.yml.

Acceptance

Convergence enrols two throwaway peers on isolated networks and proves traffic flows over the relay; the workflow then validates both certificates through the system trust store and asserts the internal ports refuse connections.

The machine keypair

The deployment owns its SSH key, following the workspace SSH Keypair Standard. Leave vultr-ssh-keys out of colors.yml and the first real create generates ~/.ssh/<profile>, registers it at Vultr under the profile name, and a successful delete removes it last — never before.

The key lives outside the checkout. Cloning a deployment repository does not carry machine access with it; copy ~/.ssh/<profile> deliberately. A key with no state is never overwritten, and a Vultr key named after the profile that this deployment's state does not own stops the run — if its fingerprint is not yours, do not delete it.

Supplying vultr-ssh-keys opts out entirely: the package then generates, validates and deletes no key material. Rotation is a rebuild, because Vultr key lists are ForceNew.

The SSH config block

Convergence also writes one ~/.ssh/config block, following the workspace SSH Config Standard, so ssh <profile> reaches the host with no address, user or -i flag. The block names an IdentityFile only in keygen mode, where the package knows the key because it generated it. It is inserted above the first Host line, because ssh_config takes the first value it obtains and a Host * stanza higher in the file would otherwise win on User and IdentityFile.

Delete removes the block before destroying the instance, the reverse of the keypair: a block that outlives its host is stale but harmless, while a key removed early locks you out of a machine that still exists.

Exposure

Port	Exposure	Purpose
22	`vultr-ssh-sources`	Key-only SSH for convergence and recovery
80 / 443	`vultr-http-sources`	Traefik: dashboard, REST API, management and signal gRPC, relay WebSocket, embedded IdP, and Authentik on its own hostname
3478 / udp	`vultr-stun-sources`	STUN, bundled into `netbird-server`. The only UDP published — there is no coturn and no legacy relay port range.
9000 / 9090	loopback	NetBird healthcheck and metrics
5432 / 6379	loopback	Authentik's Postgres and Redis

Safety

Credentials are COLORS_PAR_* variables in the gitignored .envrc.private — never in colors.yml.
Never export COLORS_PAR_PROFILE; the profile keys remote state.
.colors/ is generated output: never edit or commit it.
compute-prevent-destroy: true guards deletion behind a one-run override.

Source on GitHub · Configuration reference · In the Package Skills Catalog · Featured on getcolors.ai