forked from heavy-duty/rig
claude-hdb
2181e87a0f
`bootstrap` skips `tailscale up` when the box has already joined — which is what lets a re-run work without spending a pre-auth key. But skipping it also skipped `--hostname`, so the TAILNET name never converged: a box that joined under the wrong name (e.g. `--hostname` omitted, defaulting to the ROLE) stayed misnamed permanently, and re-running rig — the documented repair path — could not fix it. rig is convergent by contract; this was the one field that wasn't. The already-joined path now compares the current tailnet hostname against `--hostname` and reconciles it with `tailscale set --hostname` (no re-auth, no key). A failure warns rather than dying: a cosmetic name is not worth failing a bootstrap over. Safe by construction: Tailscale ACLs cannot bind a rule's dst to a hostname (it must be a tag, an IP, or a `hosts` alias — which is precisely why acl.hujson pins coolify-box to an IP), so a rename cannot silently void a grant. It also will not clobber a deliberate rename — a machine renamed in the admin console keeps that name and is no longer overridden by the device hostname. Found in the same session as the sshd first-wins bug (#6): an operator ran `bootstrap control-plane` on the prod box without `--hostname`, and no re-run could undo the resulting name. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> |
||
|---|---|---|
| .. | ||
| bootstrap.sh | ||
| coolify-install.sh | ||
| runner-install.sh | ||