dtoro/oikos
1
0
Fork 0
Code Issues Pull Requests Actions 2 Packages Projects Releases Wiki Activity

fix(bootstrap): add --no-mesh so LAN-only secrets issuance doesn't block on Netbird SSO

Browse Source 
Running bootstrap without --no-secrets always tried to install and
connect Netbird, even when the mesh-check right after it already knows
how to fall back to plain LAN reachability. On a host nobody's watching
interactively (e.g. driven over SSH), this hangs forever at the
device-code prompt — hit live on strong, had to kill the stuck
`netbird up` process manually. --no-mesh skips netbird install/up while
still allowing the existing LAN-fallback path to satisfy secrets
issuance.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
This commit is contained in:
authentik Default Admin
2026-07-01 12:38:21 +02:00
parent b266c3f1d8
commit fc62cf38f7
1 changed files with 15 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

20
bootstrap.sh
View File

@@ -7,7 +7,11 @@
# curl ... | sudo bash -s -- --with-mcp # also wire Claude's .mcp.json # curl ... | sudo bash -s -- --with-mcp # also wire Claude's .mcp.json
# curl ... | sudo bash -s -- --with-hermes # also install Goose + Hermes wrapper # curl ... | sudo bash -s -- --with-hermes # also install Goose + Hermes wrapper
# curl ... | sudo bash -s -- --dry-run # show what would happen # curl ... | sudo bash -s -- --dry-run # show what would happen
# curl ... | sudo bash -s -- --no-secrets # skip age-key issuance # curl ... | sudo bash -s -- --no-secrets # skip age-key issuance entirely
# curl ... | sudo bash -s -- --no-mesh # get secrets over LAN only, skip
# # installing/connecting Netbird
# # (host must be on 192.168.8.0/24
# # or otherwise reach secrets.hubris.network)
# #
# Prerequisites the script verifies: # Prerequisites the script verifies:
# - running as root # - running as root
@@ -31,6 +35,7 @@ WITH_MCP=0
WITH_HERMES=0 WITH_HERMES=0
DRY_RUN=0 DRY_RUN=0
NO_SECRETS=0 NO_SECRETS=0
NO_MESH=0
GITEA_TOKEN="${HOMELAB_GITEA_TOKEN:-}" GITEA_TOKEN="${HOMELAB_GITEA_TOKEN:-}"
GITEA_USER="${HOMELAB_GITEA_USER:-dtoro}" GITEA_USER="${HOMELAB_GITEA_USER:-dtoro}"
@@ -41,6 +46,7 @@ while [ $# -gt 0 ]; do
--with-hermes) WITH_HERMES=1; shift ;; --with-hermes) WITH_HERMES=1; shift ;;
--dry-run) DRY_RUN=1; shift ;; --dry-run) DRY_RUN=1; shift ;;
--no-secrets) NO_SECRETS=1; shift ;; --no-secrets) NO_SECRETS=1; shift ;;
--no-mesh) NO_MESH=1; shift ;;
--gitea-token) GITEA_TOKEN="$2"; shift 2 ;; --gitea-token) GITEA_TOKEN="$2"; shift 2 ;;
--gitea-user) GITEA_USER="$2"; shift 2 ;; --gitea-user) GITEA_USER="$2"; shift 2 ;;
--help|-h) --help|-h)
@@ -206,10 +212,14 @@ if [ "${#missing[@]}" -gt 0 ]; then
fi fi
# -------- ensure netbird is installed + connected (workstation/VM hosts) -------- # -------- ensure netbird is installed + connected (workstation/VM hosts) --------
# Skipped on --no-secrets (LXCs that route via the LAN already) and --dry-run. # Skipped on --no-secrets (LXCs that route via the LAN already), --no-mesh
# Installs netbird if missing, then drives `netbird up` against the homelab # (explicit opt-out — secrets issuance still works if the mesh check below
# management server. The operator clicks the printed device-code URL once. # falls back to LAN reachability), and --dry-run. Installs netbird if
if [ "$NO_SECRETS" -eq 0 ] && [ "$DRY_RUN" -eq 0 ]; then # missing, then drives `netbird up` against the homelab management server.
# The operator clicks the printed device-code URL once — this blocks
# indefinitely if nobody approves it, so don't skip --no-mesh on a host
# nobody's watching interactively.
if [ "$NO_SECRETS" -eq 0 ] && [ "$DRY_RUN" -eq 0 ] && [ "$NO_MESH" -eq 0 ]; then
if ! command -v netbird >/dev/null 2>&1 && ! command -v tailscale >/dev/null 2>&1; then if ! command -v netbird >/dev/null 2>&1 && ! command -v tailscale >/dev/null 2>&1; then
echo "[bootstrap] no mesh CLI found; installing netbird..." echo "[bootstrap] no mesh CLI found; installing netbird..."
if [ "$OS" = "Darwin" ]; then if [ "$OS" = "Darwin" ]; then