Dear Foreman community,
Some 9 months ago, I met some of you at Ghent CfgMgmtCamp 2025 and we discussed missing bits for EU OS, a documented setup with Foreman and FreeIPA to provision managed laptops with bootc images.
Amongst the missing bits discussed at the time was a convenient VPN integration in our setup.
Make Wireguard VPN work with Foreman for CfgMgmtCamp '27
We want to cater for the following typical scenarios:
- A user has the laptop in the home office in a private Wifi and the laptop needs to check for updates and pending Foreman jobs. Foreman is not publicly exposed but only via VPN.
- A user requests support from the IT while in home office and the IT help desk wants to login to the laptop despite the laptop being in a private Wifi and not local intranet.
- The sysadmin wants to configure specific intranet access policies for a given laptop.
- Bonus: The sysadmin wants to configure specific internet and intranet access policies for a given user account
For greenfield setups, Wireguard seems like a hot contender and both Tailscale and netbird offer VPN setups with granular configuration options and wireguard key management. Netbird is more open source last time I checked and thus the one to tackle first.
I would love to propose a common effort of the Foreman community to come up with a network architecture and possibly a Foreman plugin or provisioning script for VPN setup.
With your positive feedback and support, we can bring this to the call for contributions for the conf in Ghent 2027. The call ends on 20th October, thus in 8 days. Then we got another 3 months to make it work. Doable? 
Early Ideas for Implementation
Netbird supports at least the following options to setup clients:
- interactive SSO to link a connection to as specific user, see Install NetBird - NetBird Docs
- bootstrap via config file and secret key, see Bootstrap peers via config file - NetBird Docs
- One-off key — can be used only once to authenticate a single machine.
- Reusable key — can be used multiple times to authenticate a configurable number of machines.
For the per-machine VPN the 2nd choice seems the way to go with a few options for implementation:
- we configure a new provisioning variable that the admin needs to fill with a reusable key. A script generates the config file during provisioning. On first boot, the VPN is setup. Unclear how the reusable key can be protected.
- with a netbird service account access token stored in a provisioning variable, a script obtains a one-time token and generates the config file during provisioning. On first boot, the VPN is setup.
For the per-user VPN, netbird offers a GUI or a browser-based flow. Optimal would be to reuse the FreeIPA kerberos ticket for automatic setup of this 2nd VPN, but I found very little about kerberos support. The netbird docs don’t mention it. GitHub - kambiz-aghaiepour/netbird-extend: Renew NetBird sessions using Kerberos SSO and Firefox on a temporary VNC display. · GitHub could provide an avenue.