dtoro dd4072f1d4 bootstrap: enable netbird ssh-jwt-cache-ttl on workstation enrollment ...

After preflight detects MESH_CONNECTED=netbird, run `netbird down && netbird up
--ssh-jwt-cache-ttl=86400` so ssh into mesh peers (e.g. `ssh -p 22022
root@proxmox-server.netbird.selfhosted ...`) stops triggering device-code SSO
on every connection.

Validated 2026-05-21 on republic-laptop: after one SSO, subsequent ssh
sessions within 24h skip the device-code flow and run instantly. Fleet
operations (e.g. pct exec through hubris into LXCs) reuse the cached JWT.

Notes:
- Flag is supported in netbird 0.71.x+ (netbirdio/netbird#4015). A version
  probe (`netbird up --help | grep ssh-jwt-cache-ttl`) skips the section on
  older clients.
- Flag belongs on `netbird up` (client config), NOT on the daemon's
  ExecStart — putting it there crashes the daemon with "unknown flag".
- Runs LAST in bootstrap, after secrets issuance + MCP wiring, so the brief
  mesh down/up doesn't disrupt earlier steps.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

2026-05-21 08:12:55 +02:00

14 KiB

Executable File

Raw Blame History

View Raw