Skip to content

Fall back to the request Host for the join-token panel_addr #13

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
iamfarhad merged 1 commit into from
Jul 18, 2026
Merged

Fall back to the request Host for the join-token panel_addr #13

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
20 changes: 15 additions & 5 deletions backend/internal/httpapi/nodes.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,6 +6,7 @@ import (
"encoding/hex"
"encoding/json"
"errors"
"net"
"net/http"
"strconv"
"time"
Expand Down Expand Up @@ -216,17 +217,26 @@ type joinTokenResponse struct {
}

// controlPlaneAddr assembles the host:port a node agent must dial: the panel
// domain (live setting, falling back to the boot-time PANEL_DOMAIN) plus the
// agent listener's NODE_AGENT_PORT. Nil when either half is unknown.
func (s *Server) controlPlaneAddr(ctx context.Context) *string {
// domain (live setting, falling back to the boot-time PANEL_DOMAIN, falling back
// to the Host the admin is browsing the panel on right now - an IP-only
// deployment has no configured domain, but the browser's Host reaches this
// server by definition) plus the agent listener's NODE_AGENT_PORT.
func (s *Server) controlPlaneAddr(ctx context.Context, r *http.Request) *string {
host := s.BootPanelDomain
if settings, err := s.Store.GetSettings(ctx); err == nil && settings.PanelDomain != nil && *settings.PanelDomain != "" {
host = *settings.PanelDomain
}
if host == "" {
if h, _, err := net.SplitHostPort(r.Host); err == nil {
host = h
} else {
host = r.Host
}
}
Comment on lines +229 to +235

@gemini-code-assist gemini-code-assist Bot Jul 18, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

medium

If the admin accesses the panel using an IPv6 address without a port (e.g., [::1]), net.SplitHostPort will fail and host will be set to [::1]. When net.JoinHostPort is subsequently called, it will detect the colon in [::1] and wrap it in brackets again, resulting in an invalid address like [[::1]]:port.

To prevent this double-wrapping, strip the brackets from host if they are present before calling net.JoinHostPort.

Suggested change
if host == "" {
if h, _, err := net.SplitHostPort(r.Host); err == nil {
host = h
} else {
host = r.Host
}
}
if host == "" {
if h, _, err := net.SplitHostPort(r.Host); err == nil {
host = h
} else {
host = r.Host
}
if len(host) > 2 && host[0] == '[' && host[len(host)-1] == ']' {
host = host[1 : len(host)-1]
}
}

if host == "" || s.NodeAgentPort == "" {
return nil
}
addr := host + ":" + s.NodeAgentPort
addr := net.JoinHostPort(host, s.NodeAgentPort)
return &addr
}

Expand Down Expand Up @@ -300,7 +310,7 @@ func (s *Server) handleGenerateJoinToken(w http.ResponseWriter, r *http.Request)
Token: rawToken,
ExpiresAt: expiresAt,
Unlimited: req.Unlimited,
PanelAddr: s.controlPlaneAddr(ctx),
PanelAddr: s.controlPlaneAddr(ctx, r),
})
}

Expand Down
5 changes: 3 additions & 2 deletions docs/openapi.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -485,8 +485,9 @@ paths:
nullable: true
description: >-
The exact host:port to give install-node.sh as the control-plane
address (panel domain + NODE_AGENT_PORT). Null when no panel
domain is configured. This is NOT the panel's web/HTTPS port.
address: the panel domain (falling back to the Host this request
was made on, for IP-only deployments) + NODE_AGENT_PORT. This is
NOT the panel's web/HTTPS port.
example: panel.example.com:48443
"401": { $ref: "#/components/responses/Unauthorized" }
"403": { $ref: "#/components/responses/Forbidden" }
Expand Down
Loading