sendnrw/netbird
2
0
Fork 0
mirror of https://github.com/netbirdio/netbird.git synced 2026-10-13 08:59:08 +02:00
Code Issues Packages Projects Releases Wiki Activity

[management,client] Default to NetBird's upload service when nothing is configured

Browse Source 
The previous commit made a peer with no destination — no MDM override, no URL
named by the caller, nothing published by its management server — refuse to
upload and keep the bundle local unless it was enrolled with NetBird's cloud.
That closed the reported data-boundary concern, but it broke the default for
everyone who uploads a bundle as part of their day: a self-hosted user opening
a support ticket got a refusal where the command used to work.

Product decision (NetBird's, not the reporter's): the knob to keep bundles
inside your own infrastructure is what this branch provides, and it is enough.
The default stays the service NetBird runs, self-hosted included. An admin who
needs the bundles to stay in-house configures the destination; until then the
everyday flow keeps working.

So ResolveUploadURL drops the cloud check, the sentinel error and the
managementURL argument, and never fails:

    MDM  >  explicitly named URL  >  published by management  >  NetBird's service

Nothing observable changes for a deployment that configures nothing, which also
removes two edge cases the fail-closed default had: a peer still enrolled on the
legacy api.wiretrustee.com host would have been classified self-hosted and
refused, and an upgrade would have silently stopped uploads for self-hosted
deployments relying on them. The privilege gate is unaffected — a host other
than the default one still requires a privileged caller, so pointing the CLI
somewhere other than what management published needs root.
This commit is contained in:
riccardom
2026-09-10 16:38:41 +02:00
parent fcb9b02451
commit c71fd1d841
16 changed files with 88 additions and 163 deletions
Download Patch File Download Diff File Expand all files Collapse all files
client/internal/debug/destination.go
+15 -27
View File
@@ -1,41 +1,29 @@
package debug
import (
"errors"
"github.com/netbirdio/netbird/client/internal/metrics"
"github.com/netbirdio/netbird/upload-server/types"
)
// ErrNoUploadDestination reports that a bundle has nowhere to go: the
// management server of this deployment publishes no upload service, and the
// peer is not enrolled with NetBird's cloud either. A debug bundle carries the
// peer's logs, routes, DNS and firewall state, so the default is to keep it
// inside the operator's control sphere rather than fall back to the service
// NetBird runs.
var ErrNoUploadDestination = errors.New("this deployment publishes no debug bundle upload service; set it on the account settings or in the management server config, or pass an explicit upload URL")
// ResolveUploadURL decides where a debug bundle may be uploaded.
// ResolveUploadURL decides where a debug bundle is uploaded.
//
// requested is a destination a caller named explicitly (a CLI flag, the daemon
// request); it always wins, and the callers that accept one gate it separately.
// published is what the management server of this deployment advertises, which
// the engine holds (Engine.DebugUploadURL). With neither, only a peer enrolled
// with NetBird's cloud falls back to the service NetBird runs — for anyone else
// that would carry the bundle out of the deployment the operator controls, so it
// fails closed with ErrNoUploadDestination.
func ResolveUploadURL(requested, published, managementURL string) (string, error) {
// requested is a destination a caller named explicitly — an MDM override, the
// CLI's --upload-bundle-url, a remote job's upload_url; it always wins, and the
// callers that accept one gate it separately (see requirePrivilegeForUploadURL:
// any host other than the default needs a privileged caller). published is what
// the management server of this deployment advertises, which the engine holds
// (Engine.DebugUploadURL). With neither, the upload service NetBird runs is the
// default, for a self-hosted deployment as much as for a cloud one: an operator
// who needs the bundles to stay inside their own infrastructure points either
// knob at their own upload service, and until they do the everyday
// "collect a bundle and send it to support" flow keeps working.
func ResolveUploadURL(requested, published string) string {
if requested != "" {
return requested, nil
return requested
}
if published != "" {
return published, nil
return published
}
if metrics.DetermineDeploymentType(managementURL) == metrics.DeploymentTypeCloud {
return types.DefaultBundleURL, nil
}
return "", ErrNoUploadDestination
return types.DefaultBundleURL
}