konairius/homelab
10
0
Fork 0
Code Issues 9 Pull Requests 2 Packages Projects Releases 1 Wiki Activity

netbird-server: enable IdpSignKeyRefreshEnabled (survive Authentik key rotation) #65

Merged
k.renner merged 1 commits from netbird-mgmt-jwks-refresh into master 2026-06-27 06:54:31 +00:00
Conversation 0 Commits 1 Files Changed 1
+1 -1
1 Commits
Author SHA1 Message Date
k.rennerandClaude Opus 4.8 6759b6dd79 netbird-server: enable IdpSignKeyRefreshEnabled (survive Authentik key rotation)
ci/woodpecker/push/deploy-netbird-server Pipeline was successful
Details 
The management cached Authentik's JWKS at startup and never refreshed it, so
when Authentik rotated its JWT signing key the management could no longer
verify tokens ('unable to find appropriate key' -> 'token invalid'), breaking
the dashboard. Set IdpSignKeyRefreshEnabled=true so management re-fetches the
JWKS on an unknown key id instead of caching forever.

NOTE: deploying this redeploys VPS-1 (the IdP host) and restarts the
management container.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-06-27 07:22:37 +02:00