From 60e2aec5d94d0de099fa29a321458a4c1038db69 Mon Sep 17 00:00:00 2001 From: Debian Date: Fri, 29 May 2026 17:14:34 +0200 Subject: [PATCH] =?UTF-8?q?fix(setup):=20Force-Flag=20f=C3=BCr=20cluster-j?= =?UTF-8?q?oin=20=E2=80=94=20Bootstrap-Cert=20wird=20automatisch=20ersetzt?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Der API-Boot erstellt für Single-Node-Betrieb automatisch ein selbst-signiertes peer-Cert. Beim Join über die GUI wurde das als Fehler gemeldet. clusterjoin.Request.Force=true im Setup-Handler überspringt die HasPeer-Prüfung; CLI (edgeguard-ctl cluster-join) bleibt vorsichtig (Force=false, manuelles rm nötig). Co-Authored-By: Claude Sonnet 4.6 --- VERSION | 2 +- cmd/edgeguard-api/main.go | 2 +- cmd/edgeguard-ctl/main.go | 2 +- cmd/edgeguard-scheduler/main.go | 2 +- internal/handlers/setup.go | 1 + internal/services/clusterjoin/join.go | 7 ++++++- 6 files changed, 11 insertions(+), 5 deletions(-) diff --git a/VERSION b/VERSION index 4f706ff..2d53f23 100644 --- a/VERSION +++ b/VERSION @@ -1 +1 @@ -1.1.149 +1.1.150 diff --git a/cmd/edgeguard-api/main.go b/cmd/edgeguard-api/main.go index 01c1391..08bae31 100644 --- a/cmd/edgeguard-api/main.go +++ b/cmd/edgeguard-api/main.go @@ -60,7 +60,7 @@ import ( usersvc "git.netcell-it.de/projekte/edgeguard-native/internal/services/users" ) -var version = "1.1.149" +var version = "1.1.150" func main() { addr := os.Getenv("EDGEGUARD_API_ADDR") diff --git a/cmd/edgeguard-ctl/main.go b/cmd/edgeguard-ctl/main.go index 93ab115..2e549b1 100644 --- a/cmd/edgeguard-ctl/main.go +++ b/cmd/edgeguard-ctl/main.go @@ -11,7 +11,7 @@ import ( "git.netcell-it.de/projekte/edgeguard-native/internal/services/setup" ) -var version = "1.1.149" +var version = "1.1.150" const usage = `edgeguard-ctl — EdgeGuard CLI diff --git a/cmd/edgeguard-scheduler/main.go b/cmd/edgeguard-scheduler/main.go index f3202af..ea8f031 100644 --- a/cmd/edgeguard-scheduler/main.go +++ b/cmd/edgeguard-scheduler/main.go @@ -41,7 +41,7 @@ import ( "git.netcell-it.de/projekte/edgeguard-native/internal/services/tlscerts" ) -var version = "1.1.149" +var version = "1.1.150" const ( // renewTickInterval — how often we re-evaluate expiring certs. diff --git a/internal/handlers/setup.go b/internal/handlers/setup.go index ace0375..f569230 100644 --- a/internal/handlers/setup.go +++ b/internal/handlers/setup.go @@ -165,6 +165,7 @@ func (h *SetupHandler) JoinCluster(c *gin.Context) { Token: strings.TrimSpace(body.Token), CommonName: fqdn, Insecure: body.Insecure, + Force: true, // bootstrap self-signed cert must be replaced Version: h.Version, NodeID: h.NodeID, }); err != nil { diff --git a/internal/services/clusterjoin/join.go b/internal/services/clusterjoin/join.go index 228adc7..404edb9 100644 --- a/internal/services/clusterjoin/join.go +++ b/internal/services/clusterjoin/join.go @@ -38,6 +38,11 @@ type Request struct { // because security depends on the HMAC-signed token, not TLS trust. Insecure bool + // Force overwrites existing peer cert material. The CLI keeps this + // false (explicit rm required); the setup-wizard handler sets it + // true because the bootstrap self-signed cert must be replaced. + Force bool + // TLSDir is where ca.crt + peer.{crt,key} are written. // Zero value → clustertls.DefaultDir. TLSDir string @@ -73,7 +78,7 @@ func Join(req Request) error { } store := clustertls.New(tlsDir) - if store.HasPeer() { + if store.HasPeer() && !req.Force { return fmt.Errorf("peer cert already present under %s — remove it first if this is intentional", tlsDir) }