Authenticate pangolin-client via a persisted login session #45

Merged

parkerhdavis merged 1 commit from pangolin-client-login-config into main 2026-10-12 20:28:44 -06:00

Conversation 0 Commits 1 Files changed 5 +106 -69

parkerhdavis commented 2026-10-12 20:28:41 -06:00 (Migrated from github.com)

Copy link

Follow-up to #44. The machine-client path verifies the websocket but the server rejects WireGuard registration without a user token (olm/wg/register → USER_ID_NOT_FOUND), so the client role now authenticates with an interactive pangolin login session persisted in pangolin-client-config/ (gitignored; one-time docker run -it ... login per host, exactly as documented for user devices).

The client container also maintains its own /etc/hosts block for the .internal names through a bind mount with self-cleaning markers — the DNS-host rewrite the CLI performs on a host run cannot survive inside a container, and this keeps every deploy fully in-stack with no host resolver changes.

Also aligns all pangolin-* services on the three documented Docker prerequisites ( network_mode: host, NET_ADMIN, /dev/net/tun ), unifies the site service key as pangolin-site, and drops the unused *_CLIENT_* env entries.

Verified live on phd-razer: client connects, .internal names resolve host-wide, and SSH to phd-beelink and phd-tower passes passwordless through the stack.

Follow-up to #44. The machine-client path verifies the websocket but the server rejects WireGuard registration without a user token (`olm/wg/register` → `USER_ID_NOT_FOUND`), so the client role now authenticates with an interactive `pangolin login` session persisted in `pangolin-client-config/` (gitignored; one-time `docker run -it ... login` per host, exactly as documented for user devices). The client container also maintains its own `/etc/hosts` block for the `.internal` names through a bind mount with self-cleaning markers — the DNS-host rewrite the CLI performs on a host run cannot survive inside a container, and this keeps every deploy fully in-stack with no host resolver changes. Also aligns all `pangolin-*` services on the three documented Docker prerequisites ( `network_mode: host`, `NET_ADMIN`, `/dev/net/tun` ), unifies the site service key as `pangolin-site`, and drops the unused `*_CLIENT_*` env entries. Verified live on phd-razer: client connects, `.internal` names resolve host-wide, and SSH to phd-beelink and phd-tower passes passwordless through the stack.

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels

No items

No labels

Milestone

Clear milestone

No items

No milestone

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

parker/cumulus!45

No description provided.