heavy-duty/rig
7
0
Fork 1
Code Issues 10 Pull requests Projects Releases 3 Packages Wiki Activity Actions

fix(bootstrap): converge the tailnet hostname on an already-joined box #7

Merged
dan-claude-bot merged 1 commit from fix/tailnet-hostname-converges into main 2026-07-12 17:00:32 +00:00
Conversation 0 Commits 1 Files changed 2 +28
2 changed files with 28 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

8
README.md
View file

@ -42,6 +42,14 @@ enables periodic unattended upgrades); writes an sshd hardening drop-in
**verifies it took effect** via `sshd -T`; sets the system hostname; installs **verifies it took effect** via `sshd -T`; sets the system hostname; installs
tailscale and joins your tailnet. tailscale and joins your tailnet.
**`--hostname` converges both names.** On a box that has already joined,
`bootstrap` skips `tailscale up` (so a re-run needs no pre-auth key) — but it
still reconciles the **tailnet** hostname via `tailscale set --hostname`. Without
that, a box which joined under the wrong name — say `--hostname` was omitted, so
it defaulted to the *role* — stayed misnamed forever, and re-running rig, the
documented repair, could not fix it. A machine you deliberately renamed in the
admin console keeps that name; rig will not fight it.
> **Why the drop-in is `00-rig.conf` and not `99-`.** `sshd_config` is > **Why the drop-in is `00-rig.conf` and not `99-`.** `sshd_config` is
> **first-wins** — *"for each keyword, the first obtained value will be used"* > **first-wins** — *"for each keyword, the first obtained value will be used"*
> (`sshd_config(5)`) — and `Include` expands its glob in lexical order. Cloud > (`sshd_config(5)`) — and `Include` expands its glob in lexical order. Cloud

20
commands/bootstrap.sh
View file

@ -170,6 +170,26 @@ if ! command -v tailscale >/dev/null 2>&1; then
fi fi
if tailscale status >/dev/null 2>&1; then if tailscale status >/dev/null 2>&1; then
log "tailnet already joined; skipping tailscale up (no pre-auth key needed)" log "tailnet already joined; skipping tailscale up (no pre-auth key needed)"
# ...but skipping `tailscale up` also skipped --hostname, so the TAILNET name
# never converged: a box that joined under the wrong name (e.g. --hostname
# omitted, so it defaulted to the ROLE) stayed misnamed forever, and re-running
# rig — the documented repair — could not fix it. rig is convergent by
# contract; this was the one field that wasn't. `tailscale set` converges it
# without a re-auth or a pre-auth key.
#
# Safe by construction here: Tailscale ACLs cannot bind a rule's dst to a
# hostname (it must be a tag, an IP, or a `hosts` alias — which is exactly why
# acl.hujson pins coolify-box to an IP), so a rename cannot silently void a
# grant. It also will NOT clobber a deliberate rename: a machine renamed in the
# admin console keeps that name, and the device hostname no longer overrides it.
current_ts_name="$(tailscale status --peers=false 2>/dev/null | awk 'NR==1 {print $2}')"
if [ -n "$current_ts_name" ] && [ "$current_ts_name" != "$TS_HOSTNAME" ]; then
log "tailnet hostname is '${current_ts_name}', want '${TS_HOSTNAME}' — converging"
tailscale set --hostname="$TS_HOSTNAME" \
|| warn "tailscale set --hostname failed; rename '${current_ts_name}' -> '${TS_HOSTNAME}' in the admin console"
else
log "tailnet hostname already ${TS_HOSTNAME}"
fi
else else
# env override, else prompt; never touches disk # env override, else prompt; never touches disk
if [ -z "${TS_AUTHKEY:-}" ]; then if [ -z "${TS_AUTHKEY:-}" ]; then