netbird-server: enable IdpSignKeyRefreshEnabled (survive Authentik key rotation) #65

2026-06-27T05:22:38Z

k.renner commented

2026-06-27 05:22:38 +00:00

Management cached Authentiks JWKS at startup and never refreshed it; when Authentik rotated its signing key, all tokens became "unverifiable / token invalid", breaking the dashboard. Set IdpSignKeyRefreshEnabled=true so management re-fetches JWKS on an unknown key id. Merging redeploys VPS-1 (IdP host) + restarts management. This was a pre-existing latent issue, surfaced by Authentik key rotation — not the proxy work.

k.renner added 1 commit 2026-06-27 05:22:38 +00:00

netbird-server: enable IdpSignKeyRefreshEnabled (survive Authentik key rotation)

ci/woodpecker/push/deploy-netbird-server Pipeline was successful

Details

6759b6dd79

The management cached Authentik's JWKS at startup and never refreshed it, so
when Authentik rotated its JWT signing key the management could no longer
verify tokens ('unable to find appropriate key' -> 'token invalid'), breaking
the dashboard. Set IdpSignKeyRefreshEnabled=true so management re-fetches the
JWKS on an unknown key id instead of caching forever.

NOTE: deploying this redeploys VPS-1 (the IdP host) and restarts the
management container.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

k.renner merged commit cd6c52884b into master

2026-06-27 06:54:31 +00:00

k.renner referenced this issue from a commit

2026-06-27 06:54:32 +00:00

Merge pull request 'netbird-server: enable IdpSignKeyRefreshEnabled (survive Authentik key rotation)' (#65) from netbird-mgmt-jwks-refresh into master

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: konairius/homelab#65