From 2e84268f61ad4a1b4ab808c11497ff4a4e7b4dbc Mon Sep 17 00:00:00 2001
From: Debian <linux@myhorse.netcell-it.de>
Date: Fri, 29 May 2026 17:18:33 +0200
Subject: [PATCH] =?UTF-8?q?fix(setup):=20TLS-Pr=C3=BCfungs-Checkbox=20aus?=
 =?UTF-8?q?=20Cluster-Join-GUI=20entfernt?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Sicherheit des Joins kommt vom HMAC-Token, nicht von TLS-Cert-Trust.
Insecure=true wird jetzt immer im Handler gesetzt — GUI-Nutzer müssen
das nicht kennen oder konfigurieren.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 VERSION                                 | 2 +-
 cmd/edgeguard-api/main.go               | 2 +-
 cmd/edgeguard-ctl/main.go               | 2 +-
 cmd/edgeguard-scheduler/main.go         | 2 +-
 internal/handlers/setup.go              | 3 +--
 management-ui/src/pages/Setup/index.tsx | 8 +-------
 6 files changed, 6 insertions(+), 13 deletions(-)

diff --git a/VERSION b/VERSION
index 2d53f23..3d370b4 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-1.1.150
+1.1.151
diff --git a/cmd/edgeguard-api/main.go b/cmd/edgeguard-api/main.go
index 08bae31..0523620 100644
--- a/cmd/edgeguard-api/main.go
+++ b/cmd/edgeguard-api/main.go
@@ -60,7 +60,7 @@ import (
 	usersvc "git.netcell-it.de/projekte/edgeguard-native/internal/services/users"
 )
 
-var version = "1.1.150"
+var version = "1.1.151"
 
 func main() {
 	addr := os.Getenv("EDGEGUARD_API_ADDR")
diff --git a/cmd/edgeguard-ctl/main.go b/cmd/edgeguard-ctl/main.go
index 2e549b1..0d3e993 100644
--- a/cmd/edgeguard-ctl/main.go
+++ b/cmd/edgeguard-ctl/main.go
@@ -11,7 +11,7 @@ import (
 	"git.netcell-it.de/projekte/edgeguard-native/internal/services/setup"
 )
 
-var version = "1.1.150"
+var version = "1.1.151"
 
 const usage = `edgeguard-ctl — EdgeGuard CLI
 
diff --git a/cmd/edgeguard-scheduler/main.go b/cmd/edgeguard-scheduler/main.go
index ea8f031..3a62d46 100644
--- a/cmd/edgeguard-scheduler/main.go
+++ b/cmd/edgeguard-scheduler/main.go
@@ -41,7 +41,7 @@ import (
 	"git.netcell-it.de/projekte/edgeguard-native/internal/services/tlscerts"
 )
 
-var version = "1.1.150"
+var version = "1.1.151"
 
 const (
 	// renewTickInterval — how often we re-evaluate expiring certs.
diff --git a/internal/handlers/setup.go b/internal/handlers/setup.go
index f569230..4bbabfb 100644
--- a/internal/handlers/setup.go
+++ b/internal/handlers/setup.go
@@ -151,7 +151,6 @@ func (h *SetupHandler) JoinCluster(c *gin.Context) {
 		ACMEEmail   string `json:"acme_email"   binding:"required,email"`
 		PrimaryFQDN string `json:"primary_fqdn" binding:"required"`
 		Token       string `json:"token"        binding:"required"`
-		Insecure    bool   `json:"insecure"`
 	}
 	if err := c.ShouldBindJSON(&body); err != nil {
 		response.BadRequest(c, err)
@@ -164,7 +163,7 @@ func (h *SetupHandler) JoinCluster(c *gin.Context) {
 		PrimaryFQDN: body.PrimaryFQDN,
 		Token:       strings.TrimSpace(body.Token),
 		CommonName:  fqdn,
-		Insecure:    body.Insecure,
+		Insecure:    true, // security comes from the HMAC token, not TLS cert trust
 		Force:       true, // bootstrap self-signed cert must be replaced
 		Version:     h.Version,
 		NodeID:      h.NodeID,
diff --git a/management-ui/src/pages/Setup/index.tsx b/management-ui/src/pages/Setup/index.tsx
index 0fb7bb9..408cccb 100644
--- a/management-ui/src/pages/Setup/index.tsx
+++ b/management-ui/src/pages/Setup/index.tsx
@@ -1,5 +1,5 @@
 import { useState } from 'react'
-import { Alert, Button, Card, Checkbox, Form, Input, Space, Typography, message } from 'antd'
+import { Alert, Button, Card, Form, Input, Space, Typography, message } from 'antd'
 import { ArrowLeftOutlined, CheckCircleOutlined, ClusterOutlined, DesktopOutlined } from '@ant-design/icons'
 import { useNavigate } from 'react-router-dom'
 import { useTranslation } from 'react-i18next'
@@ -24,7 +24,6 @@ interface JoinValues {
   acme_email: string
   primary_fqdn: string
   token: string
-  insecure?: boolean
 }
 
 const FQDN_RE = /^([a-zA-Z0-9]([a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?\.)+[a-zA-Z]{2,}$/
@@ -78,7 +77,6 @@ export default function SetupPage({ onComplete: _onComplete }: Props) {
         acme_email: vals.acme_email.trim().toLowerCase(),
         primary_fqdn: vals.primary_fqdn.trim().toLowerCase(),
         token: vals.token.trim(),
-        insecure: vals.insecure ?? false,
       })
       setJoinDone(true)
     } catch (e: unknown) {
@@ -281,10 +279,6 @@ export default function SetupPage({ onComplete: _onComplete }: Props) {
                 />
               </Form.Item>
 
-              <Form.Item name="insecure" valuePropName="checked">
-                <Checkbox>{t('setup.joinInsecure')}</Checkbox>
-              </Form.Item>
-
               <Form.Item style={{ marginBottom: 0 }}>
                 <Button type="primary" htmlType="submit" block loading={loading}>
                   {t('setup.nodeSubmit')}