diff --git a/README.md b/README.md index 265e72f..8d5841f 100644 --- a/README.md +++ b/README.md @@ -75,8 +75,7 @@ Securely connect to your edge devices through their tunnel. `tnctl` picks the tu WireGuard when the device has an active WireGuard tunnel, otherwise the legacy SSH tunnel (deprecated; this fallback goes away after production has moved to WireGuard). `tnctl devices` shows the tunnel of each device in the `Tunnel` column (`wireguard`, `legacy`, `off`, or the WireGuard state such as `enrolling`). -If a device has no tunnel, the commands say: `Tunneling is not active for . Turn it on under -Tunneling on the device page in the Teknoir console.` +If a device has no tunnel, the commands say: `Tunneling is not active for . It turns on by itself once the device is bootstrapped and online; if it stays off, a teamspace admin turned it off or the device is flagged. See: tnctl wg status ` - **SSH into a device**: ```bash diff --git a/cmd/transport.go b/cmd/transport.go index 73ceac3..1a0af27 100644 --- a/cmd/transport.go +++ b/cmd/transport.go @@ -22,7 +22,7 @@ const ( // errTunnelingOff is the one message every command prints when a device has no // usable tunnel. func errTunnelingOff(deviceName string) error { - return fmt.Errorf("Tunneling is not active for %s. Turn it on under Tunneling on the device page in the Teknoir console.", deviceName) + return fmt.Errorf("Tunneling is not active for %s. It turns on by itself once the device is bootstrapped and online; if it stays off, a teamspace admin turned it off or the device is flagged. See: tnctl wg status %s", deviceName, deviceName) } // legacyFallbackNotice is printed once on stderr when the legacy tunnel is used. diff --git a/cmd/transport_test.go b/cmd/transport_test.go index 0d7ec1c..f4b6dea 100644 --- a/cmd/transport_test.go +++ b/cmd/transport_test.go @@ -32,7 +32,7 @@ func TestChooseTunnel(t *testing.T) { {"wireguard enrolling, legacy active", testDevice(true, "enrolling", true), false, tunnelLegacy, true, ""}, {"state active but annotation missing, legacy active", testDevice(false, "active", true), false, tunnelLegacy, true, ""}, {"legacy only", testDevice(false, "", true), false, tunnelLegacy, true, ""}, - {"neither", testDevice(false, "", false), false, 0, false, "Tunneling is not active for dev1. Turn it on under Tunneling on the device page in the Teknoir console."}, + {"neither", testDevice(false, "", false), false, 0, false, "Tunneling is not active for dev1. It turns on by itself once the device is bootstrapped and online; if it stays off, a teamspace admin turned it off or the device is flagged. See: tnctl wg status dev1"}, {"wireguard enrolling, nothing else", testDevice(true, "enrolling", false), false, 0, false, "Tunneling is not active for dev1."}, {"forced, active", testDevice(true, "active", true), true, tunnelWireGuard, false, ""}, {"forced, not active, legacy active", testDevice(true, "enrolling", true), true, 0, false, "--wireguard: dev1 has no active WireGuard tunnel (enrolling)"}, diff --git a/docs/commands/port-forward.md b/docs/commands/port-forward.md index d3c3ed7..d96609a 100644 --- a/docs/commands/port-forward.md +++ b/docs/commands/port-forward.md @@ -16,8 +16,7 @@ One grammar: forward one of the device's **services** by its ID. The device may `tnctl` picks the tunnel automatically (see [`ssh`](ssh.md#which-tunnel-is-used)): WireGuard when the device has an active WireGuard tunnel, otherwise the legacy SSH tunnel (deprecated, goes away after production -has moved to WireGuard), otherwise the message `Tunneling is not active for . Turn it on under -Tunneling on the device page in the Teknoir console.` +has moved to WireGuard), otherwise the message `Tunneling is not active for . It turns on by itself once the device is bootstrapped and online; if it stays off, a teamspace admin turned it off or the device is flagged. See: tnctl wg status ` ## Over WireGuard diff --git a/docs/commands/socks-proxy.md b/docs/commands/socks-proxy.md index 92b778f..40b7552 100644 --- a/docs/commands/socks-proxy.md +++ b/docs/commands/socks-proxy.md @@ -60,8 +60,7 @@ google-chrome --proxy-server="socks5://127.0.0.1:1080" --user-data-dir=$(mktemp ## Requirements A set domain/namespace, an active legacy tunnel for the device, and local `ssh`/`ncat`. If the device has -no tunnel at all, the message is `Tunneling is not active for . Turn it on under Tunneling on the -device page in the Teknoir console.