konairius/homelab
10
0
Fork 0
Code Issues 8 Pull Requests 2 Packages Projects Releases 1 Wiki Activity

fix(netbird-rotation): match key settings (ephemeral+dns), fill group, enable #308

Merged
k.renner merged 1 commits from fix/netbird-rotation-key-settings into master 2026-07-19 07:08:03 +00:00
Conversation 0 Commits 1 Files Changed 1
+11 -16
claude-bot commented 2026-07-19 07:06:52 +00:00
Member
Copy Link
Copy Source

End-to-end test of #304 caught the minted key having wrong settings vs the ingress key (per screenshot): ephemeral=false (must be true — DaemonSet peers re-enroll fresh each restart and must be auto-reaped) and allow_extra_dns_labels=false (must be true — the DNS capability). Fixed live and in the manifest:

  • Add ephemeral: true + allow_extra_dns_labels: true to the POST /api/setup-keys payload.
  • Fill NB_AUTO_GROUPS = d8umic2oc9cs73d4e1f0 (k8s-ingress-router).
  • Keep the 1y expiry — intentional (an auto-rotated key should expire so a silently-broken rotation surfaces; do not match the original's never-expire).
  • suspend: false — tested end-to-end and enabled.

Verified: kustomize + python syntax clean; live daemonset re-enrolled on a correctly-configured key.

End-to-end test of #304 caught the minted key having **wrong settings** vs the ingress key (per screenshot): `ephemeral=false` (must be **true** — DaemonSet peers re-enroll fresh each restart and must be auto-reaped) and `allow_extra_dns_labels=false` (must be **true** — the `DNS` capability). Fixed live and in the manifest: - Add `ephemeral: true` + `allow_extra_dns_labels: true` to the `POST /api/setup-keys` payload. - Fill `NB_AUTO_GROUPS` = `d8umic2oc9cs73d4e1f0` (k8s-ingress-router). - **Keep** the 1y expiry — intentional (an auto-rotated key *should* expire so a silently-broken rotation surfaces; do not match the original's never-expire). - `suspend: false` — tested end-to-end and enabled. Verified: kustomize + python syntax clean; live daemonset re-enrolled on a correctly-configured key.
claude-bot added 1 commit 2026-07-19 07:06:52 +00:00
fix(netbird-rotation): match key settings (ephemeral+dns), fill group, enable bbdd488710 
Testing #304 end-to-end revealed the minted setup key had the WRONG settings vs the ingress key: ephemeral=false (should be true — peers must be auto-reaped; these DaemonSet peers re-enroll fresh each restart) and allow_extra_dns_labels=false (should be true — the DNS capability). Remediated live and fixed the payload:
- add ephemeral: true, allow_extra_dns_labels: true to the setup-keys POST.
- NB_AUTO_GROUPS = d8umic2oc9cs73d4e1f0 (k8s-ingress-router).
- KEEP the 1y expiry (intentional: an auto-rotated key should expire so a broken rotation surfaces — do NOT match the original's never-expire).
- suspend: false (tested + enabled).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015K7gLUVVnutvDnzV2TrMRJ
k.renner merged commit 084644da43 into master 2026-07-19 07:08:03 +00:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
Clear labels
apollo
Hermes expert: Immich, Audiobookshelf, Libation, Navidrome, Music Assistant
 atlas
Hermes expert: Talos, Flux, network, Authentik, Matrix, monitoring
 clio
Hermes expert: Paperless, wiki, ical-proxy, TRMNL, websites
 daedalus
Hermes expert: Gitea, Woodpecker, Renovate, review-bot, Hermes
 hestia
Hermes expert: Home Assistant, IoT, MQTT, ESPHome, voice
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
alert-monitor-bot claude-bot (Claude Bot) flux hermes-bot issue-fix-bot k.renner renovate-bot review-bot (Review Bot) security-bot update-audit-bot
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: konairius/homelab#308