mirror of
https://github.com/netbirdio/netbird.git
synced 2026-10-10 23:49:09 +02:00
Nicolas Frati
a5834fdaab
* [management,signal] Make the Let's Encrypt challenge listener address configurable With Let's Encrypt enabled and --port set to something other than 443, signal and management also opened a separate challenge listener that was hard-coded to :443. Non-root deployments, such as the UBI images, could not start that listener. Add --letsencrypt-listen-address to both. It defaults to :443, so current behavior is unchanged. An empty value disables the separate listener for setups that forward public port 443 to --port, where the main TLS listener already answers TLS-ALPN-01 challenges. Signal now fails on startup when the challenge listener cannot bind, and exits non-zero when a server stops unexpectedly instead of exiting 0. A failure reported before the run loop waited was previously dropped. Management no longer opens a new :443 listener on shutdown just to close it. * [management,signal] Keep the challenge listener change additive Remove the Signal fail-fast changes from this PR. They change the behavior that existing installations see after an upgrade, so they move to a separate PR. If the challenge listener cannot bind, Signal now logs the error and continues. The main TLS listener still answers TLS-ALPN-01 challenges. Management keeps its previous behavior and stops with an error. The check for an empty address moves to the caller, so the function does not return a nil listener with a nil error. Also add assertion messages, guard a nil listener in a test cleanup, and add the flag to the Signal README.
102 lines
5.9 KiB
Go
102 lines
5.9 KiB
Go
package cmd
|
|
|
|
import (
|
|
"fmt"
|
|
|
|
"github.com/spf13/cobra"
|
|
|
|
nbconfig "github.com/netbirdio/netbird/management/internals/server/config"
|
|
"github.com/netbirdio/netbird/version"
|
|
)
|
|
|
|
const (
|
|
// ExitSetupFailed defines exit code
|
|
ExitSetupFailed = 1
|
|
idpSignKeyRefreshEnabledFlagName = "idp-sign-key-refresh-enabled"
|
|
)
|
|
|
|
var (
|
|
dnsDomain string
|
|
mgmtDataDir string
|
|
logLevel string
|
|
logFile string
|
|
disableMetrics bool
|
|
disableSingleAccMode bool
|
|
disableGeoliteUpdate bool
|
|
idpSignKeyRefreshEnabled bool
|
|
userDeleteFromIDPEnabled bool
|
|
mgmtPort int
|
|
mgmtMetricsPort int
|
|
disableLegacyManagementPort bool
|
|
mgmtLetsencryptDomain string
|
|
mgmtLetsencryptListen string
|
|
mgmtSingleAccModeDomain string
|
|
certFile string
|
|
certKey string
|
|
|
|
rootCmd = &cobra.Command{
|
|
Use: "netbird-mgmt",
|
|
Short: "",
|
|
Long: "",
|
|
Version: version.NetbirdVersion(),
|
|
SilenceUsage: true,
|
|
}
|
|
|
|
migrationCmd = &cobra.Command{
|
|
Use: "sqlite-migration",
|
|
Short: "Contains sub-commands to perform JSON file store to SQLite store migration and rollback",
|
|
Long: "",
|
|
SilenceUsage: true,
|
|
}
|
|
)
|
|
|
|
// Execute executes the root command.
|
|
func Execute() error {
|
|
return rootCmd.Execute()
|
|
}
|
|
|
|
// Customize hands the fully built root command to fn so an embedding binary
|
|
// can extend or adjust the command tree — most commonly attaching its own
|
|
// subcommands next to (or under) the built-in ones — before calling Execute.
|
|
// The root command is constructed in this package's init, so Customize may be
|
|
// called from the embedding binary's main at any point before Execute.
