From ab6b8fabc402ad44693791a66bcf64bc47351d05 Mon Sep 17 00:00:00 2001
From: root <root@hubris.local>
Date: Wed, 20 May 2026 18:38:41 +0200
Subject: [PATCH] bootstrap.sh: accept LAN reachability as a mesh-equivalent
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

LXCs without a mesh CLI sit on 192.168.8.0/24 which is in the
issuance service's MESH_SUBNETS — they should be able to bootstrap
without netbird/tailscale installed. New third path probes the
issuance /health endpoint directly; if reachable, treat that as
satisfying the mesh precondition.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 bootstrap.sh | 11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

diff --git a/bootstrap.sh b/bootstrap.sh
index a03f237..e020fd0 100755
--- a/bootstrap.sh
+++ b/bootstrap.sh
@@ -142,16 +142,21 @@ if [ "${#missing[@]}" -gt 0 ]; then
     exit 1
 fi
 
-# Mesh check — accept either Netbird OR Tailscale.
+# Mesh check — accept Netbird, Tailscale, or LAN reachability of the issuance
+# endpoint. LAN is fine for LXCs that don't run a mesh CLI but sit in the
+# trusted subnet (192.168.8.0/24) included in MESH_SUBNETS.
 MESH_CONNECTED=""
 if command -v netbird >/dev/null && netbird status 2>/dev/null | grep -q "Management: Connected"; then
     MESH_CONNECTED="netbird"
 elif command -v tailscale >/dev/null && tailscale status >/dev/null 2>&1; then
     MESH_CONNECTED="tailscale"
+elif curl -sfI -o /dev/null --max-time 3 "${ISSUANCE_URL_NETBIRD%/issue}/health" 2>/dev/null; then
+    MESH_CONNECTED="lan"
 fi
 if [ -z "$MESH_CONNECTED" ] && [ "$NO_SECRETS" -eq 0 ]; then
-    echo "neither netbird nor tailscale is connected; cannot bootstrap." >&2
-    echo "either bring up the mesh first, or pass --no-secrets to skip issuance." >&2
+    echo "no reachable issuance endpoint (no netbird/tailscale connected and" >&2
+    echo "$ISSUANCE_URL_NETBIRD did not respond to /health)." >&2
+    echo "either bring up the mesh first, fix DNS for *.hubris.network, or pass --no-secrets." >&2
     exit 1
 fi
 echo "[bootstrap] mesh: ${MESH_CONNECTED:-none (skipped, --no-secrets)}"