From 34d2aef8eb4d637a165184df4cc370630fb1d7eb Mon Sep 17 00:00:00 2001
From: TechHutTV <brandon@techhut.tv>
Date: Tue, 25 Aug 2026 12:02:19 +0200
Subject: [PATCH] Stricter domain label regex, docker CLI error

---
 infrastructure_files/getting-started.sh | 22 +++++++++++++++-------
 1 file changed, 15 insertions(+), 7 deletions(-)

diff --git a/infrastructure_files/getting-started.sh b/infrastructure_files/getting-started.sh
index ccdf14782..51ae6dc58 100755
--- a/infrastructure_files/getting-started.sh
+++ b/infrastructure_files/getting-started.sh
@@ -109,12 +109,15 @@ check_nb_domain() {
     return 1
   fi
 
-  # Letters, digits, dots, and hyphens only; the domain is embedded in
-  # generated YAML and env files. This is not FQDN validation: "use-ip" and
-  # bare IP addresses are valid inputs here and both satisfy the pattern.
-  local re='^[A-Za-z0-9]([A-Za-z0-9.-]*[A-Za-z0-9])?$'
-  if [[ ! "$DOMAIN" =~ $re ]] || [[ "$DOMAIN" == *..* ]]; then
-    echo "The NETBIRD_DOMAIN may only contain letters, digits, dots, and hyphens, and cannot begin or end with a dot or hyphen." > /dev/stderr
+  # Letters, digits, dots, and hyphens only, with every dot-separated label
+  # starting and ending in a letter or digit; the domain is embedded in
+  # generated YAML and env files. The per-label form also rejects empty labels
+  # ("a..b"). This is not FQDN validation: "use-ip" and bare IP addresses are
+  # valid inputs here and both satisfy the pattern.
+  local label='[A-Za-z0-9]([A-Za-z0-9-]*[A-Za-z0-9])?'
+  local re="^${label}(\.${label})*$"
+  if [[ ! "$DOMAIN" =~ $re ]]; then
+    echo "The NETBIRD_DOMAIN may only contain letters, digits, dots, and hyphens, and each dot-separated label must begin and end with a letter or digit." > /dev/stderr
     return 1
   fi
 
@@ -463,7 +466,12 @@ apply_docker_subnet_override() {
 # NETBIRD_DOCKER_SUBNET covers those cases.
 check_docker_subnet_conflicts() {
   local expected_network="$1"
-  command -v docker &> /dev/null || return 0
+  if ! command -v docker &> /dev/null; then
+    echo "ERROR: the Docker CLI was not found in PATH." > /dev/stderr
+    echo "It is required to verify that $DOCKER_SUBNET is free before the built-in Traefik setup pins it." > /dev/stderr
+    echo "Install Docker (https://docs.docker.com/engine/install/) and run this script again." > /dev/stderr
+    exit 1
+  fi
 
   # docker's own stderr is left visible on purpose: "is the daemon running"
   # and socket permission errors are the actionable part. Only the exit status