fix monitor start race and document insecure TLS risk
- commit
- c80859292dd48d3843f1f1f171779bd141528d69
- author
- brice · · 2026-02-08 17:21 UTC
- parent
- 332577e
- signature
- GPG Verified
CD88F9E564E0102646FB6077A1A07C7C7C3E349D· arch-gpg Verified for the committer email - refs
- tag: v2.15.1
2 files · +10 -1
M internal/usecase/container/service.go +1 -1
| @@ -918,8 +918,8 @@ func (s *Service) StartMonitor(ctx context.Context) { | |||
| 918 | 918 | } | |
| 919 | 919 | s.monitor = newMonitor(s) | |
| 920 | 920 | m := s.monitor | |
| 921 | - | s.mu.Unlock() | |
| 922 | 921 | m.Start(ctx) | |
| 922 | + | s.mu.Unlock() | |
| 923 | 923 | } | |
| 924 | 924 | ||
| 925 | 925 | // StopMonitor stops the background container monitor. | |
| @@ -918,8 +918,8 @@ func (s *Service) StartMonitor(ctx context.Context) { | |||||
| 918 | } | 918 | } | ||
| 919 | s.monitor = newMonitor(s) | 919 | s.monitor = newMonitor(s) | ||
| 920 | m := s.monitor | 920 | m := s.monitor | ||
| 921 | - | s.mu.Unlock() | |||
| 922 | m.Start(ctx) | 921 | m.Start(ctx) | ||
| 922 | + | s.mu.Unlock() | |||
| 923 | } | 923 | } | ||
| 924 | 924 | ||||
| 925 | // StopMonitor stops the background container monitor. | 925 | // StopMonitor stops the background container monitor. | ||
M wiki/guides/remote-cli.md +9 -0
| @@ -30,6 +30,15 @@ The CLI connects to `https://gordon.example.com/admin/*` endpoints. | |||
| 30 | 30 | ||
| 31 | 31 | Private tailnet setup (recommended for hardened VPS): keep using the HTTPS domain, point that DNS record to the VPS tailnet IP, and set insecure TLS for self-signed certs. | |
| 32 | 32 | ||
| 33 | + | > [!CAUTION] | |
| 34 | + | > `--insecure` and `insecure_tls = true` disable TLS certificate verification. | |
| 35 | + | > This removes server identity validation and increases man-in-the-middle risk. | |
| 36 | + | > Use this only for private tailnet/VPN deployments with strict network access controls (restricted CIDRs, firewall allowlists, and no public ingress to admin endpoints). | |
| 37 | + | > Safer alternatives: | |
| 38 | + | > - Use a publicly trusted certificate (for example, Let's Encrypt). | |
| 39 | + | > - Use an internal CA and trust that CA on operator machines. | |
| 40 | + | > - Use Tailscale certificate generation (`tailscale cert`) and serve Gordon with that cert. | |
| 41 | + | ||
| 33 | 42 | ```bash | |
| 34 | 43 | # Save remote once | |
| 35 | 44 | gordon remotes add tailnet-reg https://gordon.example.com --token-env GORDON_TOKEN --insecure | |
| @@ -30,6 +30,15 @@ The CLI connects to `https://gordon.example.com/admin/*` endpoints. | |||||
| 30 | 30 | ||||
| 31 | Private tailnet setup (recommended for hardened VPS): keep using the HTTPS domain, point that DNS record to the VPS tailnet IP, and set insecure TLS for self-signed certs. | 31 | Private tailnet setup (recommended for hardened VPS): keep using the HTTPS domain, point that DNS record to the VPS tailnet IP, and set insecure TLS for self-signed certs. | ||
| 32 | 32 | ||||
| 33 | + | > [!CAUTION] | |||
| 34 | + | > `--insecure` and `insecure_tls = true` disable TLS certificate verification. | |||
| 35 | + | > This removes server identity validation and increases man-in-the-middle risk. | |||
| 36 | + | > Use this only for private tailnet/VPN deployments with strict network access controls (restricted CIDRs, firewall allowlists, and no public ingress to admin endpoints). | |||
| 37 | + | > Safer alternatives: | |||
| 38 | + | > - Use a publicly trusted certificate (for example, Let's Encrypt). | |||
| 39 | + | > - Use an internal CA and trust that CA on operator machines. | |||
| 40 | + | > - Use Tailscale certificate generation (`tailscale cert`) and serve Gordon with that cert. | |||
| 41 | + | ||||
| 33 | ```bash | 42 | ```bash | ||
| 34 | # Save remote once | 43 | # Save remote once | ||
| 35 | gordon remotes add tailnet-reg https://gordon.example.com --token-env GORDON_TOKEN --insecure | 44 | gordon remotes add tailnet-reg https://gordon.example.com --token-env GORDON_TOKEN --insecure | ||