# Generated by oikos build-hosts from inventory.yaml.
# Do NOT edit by hand.

kind: external
mcp_endpoint: https://mcp.hubris.network/mcp
mesh:
  netbird:
    fqdn: netbird-ionos.netbird.selfhosted
    ip: 100.122.165.149
mesh_globals:
  accepted:
    - netbird
    - tailscale
  primary: netbird
name: netbird-vps
notes:
  - Public IONOS VPS — hosts the vanilla netbird mgmt+signal+relay+dashboard stack + host coturn (see infrastructure/vps-hardening.md + infrastructure/mesh.md changelog 2026-05-21).
  - NOT a homelab client. No /etc/age/key.txt, no /opt/homelab-context clone. Managed via ssh from hubris; sshd is locked to hubris's pubkey.
  - Public IPv4 82.165.190.79. Auto-patching via unattended-upgrades.
  - Configs rendered by `homelab render-vps-configs` from vps/turnserver.conf.tmpl + vps/management.json.tmpl, with secrets decrypted from secrets/turn-shared-secret.yaml + secrets/netbird-authentik-oidc.yaml on hubris.
os: linux
role: netbird-mgmt
runs:
  - authentik
secrets_issuance_endpoint: https://secrets.hubris.network/issue
services_hosted:
  - backend: netbird-vps
    doc_page: knowledge/wiki/containers/106-auth-outpost.md
    name: authentik
    note: core runs on the VPS since 2026-05-31; LAN forward-auth outpost is auth-outpost (LXC 106) at 192.168.8.6:9000. Previous backend value "authentik" referenced the retired embedded-outpost host (LXC 124).
    risk_notes: SSO provider — outage locks login to OIDC/forward-auth services
    url: https://auth.hubris.network
ssh:
  user: root
state: active