#netbird
5 posts tagged netbird.
Cutover without downtime: migrating users while the old VPN stays up
The new mesh works. Now move real people onto it without a bad day. This part is the discipline that makes a migration boring: a real pilot, simpler onboarding, a wave-by-wave cutover with the old VPN as a live safety net, and backups you've actually restored.
Routes and policy: giving the mesh the keys, one team at a time
An authenticated peer that can't reach anything is useless. This part turns the gateway into a routing peer, advertises the internal network, pushes internal DNS, and replaces 'connected means full access' with default-deny, group-based policy.
The two networks bare-metal guides skip, and booting the head node
Almost every \"my node won't PXE boot\" problem is a network problem. Here's the two-network design, including the DHCP-less network that makes stateless booting possible, and how to stand up the head node on it.
The gateway: self-hosted NetBird behind Caddy, with a relay
Now the WireGuard control plane. This part stands up self-hosted NetBird on a DMZ gateway, fronts it with Caddy issuing TLS over DNS-01, points it at the SSO for auth, and adds a coturn relay for the peers that can't connect directly.
Why we're tearing out a VPN that works
The old OpenVPN setup wasn't broken. It was a pile of per-user certificates and a manual onboarding ritual. Here's the case for replacing it with a self-hosted WireGuard mesh tied to the directory, and the one rule that keeps the swap from becoming an outage.