Document daemon IPC privilege requirements and the Windows named pipe - #894
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
📝 WalkthroughWalkthroughThe documentation updates clarify elevated SSH configuration requirements, add Windows named-pipe daemon addresses, document caller identity and privileged-operation refusal behavior for gRPC and JSON sockets, and explain debug bundle upload privilege and transport requirements. ChangesDaemon access and privilege documentation
Estimated code review effort: 3 (Moderate) | ~20 minutes Possibly related PRs
Suggested reviewers: Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Warning There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure. 🔧 ESLint
src/pages/client/desktop-app.mdxOops! Something went wrong! :( ESLint: 9.39.2 TypeError: Converting circular structure to JSON src/pages/client/grpc-socket.mdxOops! Something went wrong! :( ESLint: 9.39.2 TypeError: Converting circular structure to JSON src/pages/get-started/cli.mdxOops! Something went wrong! :( ESLint: 9.39.2 TypeError: Converting circular structure to JSON
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@src/pages/client/desktop-app.mdx`:
- Around line 79-89: Update the SSH privilege wording in
src/pages/client/desktop-app.mdx lines 79-89 and src/pages/manage/peers/ssh.mdx
lines 70-78 to state that only disabling SSH authentication requires elevation;
enabling it remains allowed without elevated privileges. Preserve the existing
guidance for Enable SSH Server and Enable Root Login.
In `@src/pages/client/grpc-socket.mdx`:
- Around line 228-231: Complete the introductory sentence before the grpcurl
limitation by adding the missing subject and verb, clearly stating what the
custom loopback TCP listener is used or configured for. Keep the existing
Windows named-pipe and privileged-operations guidance unchanged.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: f755f278-af50-4731-b476-68a0b6c1e24c
📒 Files selected for processing (6)
src/pages/client/desktop-app.mdxsrc/pages/client/grpc-socket.mdxsrc/pages/client/json-socket.mdxsrc/pages/get-started/cli.mdxsrc/pages/manage/peers/access-infrastructure/setup-keys-add-servers-to-network.mdxsrc/pages/manage/peers/ssh.mdx
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@src/pages/help/troubleshooting-client.mdx`:
- Around line 312-314: Update the Note describing --upload-bundle-insecure to
explicitly warn that it can expose debug-bundle logs and system/network
information over HTTP or untrusted TLS. State that the flag should only be used
with a trusted endpoint, preferably only for troubleshooting.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: 83550045-2b1d-40aa-94dc-16eb19b946d3
📒 Files selected for processing (5)
src/pages/client/desktop-app.mdxsrc/pages/client/grpc-socket.mdxsrc/pages/get-started/cli.mdxsrc/pages/help/troubleshooting-client.mdxsrc/pages/manage/peers/ssh.mdx
🚧 Files skipped from review as they are similar to previous changes (4)
- src/pages/client/grpc-socket.mdx
- src/pages/get-started/cli.mdx
- src/pages/client/desktop-app.mdx
- src/pages/manage/peers/ssh.mdx
| <Note> | ||
| Uploading to a custom endpoint with `--upload-bundle-url` (for example a self-hosted upload server) requires root/administrator and an `https` URL. To upload to a server that uses `http` or an untrusted TLS certificate, add `--upload-bundle-insecure`. | ||
| </Note> |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟡 Minor | ⚡ Quick win
Warn about the security impact of --upload-bundle-insecure.
This permits uploading debug bundles over HTTP or with untrusted TLS, potentially exposing logs and system/network information. State that it should be used only with a trusted endpoint, and preferably only for troubleshooting.
Suggested wording
<Note>
- Uploading to a custom endpoint with `--upload-bundle-url` (for example a self-hosted upload server) requires root/administrator and an `https` URL. To upload to a server that uses `http` or an untrusted TLS certificate, add `--upload-bundle-insecure`.
+ Uploading to a custom endpoint with `--upload-bundle-url` (for example a self-hosted upload server) requires root/administrator and an `https` URL. To upload to a trusted server that uses `http` or an untrusted TLS certificate, add `--upload-bundle-insecure`; this reduces transport security and may expose bundle contents.
</Note>📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| <Note> | |
| Uploading to a custom endpoint with `--upload-bundle-url` (for example a self-hosted upload server) requires root/administrator and an `https` URL. To upload to a server that uses `http` or an untrusted TLS certificate, add `--upload-bundle-insecure`. | |
| </Note> | |
| <Note> | |
| Uploading to a custom endpoint with `--upload-bundle-url` (for example a self-hosted upload server) requires root/administrator and an `https` URL. To upload to a trusted server that uses `http` or an untrusted TLS certificate, add `--upload-bundle-insecure`; this reduces transport security and may expose bundle contents. | |
| </Note> |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@src/pages/help/troubleshooting-client.mdx` around lines 312 - 314, Update the
Note describing --upload-bundle-insecure to explicitly warn that it can expose
debug-bundle logs and system/network information over HTTP or untrusted TLS.
State that the flag should only be used with a trusted endpoint, preferably only
for troubleshooting.
2 participants
Documents the local daemon IPC authorization added in client v0.76.0, and corrects the Windows daemon address, which is now a named pipe rather than loopback TCP.
PRIVILEGE_REQUIREDerror detail an integration should render instead of the raw errortcp://127.0.0.1:41731withnpipe://netbird, explain the protected-namespace and fallback pipe paths, and note that existing installations are migrated automaticallysudoin the SSH server examples on the SSH, CLI and setup-key pages, since enabling the SSH server, root login or the auth bypass now requires privilegesScreenshots
Full-page captures of the changed pages are local PNGs from the dev server, in
/tmp/claude-1000/-home-vma-dev-netbird/ca53bbcd-1c59-460f-a74f-e719b663a766/scratchpad/shots/(
docs-grpc-socket,docs-json-socket,docs-peers-ssh), taken at 1920px.Need help on this PR? Tag
@codesmith-botwith what you need. Autofix is disabled.Summary by CodeRabbit
netbird down/netbird up --allow-server-ssh.npipe://netbird) support and refreshed default address guidance.PRIVILEGE_REQUIRED), plus grpcurl testing notes.