projekte/edgeguard-native
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(setup): Force-Flag für cluster-join — Bootstrap-Cert wird automatisch ersetzt

Browse Source 
Der API-Boot erstellt für Single-Node-Betrieb automatisch ein selbst-signiertes
peer-Cert. Beim Join über die GUI wurde das als Fehler gemeldet.

clusterjoin.Request.Force=true im Setup-Handler überspringt die HasPeer-Prüfung;
CLI (edgeguard-ctl cluster-join) bleibt vorsichtig (Force=false, manuelles rm nötig).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This commit is contained in:
Debian
2026-05-29 17:14:34 +02:00
parent afe2c951b9
commit 60e2aec5d9
6 changed files with 11 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
VERSION
View File

@@ -1 +1 @@
1.1.149 1.1.150

2
cmd/edgeguard-api/main.go
View File

@@ -60,7 +60,7 @@ import (
usersvc "git.netcell-it.de/projekte/edgeguard-native/internal/services/users" usersvc "git.netcell-it.de/projekte/edgeguard-native/internal/services/users"
) )
var version = "1.1.149" var version = "1.1.150"
func main() { func main() {
addr := os.Getenv("EDGEGUARD_API_ADDR") addr := os.Getenv("EDGEGUARD_API_ADDR")

2
cmd/edgeguard-ctl/main.go
View File

@@ -11,7 +11,7 @@ import (
"git.netcell-it.de/projekte/edgeguard-native/internal/services/setup" "git.netcell-it.de/projekte/edgeguard-native/internal/services/setup"
) )
var version = "1.1.149" var version = "1.1.150"
const usage = `edgeguard-ctl — EdgeGuard CLI const usage = `edgeguard-ctl — EdgeGuard CLI

2
cmd/edgeguard-scheduler/main.go
View File

@@ -41,7 +41,7 @@ import (
"git.netcell-it.de/projekte/edgeguard-native/internal/services/tlscerts" "git.netcell-it.de/projekte/edgeguard-native/internal/services/tlscerts"
) )
var version = "1.1.149" var version = "1.1.150"
const ( const (
// renewTickInterval — how often we re-evaluate expiring certs. // renewTickInterval — how often we re-evaluate expiring certs.

1
internal/handlers/setup.go
View File

@@ -165,6 +165,7 @@ func (h *SetupHandler) JoinCluster(c *gin.Context) {
Token: strings.TrimSpace(body.Token), Token: strings.TrimSpace(body.Token),
CommonName: fqdn, CommonName: fqdn,
Insecure: body.Insecure, Insecure: body.Insecure,
Force: true, // bootstrap self-signed cert must be replaced
Version: h.Version, Version: h.Version,
NodeID: h.NodeID, NodeID: h.NodeID,
}); err != nil { }); err != nil {

7
internal/services/clusterjoin/join.go
View File

@@ -38,6 +38,11 @@ type Request struct {
// because security depends on the HMAC-signed token, not TLS trust. // because security depends on the HMAC-signed token, not TLS trust.
Insecure bool Insecure bool
// Force overwrites existing peer cert material. The CLI keeps this
// false (explicit rm required); the setup-wizard handler sets it
// true because the bootstrap self-signed cert must be replaced.
Force bool
// TLSDir is where ca.crt + peer.{crt,key} are written. // TLSDir is where ca.crt + peer.{crt,key} are written.
// Zero value → clustertls.DefaultDir. // Zero value → clustertls.DefaultDir.
TLSDir string TLSDir string
@@ -73,7 +78,7 @@ func Join(req Request) error {
} }
store := clustertls.New(tlsDir) store := clustertls.New(tlsDir)
if store.HasPeer() { if store.HasPeer() && !req.Force {
return fmt.Errorf("peer cert already present under %s — remove it first if this is intentional", tlsDir) return fmt.Errorf("peer cert already present under %s — remove it first if this is intentional", tlsDir)
} }