|
|
func Customize(fn func(root *cobra.Command)) {
|
|
fn(rootCmd)
|
|
}
|
|
|
|
func init() {
|
|
mgmtCmd.Flags().IntVar(&mgmtPort, "port", 80, "server port to listen on (defaults to 443 if TLS is enabled, 80 otherwise")
|
|
mgmtCmd.Flags().BoolVar(&disableLegacyManagementPort, "disable-legacy-port", false, "disabling the old legacy port (33073)")
|
|
mgmtCmd.Flags().IntVar(&mgmtMetricsPort, "metrics-port", 9090, "metrics endpoint http port. Metrics are accessible under host:metrics-port/metrics")
|
|
mgmtCmd.Flags().StringVar(&mgmtDataDir, "datadir", defaultMgmtDataDir, "server data directory location")
|
|
mgmtCmd.Flags().StringVar(&nbconfig.MgmtConfigPath, "config", defaultMgmtConfig, "Netbird config file location. Config params specified via command line (e.g. datadir) have a precedence over configuration from this file")
|
|
mgmtCmd.Flags().StringVar(&mgmtLetsencryptDomain, "letsencrypt-domain", "", "a domain to issue Let's Encrypt certificate for. Enables TLS using Let's Encrypt. Will fetch and renew certificate, and run the server with TLS")
|
|
mgmtCmd.Flags().StringVar(&mgmtLetsencryptListen, "letsencrypt-listen-address", ":443", "address of the separate Let's Encrypt challenge listener, used when --port is not 443. Set it empty when public port 443 is forwarded to --port, which answers the challenges itself")
|
|
mgmtCmd.Flags().StringVar(&mgmtSingleAccModeDomain, "single-account-mode-domain", defaultSingleAccModeDomain, "Enables single account mode. This means that all the users will be under the same account grouped by the specified domain. If the installation has more than one account, the property is ineffective. Enabled by default with the default domain "+defaultSingleAccModeDomain)
|
|
mgmtCmd.Flags().BoolVar(&disableSingleAccMode, "disable-single-account-mode", false, "If set to true, disables single account mode. The --single-account-mode-domain property will be ignored and every new user will have a separate NetBird account.")
|
|
mgmtCmd.Flags().StringVar(&certFile, "cert-file", "", "Location of your SSL certificate. Can be used when you have an existing certificate and don't want a new certificate be generated automatically. If letsencrypt-domain is specified this property has no effect")
|
|
mgmtCmd.Flags().StringVar(&certKey, "cert-key", "", "Location of your SSL certificate private key. Can be used when you have an existing certificate and don't want a new certificate be generated automatically. If letsencrypt-domain is specified this property has no effect")
|
|
mgmtCmd.Flags().BoolVar(&disableMetrics, "disable-anonymous-metrics", false, "disables push of anonymous usage metrics to NetBird")
|
|
mgmtCmd.Flags().StringVar(&dnsDomain, "dns-domain", defaultSingleAccModeDomain, fmt.Sprintf("Domain used for peer resolution. This is appended to the peer's name, e.g. pi-server. %s. Max length is 192 characters to allow appending to a peer name with up to 63 characters.", defaultSingleAccModeDomain))
|
|
mgmtCmd.Flags().BoolVar(&idpSignKeyRefreshEnabled, idpSignKeyRefreshEnabledFlagName, false, "Enable cache headers evaluation to determine signing key rotation period. This will refresh the signing key upon expiry.")
|
|
mgmtCmd.Flags().BoolVar(&userDeleteFromIDPEnabled, "user-delete-from-idp", false, "Allows to delete user from IDP when user is deleted from account")
|
|
mgmtCmd.Flags().BoolVar(&disableGeoliteUpdate, "disable-geolite-update", true, "disables automatic updates to the Geolite2 geolocation databases")
|
|
rootCmd.MarkFlagRequired("config") //nolint
|
|
|
|
rootCmd.PersistentFlags().StringVar(&logLevel, "log-level", "info", "")
|
|
rootCmd.PersistentFlags().StringVar(&logFile, "log-file", defaultLogFile, "sets Netbird log path. If console is specified the log will be output to stdout")
|
|
rootCmd.AddCommand(mgmtCmd)
|
|
|
|
migrationCmd.PersistentFlags().StringVar(&mgmtDataDir, "datadir", defaultMgmtDataDir, "server data directory location")
|
|
migrationCmd.MarkFlagRequired("datadir") //nolint
|
|
|
|
migrationCmd.AddCommand(upCmd)
|
|
|
|
rootCmd.AddCommand(migrationCmd)
|
|
|
|
ac := newAdminCommands()
|
|
ac.PersistentFlags().StringVar(&nbconfig.MgmtConfigPath, "config", defaultMgmtConfig, "Netbird config file location")
|
|
rootCmd.AddCommand(ac)
|
|
rootCmd.AddCommand(newLegacyTokenCommand())
|
|
}
|