NetBird Agent Network on Vultr or DigitalOcean

A Green workflow that turns one colors.yml into a running Agent Network demo: OpenTofu for the machine, its provider firewall and two Cloudflare records (the base name and its wildcard); Ansible for Traefik, the combined netbird-server, the dashboard in agent-network-only mode, the NetBird reverse proxy in private mode, the control plane (provider, guardrail, policy, global limit), and the isolated agent container.

The demo's claim: the agent has no internet path — two independent boundaries, an internal Docker network and DOCKER-USER rules — and its only route to an LLM is the keyless agent-network endpoint over the WireGuard tunnel, where every request carries the peer's identity, passes the policy, and is metered. Convergence proves the claim (positive and negative space both) or fails.

Compute library boundary