Add support for preshared key configuration and redact logging output - #427
Open
p-atr wants to merge 2 commits into
Open
Add support for preshared key configuration and redact logging output#427p-atr wants to merge 2 commits into
p-atr wants to merge 2 commits into
Conversation
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (3)
🚧 Files skipped from review as they are similar to previous changes (3)
📝 WalkthroughWalkthroughThe add-on adds a validated ChangesNetBird preshared key support
Estimated code review effort: 3 (Moderate) | ~20 minutes Sequence Diagram(s)sequenceDiagram
participant AddonConfiguration
participant NetBirdRunScript
participant CommandLog
participant NetBird
AddonConfiguration->>NetBirdRunScript: provide preshared_key
NetBirdRunScript->>CommandLog: create redacted command options
CommandLog-->>NetBirdRunScript: mask sensitive values
NetBirdRunScript->>NetBird: execute with original options
Possibly related issues
Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Contributor
There was a problem hiding this comment.
Pull request overview
This PR extends the Home Assistant NetBird add-on to support an optional WireGuard pre-shared key (PSK) and updates startup logging to avoid leaking sensitive key material when printing the netbird up command.
Changes:
- Added
preshared_keyas an optional add-on configuration value (schema + UI translation). - Passed
--preshared-keytonetbird upwhen configured. - Introduced redacted logging for secret-bearing CLI arguments (
--setup-key,--preshared-key).
Reviewed changes
Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.
| File | Description |
|---|---|
netbird/config.yaml |
Adds preshared_key to add-on options and schema. |
netbird/rootfs/etc/s6-overlay/s6-rc.d/netbird/run |
Reads preshared_key, appends --preshared-key, and logs a redacted netbird up command line. |
netbird/translations/en.yaml |
Adds UI text for the new preshared_key option. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
| admin_url: str? | ||
| management_url: str? | ||
| setup_key: str? | ||
| preshared_key: str? |
Comment on lines
+30
to
+31
| Sets WireGuard PreSharedKey property. | ||
| If set, then only peers that have the same key can communicate. |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@netbird/config.yaml`:
- Line 38: Update the preshared_key schema field in the configuration to use the
optional password type instead of the optional string type, so the input remains
optional while being masked in the add-on UI.
In `@netbird/rootfs/etc/s6-overlay/s6-rc.d/netbird/run`:
- Around line 129-151: Update the netbird startup argument construction before
the redaction loop so the preshared key is removed from the netbird command-line
arguments and supplied through the supported NB_PRESHARED_KEY environment
variable or equivalent secure channel. Preserve the existing setup-key argument
handling and ensure the resulting command still receives the preshared key
without exposing it in /proc command-line data.
- Around line 71-77: Update the preshared_key handling in the run script so an
empty Home Assistant option still appends the --preshared-key argument with an
empty value, clearing the persisted PSK. Preserve the existing informational
logs and configured-key behavior.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: df5a6658-d48b-4591-ad12-3a4d09891d5e
📒 Files selected for processing (3)
netbird/config.yamlnetbird/rootfs/etc/s6-overlay/s6-rc.d/netbird/runnetbird/translations/en.yaml
… logging output and handling
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Proposed Changes
Added optional NetBird preshared key support in the Home Assistant addon configuration.
The key is passed to netbird up, and sensitive values are redacted from startup logs.
Summary by CodeRabbit
New Features
Security