From dd4072f1d4bb446778d9b0e90c4d8eb33d7e35a1 Mon Sep 17 00:00:00 2001 From: dtoro Date: Thu, 21 May 2026 08:12:55 +0200 Subject: [PATCH] bootstrap: enable netbird ssh-jwt-cache-ttl on workstation enrollment MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit After preflight detects MESH_CONNECTED=netbird, run `netbird down && netbird up --ssh-jwt-cache-ttl=86400` so ssh into mesh peers (e.g. `ssh -p 22022 root@proxmox-server.netbird.selfhosted ...`) stops triggering device-code SSO on every connection. Validated 2026-05-21 on republic-laptop: after one SSO, subsequent ssh sessions within 24h skip the device-code flow and run instantly. Fleet operations (e.g. pct exec through hubris into LXCs) reuse the cached JWT. Notes: - Flag is supported in netbird 0.71.x+ (netbirdio/netbird#4015). A version probe (`netbird up --help | grep ssh-jwt-cache-ttl`) skips the section on older clients. - Flag belongs on `netbird up` (client config), NOT on the daemon's ExecStart — putting it there crashes the daemon with "unknown flag". - Runs LAST in bootstrap, after secrets issuance + MCP wiring, so the brief mesh down/up doesn't disrupt earlier steps. Co-Authored-By: Claude Opus 4.7 (1M context) --- bootstrap.sh | 22 ++++++++++++++++++++++ 1 file changed, 22 insertions(+) diff --git a/bootstrap.sh b/bootstrap.sh index 4b3e18d..9a02cd7 100755 --- a/bootstrap.sh +++ b/bootstrap.sh @@ -325,6 +325,28 @@ PYEOF fi fi +# -------- netbird tuning (skip per-session SSO for ssh into mesh peers) -------- +# Apply the SSH JWT cache TTL so `ssh ... .netbird.selfhosted` doesn't trigger +# device-code SSO on every connection. Flag added in netbird 0.71.x +# (netbirdio/netbird#4015). It belongs on `netbird up` — putting it on the +# daemon's ExecStart crashes the daemon with "unknown flag". After this runs the +# FIRST ssh still prompts SSO once; subsequent sessions within 24h skip it. +if [ "$MESH_CONNECTED" = "netbird" ]; then + if [ "$DRY_RUN" -eq 1 ]; then + echo "+ would: netbird down && netbird up --ssh-jwt-cache-ttl=86400" + elif netbird up --help 2>&1 | grep -q -- "--ssh-jwt-cache-ttl"; then + echo "[bootstrap] netbird: enabling ssh-jwt-cache-ttl=86400 (one SSO per 24h)" + # `netbird up` short-circuits with "Already connected" — need down first. + netbird down >/dev/null 2>&1 || true + if ! netbird up --ssh-jwt-cache-ttl=86400; then + echo "[bootstrap] WARNING: netbird up with --ssh-jwt-cache-ttl failed; rerun manually:" + echo "[bootstrap] netbird down && netbird up --ssh-jwt-cache-ttl=86400" + fi + else + echo "[bootstrap] netbird: --ssh-jwt-cache-ttl flag not supported (need >=0.71.x); skipping" + fi +fi + # -------- done -------- cat <