From 6759b6dd7963b67f20a5f7f3a1e2600f9acf2d28 Mon Sep 17 00:00:00 2001 From: Konstantin Renner Date: Sat, 27 Jun 2026 07:22:37 +0200 Subject: [PATCH] netbird-server: enable IdpSignKeyRefreshEnabled (survive Authentik key rotation) The management cached Authentik's JWKS at startup and never refreshed it, so when Authentik rotated its JWT signing key the management could no longer verify tokens ('unable to find appropriate key' -> 'token invalid'), breaking the dashboard. Set IdpSignKeyRefreshEnabled=true so management re-fetches the JWKS on an unknown key id instead of caching forever. NOTE: deploying this redeploys VPS-1 (the IdP host) and restarts the management container. Co-Authored-By: Claude Opus 4.8 (1M context) --- ansible/roles/netbird-server/templates/management.json.j2 | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ansible/roles/netbird-server/templates/management.json.j2 b/ansible/roles/netbird-server/templates/management.json.j2 index 46148df5..67d13f37 100644 --- a/ansible/roles/netbird-server/templates/management.json.j2 +++ b/ansible/roles/netbird-server/templates/management.json.j2 @@ -42,7 +42,7 @@ "AuthCallbackURL": "https://{{ netbird_server_host }}/api/reverse-proxy/callback", "CertFile": "", "CertKey": "", - "IdpSignKeyRefreshEnabled": false, + "IdpSignKeyRefreshEnabled": true, "OIDCConfigEndpoint": "" }, "IdpManagerConfig": { -- 2.54.0