[management,signal,proxy,relay,misc] Restore legacy config wiring

management/cmd/admin.go

@@ -114,7 +114,7 @@ func withAdminConfig(cmd *cobra.Command, applyIDPDefaults bool, fn func(ctx cont
 }
 
 func loadAdminMgmtConfig(ctx context.Context, applyIDPDefaults bool) (*nbconfig.Config, string, error) {
-	config, err := loadManagementConfig(nbconfig.MgmtConfigPath)
+	config, err := decodeManagementConfig(nbconfig.MgmtConfigPath, &nbconfig.Config{})
 	if err != nil {
 		return nil, "", err
 	}

management/cmd/config.go

@@ -7,10 +7,7 @@ import (
 )
 
 func loadManagementConfig(configPath string) (*nbconfig.Config, error) {
-	cfg, err := configloader.Load(configPath, &nbconfig.Config{Datadir: defaultMgmtDataDir}, configloader.Options{
-		TagName:   "json",
-		Transform: envtemplate.Expand,
-	})
+	cfg, err := decodeManagementConfig(configPath, &nbconfig.Config{Datadir: defaultMgmtDataDir})
 	if err != nil {
 		return nil, err
 	}
@@ -19,3 +16,10 @@ func loadManagementConfig(configPath string) (*nbconfig.Config, error) {
 	}
 	return cfg, nil
 }
+
+func decodeManagementConfig(configPath string, defaults *nbconfig.Config) (*nbconfig.Config, error) {
+	return configloader.Load(configPath, defaults, configloader.Options{
+		TagName:   "json",
+		Transform: envtemplate.Expand,
+	})
+}

management/cmd/management.go

@@ -71,7 +71,7 @@ var (
 			}
 
 			var tlsEnabled bool
-			if config.HttpConfig.LetsEncryptDomain != "" || (config.HttpConfig.CertFile != "" && config.HttpConfig.CertKey != "") {
+			if mgmtLetsencryptDomain != "" || (config.HttpConfig.CertFile != "" && config.HttpConfig.CertKey != "") {
 				tlsEnabled = true
 			}
 
@@ -212,15 +212,15 @@ func LoadMgmtConfig(ctx context.Context, mgmtConfigPath string, flags *pflag.Fla
 }
 
 // ApplyCommandLineOverrides applies command-line flag overrides to the config
-func ApplyCommandLineOverrides(cfg *nbconfig.Config, flags *pflag.FlagSet) {
-	hasCertOverride := flags.Changed("cert-key") && flags.Changed("cert-file")
-	if (flags.Changed("letsencrypt-domain") || hasCertOverride) && cfg.HttpConfig == nil {
+func ApplyCommandLineOverrides(cfg *nbconfig.Config, _ *pflag.FlagSet) {
+	hasCertOverride := certKey != "" && certFile != ""
+	if (mgmtLetsencryptDomain != "" || hasCertOverride) && cfg.HttpConfig == nil {
 		cfg.HttpConfig = &nbconfig.HttpServerConfig{}
 	}
-	if flags.Changed("letsencrypt-domain") {
+	if mgmtLetsencryptDomain != "" {
 		cfg.HttpConfig.LetsEncryptDomain = mgmtLetsencryptDomain
 	}
-	if flags.Changed("datadir") {
+	if mgmtDataDir != "" {
 		cfg.Datadir = mgmtDataDir
 	}
 	if hasCertOverride {
@@ -378,11 +378,17 @@ func EnsureEncryptionKey(ctx context.Context, configPath string, cfg *nbconfig.C
 	if err != nil {
 		return fmt.Errorf("failed to generate datastore encryption key: %v", err)
 	}
-	cfg.DataStoreEncryptionKey = key
 
-	if err := util.DirectWriteJson(ctx, configPath, cfg); err != nil {
+	fileConfig, err := decodeManagementConfig(configPath, &nbconfig.Config{})
+	if err != nil {
+		return fmt.Errorf("reload config before saving encryption key: %w", err)
+	}
+	fileConfig.DataStoreEncryptionKey = key
+	if err := util.DirectWriteJson(ctx, configPath, fileConfig); err != nil {
 		return fmt.Errorf("failed to save config with new encryption key: %v", err)
 	}
+
+	cfg.DataStoreEncryptionKey = key
 	log.WithContext(ctx).Infof("DataStoreEncryptionKey generated and saved to config")
 	return nil
 }