sendnrw/netbird
2
0
Fork 0
mirror of https://github.com/netbirdio/netbird.git synced 2026-10-15 01:49:08 +02:00
Code Issues Packages Projects Releases Wiki Activity

[infrastructure] Fix flow auth secret for external Relay migrations (#7731) (#7737)

Browse Source
This commit is contained in:
Bethuel Mmbaga
2026-09-28 22:10:30 +03:00
committed by GitHub
parent a8162aaac5
commit 6441417eab
1 changed files with 18 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
infrastructure_files/migrate-to-enterprise.sh
+18 -4
View File
@@ -220,6 +220,21 @@ detect_exposed_address() {
yq eval '.server.exposedAddress // ""' "$CONFIG_YAML_HOST" yq eval '.server.exposedAddress // ""' "$CONFIG_YAML_HOST"
} }
detect_relay_auth_secret() {
local secret=""
local external_relay_count
external_relay_count=$(yq eval '(.server.relays.addresses // []) | length' "$CONFIG_YAML_HOST")
if (( external_relay_count > 0 )); then
secret=$(yq eval '.server.relays.secret // ""' "$CONFIG_YAML_HOST")
fi
if [[ -z "$secret" ]] || [[ "$secret" == "null" ]]; then
secret=$(yq eval '.server.authSecret // ""' "$CONFIG_YAML_HOST")
fi
printf '%s' "$secret"
}
# The engine is a config.yaml-only setting — there is no env override for it # The engine is a config.yaml-only setting — there is no env override for it
# (combined/cmd/root.go reads it from YAML and derives the env vars), so # (combined/cmd/root.go reads it from YAML and derives the env vars), so
# config.yaml is authoritative. Absent means the sqlite default. # config.yaml is authoritative. Absent means the sqlite default.
@@ -945,11 +960,10 @@ init_migration() {
if [[ "$MIGRATE_POSTGRES" == "yes" ]] || [[ "$EXISTING_POSTGRES" == "yes" ]]; then if [[ "$MIGRATE_POSTGRES" == "yes" ]] || [[ "$EXISTING_POSTGRES" == "yes" ]]; then
ENABLE_FLOW=$(read_yes_no "Step 3: Enable traffic flow? (requires Postgres)" "n") ENABLE_FLOW=$(read_yes_no "Step 3: Enable traffic flow? (requires Postgres)" "n")
if [[ "$ENABLE_FLOW" == "yes" ]]; then if [[ "$ENABLE_FLOW" == "yes" ]]; then
# Auth secret MUST match server.authSecret from config.yaml NB_FLOW_AUTH_SECRET=$(detect_relay_auth_secret)
NB_FLOW_AUTH_SECRET=$(yq eval '.server.authSecret // ""' "$CONFIG_YAML_HOST")
if [[ -z "$NB_FLOW_AUTH_SECRET" ]] || [[ "$NB_FLOW_AUTH_SECRET" == "null" ]]; then if [[ -z "$NB_FLOW_AUTH_SECRET" ]] || [[ "$NB_FLOW_AUTH_SECRET" == "null" ]]; then
echo "Could not read server.authSecret from $CONFIG_YAML_HOST." > /dev/stderr echo "Could not resolve the Relay auth secret from $CONFIG_YAML_HOST." > /dev/stderr
echo "Flow receiver auth must match the combined server's authSecret." > /dev/stderr echo "Set server.relays.secret for external Relays or server.authSecret for the local Relay." > /dev/stderr
exit 1 exit 1
fi fi