From fc62cf38f7c9299545b846ec100c3cc96e894ede Mon Sep 17 00:00:00 2001 From: dtoro Date: Wed, 1 Jul 2026 12:38:21 +0200 Subject: [PATCH] fix(bootstrap): add --no-mesh so LAN-only secrets issuance doesn't block on Netbird SSO MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Running bootstrap without --no-secrets always tried to install and connect Netbird, even when the mesh-check right after it already knows how to fall back to plain LAN reachability. On a host nobody's watching interactively (e.g. driven over SSH), this hangs forever at the device-code prompt — hit live on strong, had to kill the stuck `netbird up` process manually. --no-mesh skips netbird install/up while still allowing the existing LAN-fallback path to satisfy secrets issuance. Co-Authored-By: Claude Sonnet 5 --- bootstrap.sh | 20 +++++++++++++++----- 1 file changed, 15 insertions(+), 5 deletions(-) diff --git a/bootstrap.sh b/bootstrap.sh index f99c569..70608bb 100755 --- a/bootstrap.sh +++ b/bootstrap.sh @@ -7,7 +7,11 @@ # curl ... | sudo bash -s -- --with-mcp # also wire Claude's .mcp.json # curl ... | sudo bash -s -- --with-hermes # also install Goose + Hermes wrapper # curl ... | sudo bash -s -- --dry-run # show what would happen -# curl ... | sudo bash -s -- --no-secrets # skip age-key issuance +# curl ... | sudo bash -s -- --no-secrets # skip age-key issuance entirely +# curl ... | sudo bash -s -- --no-mesh # get secrets over LAN only, skip +# # installing/connecting Netbird +# # (host must be on 192.168.8.0/24 +# # or otherwise reach secrets.hubris.network) # # Prerequisites the script verifies: # - running as root @@ -31,6 +35,7 @@ WITH_MCP=0 WITH_HERMES=0 DRY_RUN=0 NO_SECRETS=0 +NO_MESH=0 GITEA_TOKEN="${HOMELAB_GITEA_TOKEN:-}" GITEA_USER="${HOMELAB_GITEA_USER:-dtoro}" @@ -41,6 +46,7 @@ while [ $# -gt 0 ]; do --with-hermes) WITH_HERMES=1; shift ;; --dry-run) DRY_RUN=1; shift ;; --no-secrets) NO_SECRETS=1; shift ;; + --no-mesh) NO_MESH=1; shift ;; --gitea-token) GITEA_TOKEN="$2"; shift 2 ;; --gitea-user) GITEA_USER="$2"; shift 2 ;; --help|-h) @@ -206,10 +212,14 @@ if [ "${#missing[@]}" -gt 0 ]; then fi # -------- ensure netbird is installed + connected (workstation/VM hosts) -------- -# Skipped on --no-secrets (LXCs that route via the LAN already) and --dry-run. -# Installs netbird if missing, then drives `netbird up` against the homelab -# management server. The operator clicks the printed device-code URL once. -if [ "$NO_SECRETS" -eq 0 ] && [ "$DRY_RUN" -eq 0 ]; then +# Skipped on --no-secrets (LXCs that route via the LAN already), --no-mesh +# (explicit opt-out — secrets issuance still works if the mesh check below +# falls back to LAN reachability), and --dry-run. Installs netbird if +# missing, then drives `netbird up` against the homelab management server. +# The operator clicks the printed device-code URL once — this blocks +# indefinitely if nobody approves it, so don't skip --no-mesh on a host +# nobody's watching interactively. +if [ "$NO_SECRETS" -eq 0 ] && [ "$DRY_RUN" -eq 0 ] && [ "$NO_MESH" -eq 0 ]; then if ! command -v netbird >/dev/null 2>&1 && ! command -v tailscale >/dev/null 2>&1; then echo "[bootstrap] no mesh CLI found; installing netbird..." if [ "$OS" = "Darwin" ]; then