fix(manage-server): auto-detect gateway hostname on install, warn loudly either way (#956) #27

Merged

amiryahaya merged 1 commit from fix/956-gateway-hostname-autodetect into main

2026-09-07 06:26:53 +02:00

amiryahaya commented

2026-09-07 05:07:29 +02:00

Owner

Sync of triton#990 (fixed on the source-of-truth repo first, per the
standing installer-scripts-sync rule in triton's CLAUDE.md). Not yet
merged upstream — will merge here once triton#990 lands.

Summary

install.sh's own help text claimed --gateway-hostname "defaults to
current FQDN" if omitted, but nothing actually implemented that: when
the flag wasn't passed, env.template's literal placeholder
manage.example.com was left untouched, with zero fallback and zero
warning. That value gets baked into every agent enrollment bundle and
into the gateway's own TLS certificate, so every downstream agent
enrollment silently failed with a certificate hostname mismatch.

Detect the host's real primary outbound IP at install time via the
kernel's routing table (ip route get / route -n get, run on the bare
host before any container starts, so it correctly sees the host's real
network rather than a container-internal one). Use it as the default
instead of the placeholder, but always print a loud warning telling the
operator to verify it before enrolling any agents.

Applied identically to install.sh and install-airgap.sh.

Test plan

bash -n both scripts — syntax OK
Byte-identical to triton's scripts/deploy/manage-server/{install,install-airgap}.sh

Sync of triton#990 (fixed on the source-of-truth repo first, per the standing installer-scripts-sync rule in triton's CLAUDE.md). Not yet merged upstream — will merge here once triton#990 lands. ## Summary install.sh's own help text claimed --gateway-hostname "defaults to current FQDN" if omitted, but nothing actually implemented that: when the flag wasn't passed, env.template's literal placeholder manage.example.com was left untouched, with zero fallback and zero warning. That value gets baked into every agent enrollment bundle and into the gateway's own TLS certificate, so every downstream agent enrollment silently failed with a certificate hostname mismatch. Detect the host's real primary outbound IP at install time via the kernel's routing table (ip route get / route -n get, run on the bare host before any container starts, so it correctly sees the host's real network rather than a container-internal one). Use it as the default instead of the placeholder, but always print a loud warning telling the operator to verify it before enrolling any agents. Applied identically to install.sh and install-airgap.sh. ## Test plan - [x] `bash -n` both scripts — syntax OK - [x] Byte-identical to triton's `scripts/deploy/manage-server/{install,install-airgap}.sh`

amiryahaya added 1 commit

2026-09-07 05:07:29 +02:00

fix(manage-server): auto-detect gateway hostname on install, warn loudly either way (#956 ) e59e161727

Sync of triton#990. install.sh's own help text claimed
--gateway-hostname "defaults to current FQDN" if omitted, but nothing
actually implemented that -- when the flag wasn't passed,
env.template's literal placeholder "manage.example.com" was left
untouched, with zero warning. That value gets baked into every agent
enrollment bundle and into the gateway's own TLS certificate, so
every downstream agent enrollment silently failed with a certificate
hostname mismatch.

Detect the host's real primary outbound IP at install time via the
kernel's routing table (run on the bare host, before any container
starts, so it correctly sees the host's real network rather than a
container-internal one). Use it as the default instead of the
placeholder, but always print a loud warning telling the operator to
verify it before enrolling any agents.

amiryahaya merged commit 9edcdd2f38 into main

2026-09-07 06:26:53 +02:00

amiryahaya referenced this pull request from a commit

2026-09-07 06:26:54 +02:00

fix(manage-server): auto-detect gateway hostname on install, warn loudly either way (#956) (#27)