admin/felhom-controller
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

v0.308.0 (R-554, held-back-able): recovery-info.txt points at the dashboard's Restore page and the recovery code; the first-boot setup wizard is deleted

Browse Source 
Operator ruling 2026-10-12 (S27, 09 §3 decision 222). The operator approves the Hungarian text before
release. A box whose first ingestion failed now serves one bilingual waiting page and retries every
minute instead of the wizard. Own commit so the lead can hold it back.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS
This commit is contained in:
authentik Default Admin
2026-10-12 15:38:28 +02:00
parent fd28d70bff
commit faef8f8a91
36 changed files with 421 additions and 1916 deletions
Download Patch File Download Diff File Expand all files Collapse all files
controller/internal/bootstrap/bootstrap.go
+14 -14
View File
@@ -5,7 +5,7 @@
// uses the passphrase to PULL its full controller.yaml from the hub (which mints the customer-scoped
// hub api_key + identity + assets + backup + CF config), MERGES in the per-guest local_api block (the
// only thing the hub yaml lacks, because the hub must not know per-guest Proxmox internals), writes
// it, and comes up CONFIGURED — skipping the setup wizard.
// it, and comes up CONFIGURED (an unconfigured box waits and retries — the setup wizard is deleted, R-554).
//
// This replaces the old "seed a configured yaml from the agent's HOST key" path, which made the
// controller's hub reports 401 (the hub's /report needs the customer-scoped key, not the host key).
@@ -33,7 +33,7 @@ const DefaultMountPath = "/etc/felhom-bootstrap/bootstrap.json"
// SchemaV2 is the stable contract version the agent emits and the controller ingests. v2 changed the
// contract's MEANING (the controller pulls its config from the hub rather than seeding it from the
// agent's host key) and its field set, so it is a clean version bump with no v1 back-compat
// (pre-launch; zero v1 guests deployed). A non-v2 schema is rejected → setup mode.
// (pre-launch; zero v1 guests deployed). A non-v2 schema is rejected → the box waits (R-554).
const SchemaV2 = "felhom.bootstrap/v2"
// ErrPullTransient marks a pull failure as retryable (a boot-time network race reaching the hub).
@@ -95,7 +95,7 @@ func Path() string {
// - Idempotent: if cfg is already configured (customer.id set), the existing controller.yaml is
// NEVER clobbered and the hub is NEVER pulled — returns cfg unchanged.
// - Fail-safe: an absent/malformed bootstrap, a non-v2 schema, a missing required field, or a hub
// pull that ultimately fails leaves cfg unchanged (the caller proceeds to setup mode). It logs
// pull that ultimately fails leaves cfg unchanged (the caller serves the waiting page and retries, R-554). It logs
// and NEVER crashes — a hub outage at first boot must not brick the guest.
// - On success: writes controller.yaml (0600, atomic), reloads it, and returns the reloaded cfg.
func MaybeIngest(configPath string, cfg *config.Config, logger *log.Logger, pull PullFunc) *config.Config {
@@ -111,37 +111,37 @@ func MaybeIngest(configPath string, cfg *config.Config, logger *log.Logger, pull
data, err := os.ReadFile(bpath)
if err != nil {
if !os.IsNotExist(err) {
logger.Printf("[WARN] bootstrap: cannot read %s: %v — staying in setup", bpath, err)
logger.Printf("[WARN] bootstrap: cannot read %s: %v — waiting for the configuration", bpath, err)
}
return cfg // no bootstrap → normal setup
return cfg // no bootstrap → the caller waits (WaitForConfig)
}
var b Bootstrap
if err := json.Unmarshal(data, &b); err != nil {
logger.Printf("[WARN] bootstrap: %s is not valid JSON: %v — staying in setup", bpath, err)
logger.Printf("[WARN] bootstrap: %s is not valid JSON: %v — waiting for the configuration", bpath, err)
return cfg
}
if b.Schema != SchemaV2 {
logger.Printf("[WARN] bootstrap: unsupported schema %q (want %q) — staying in setup", b.Schema, SchemaV2)
logger.Printf("[WARN] bootstrap: unsupported schema %q (want %q) — waiting for the configuration", b.Schema, SchemaV2)
return cfg
}
if b.Customer.ID == "" || b.Hub.URL == "" || b.Hub.RetrievalPassword == "" {
logger.Printf("[WARN] bootstrap: %s missing customer.id / hub.url / hub.retrieval_password — staying in setup", bpath)
logger.Printf("[WARN] bootstrap: %s missing customer.id / hub.url / hub.retrieval_password — waiting for the configuration", bpath)
return cfg
}
if b.LocalAPI.Endpoint == "" || b.LocalAPI.Fingerprint == "" || b.LocalAPI.Token == "" {
logger.Printf("[WARN] bootstrap: %s missing local_api.{endpoint,fingerprint,token} — staying in setup", bpath)
logger.Printf("[WARN] bootstrap: %s missing local_api.{endpoint,fingerprint,token} — waiting for the configuration", bpath)
return cfg
}
if pull == nil {
logger.Printf("[WARN] bootstrap: no pull function wired — staying in setup")
logger.Printf("[WARN] bootstrap: no pull function wired — waiting for the configuration")
return cfg
}
// --- Pull the full controller.yaml from the hub, with bounded retry on transient errors only. ---
pulled, err := pullWithRetry(pull, b.Hub.URL, b.Customer.ID, b.Hub.RetrievalPassword, logger)
if err != nil {
logger.Printf("[WARN] bootstrap: hub config pull failed for customer %s from %s: %v — staying in setup (manual setup wizard remains the fallback)",
logger.Printf("[WARN] bootstrap: hub config pull failed for customer %s from %s: %v — waiting for the configuration (the waiting page retries every minute)",
b.Customer.ID, b.Hub.URL, err)
return cfg
}
@@ -150,16 +150,16 @@ func MaybeIngest(configPath string, cfg *config.Config, logger *log.Logger, pull
// every field the hub emits is preserved (forward-compat with hub template changes). ---
merged, err := mergeLocalAPI(pulled, b.LocalAPI)
if err != nil {
logger.Printf("[WARN] bootstrap: merging local_api into pulled config failed: %v — staying in setup", err)
logger.Printf("[WARN] bootstrap: merging local_api into pulled config failed: %v — waiting for the configuration", err)
return cfg
}
if err := writeFileAtomic(configPath, merged); err != nil {
logger.Printf("[WARN] bootstrap: could not write %s: %v — staying in setup", configPath, err)
logger.Printf("[WARN] bootstrap: could not write %s: %v — waiting for the configuration", configPath, err)
return cfg
}
reloaded, err := config.LoadPermissive(configPath)
if err != nil {
logger.Printf("[WARN] bootstrap: wrote %s but reload failed: %v — staying in setup", configPath, err)
logger.Printf("[WARN] bootstrap: wrote %s but reload failed: %v — waiting for the configuration", configPath, err)
return cfg
}
logger.Printf("[INFO] bootstrap: pulled config from %s for %s, merged local_api (%s) — coming up configured",