lfg2025/archy
1
0
Fork 0
Code Issues 27 Pull Requests 5 Actions Packages Projects Releases 6 Wiki Activity

fix(banner): console banner shows the reachable LAN address, not the WG tunnel IP

Browse Source 
The welcome banner picked its address with 'hostname -I | awk {print $1}',
so a node with WireGuard up advertised 10.44.0.1 — its own tunnel address,
present on EVERY node — as its web ui / ssh address. Off-tunnel that is
unreachable, and after a headless box moves to a new network it is exactly
the wrong thing to trust (framework-pt, 2026-08-15).

- Pick the default route's source address; fall back to the first address
  that is not WireGuard 10.44/16, CGNAT 100.64/10, or loopback.
- Also print http://<hostname>.local when avahi is up — the one address
  that survives any DHCP change, which is the real answer for headless
  boxes that move between networks.
- scripts/welcome-banner.sh is the new canonical copy, embedded in the
  binary (tor-helper pattern): bootstrap::run_welcome_banner_sync rewrites
  /etc/profile.d/archipelago.sh on ISO-installed nodes at startup, so the
  fix reaches the deployed fleet with the next OTA instead of only fresh
  ISOs. Machines without an installer-baked banner are left untouched.
- Same fix inlined in the live ISO builder's PROFILE heredoc
  (image-recipe/_archived/build-auto-installer-iso.sh).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This commit is contained in:
archipelago
2026-08-15 08:37:13 -04:00
co-authored by Claude Fable 5
parent 56d6396142
commit 1587853ce2
3 changed files with 143 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
image-recipe/_archived/build-auto-installer-iso.sh
+19 -2
View File
@@ -3244,10 +3244,22 @@ esac
if [ -t 0 ] && [ -z "$ARCHIPELAGO_WELCOMED" ]; then
export ARCHIPELAGO_WELCOMED=1
# Wait for network (DHCP may not be ready yet on first boot)
# Wait for network (DHCP may not be ready yet on first boot).
# The address shown must be one a LAN user can actually reach: the
# default route's source address. `hostname -I` lists addresses in
# interface order, so a node with WireGuard up advertised 10.44.0.1 —
# its own tunnel address, present on EVERY node — as its "web ui",
# which is unreachable off-tunnel and actively misleading after a
# move to a new network (framework-pt, 2026-08-15).
IP=""
for i in 1 2 3 4 5; do
IP=$(hostname -I 2>/dev/null | awk '{print $1}')
IP=$(ip -4 route get 1.1.1.1 2>/dev/null | sed -n 's/.*src \([0-9.]*\).*/\1/p' | head -n1)
# Offline LAN (no default route): first address that is not a
# tunnel (10.44/16 WireGuard), CGNAT (100.64/10 Tailscale), or
# loopback one.
[ -n "$IP" ] || IP=$(hostname -I 2>/dev/null | tr ' ' '\n' \
| grep -vE '^(10\.44\.|100\.(6[4-9]|[7-9][0-9]|1[01][0-9]|12[0-7])\.|127\.)' | head -n1)
[ -n "$IP" ] || IP=$(hostname -I 2>/dev/null | awk '{print $1}')
[ -n "$IP" ] && break
sleep 2
done
@@ -3269,6 +3281,11 @@ if [ -t 0 ] && [ -z "$ARCHIPELAGO_WELCOMED" ]; then
echo -e " ${OD}bitcoin node os${N}"
if [ -n "$IP" ]; then
echo -e " ${W}web ui http://$IP${N}"
# The mDNS name survives any DHCP change — it is the address to
# give people for a headless box that moves between networks.
if systemctl is-active avahi-daemon >/dev/null 2>&1; then
echo -e " ${W} http://$(hostname).local${N}"
fi
echo -e " ${W}ssh archipelago@$IP${N}"
echo -e " ${W}password archipelago (SSH)${N}"
echo -e " ${OD}web ui asks you to create a password on first visit${N}"