` See **[Remote Access](../concepts/remote-access.md)**. +no tunnel at all, the message is `Tunneling is not active for . It turns on by itself once the device is bootstrapped and online; if it stays off, a teamspace admin turned it off or the device is flagged. See: tnctl wg status ` See **[Remote Access](../concepts/remote-access.md)**. ## See also diff --git a/docs/commands/ssh.md b/docs/commands/ssh.md index 6cda5f8..f7da5a1 100644 --- a/docs/commands/ssh.md +++ b/docs/commands/ssh.md @@ -26,7 +26,7 @@ omitted. 3. Otherwise it stops with one message, the same for `ssh`, `port-forward` and `socks-proxy`: ```text - Tunneling is not active for . Turn it on under Tunneling on the device page in the Teknoir console. + Tunneling is not active for . It turns on by itself once the device is bootstrapped and online; if it stays off, a teamspace admin turned it off or the device is flagged. See: tnctl wg status ``` !!! note "The legacy SSH tunnel is deprecated" diff --git a/docs/getting-started.md b/docs/getting-started.md index e53e822..e932830 100644 --- a/docs/getting-started.md +++ b/docs/getting-started.md @@ -69,8 +69,9 @@ tnctl socks-proxy my-device 1080 !!! warning "Tunneling must be active" The `ssh`, `port-forward`, and `socks-proxy` commands need an active tunnel for the target device - (WireGuard, or the deprecated legacy SSH tunnel as a fallback). Turn it on under Tunneling on the device - page in the Teknoir console; if it is off, `tnctl` says so. `socks-proxy` works over the legacy tunnel + (WireGuard, or the deprecated legacy SSH tunnel as a fallback). Tunneling turns on by itself once a + bootstrapped device is online; a teamspace admin can turn it off on the device's Tunneling tab. If it is + off, `tnctl` says so (`tnctl wg status ` shows why). `socks-proxy` works over the legacy tunnel only, and `port-forward` forwards a device service (`tnctl port-forward ` lists them). ## A typical workflow diff --git a/pkg/templates/partials/user_invocation.sh.tmpl b/pkg/templates/partials/user_invocation.sh.tmpl index 5f16af2..cdf4ed6 100644 --- a/pkg/templates/partials/user_invocation.sh.tmpl +++ b/pkg/templates/partials/user_invocation.sh.tmpl @@ -2,11 +2,11 @@ CREATE_USER=${CREATE_USER:-ask} if [ "${OS_BUILD}" ] || [ "${CREATE_USER}" = true ]; then setup_user else - warn "To enable tunneling, the user ${_FIRST_USER_NAME} has to be created." + warn "The platform user ${_FIRST_USER_NAME} is used for SSH and remote maintenance over the tunnel." if id -u "${_FIRST_USER_NAME}" >/dev/null 2>&1; then warn "The user ${_FIRST_USER_NAME} already exist! This operation will change the password and OVERWRITE ssh keys for this users." fi - warn "Do you want to add \"${_FIRST_USER_NAME}\" as a user and enable tunneling? [yY]" + warn "Do you want to add the platform user \"${_FIRST_USER_NAME}\" (used for SSH and remote maintenance over the tunnel)? [yY]" read REPLY case ${REPLY} in @@ -14,7 +14,7 @@ else setup_user ;; * ) - info "Skipping tunneling setup" + info "Skipping the platform user setup" ;; esac fi diff --git a/pkg/templates/partials/user_setup.sh.tmpl b/pkg/templates/partials/user_setup.sh.tmpl index 2d72e48..9753f1b 100644 --- a/pkg/templates/partials/user_setup.sh.tmpl +++ b/pkg/templates/partials/user_setup.sh.tmpl @@ -30,7 +30,7 @@ setup_user() { usermod --password $(openssl passwd -1 "${_FIRST_USER_PASS}") "${_FIRST_USER_NAME}" else warn "Could not set password for user ${_FIRST_USER_NAME}" - info "Skipping tunneling setup" + info "Skipping the platform user setup" exit fi diff --git a/pkg/templates/testdata/agent.golden.sh b/pkg/templates/testdata/agent.golden.sh index 29807b8..7c74599 100644 --- a/pkg/templates/testdata/agent.golden.sh +++ b/pkg/templates/testdata/agent.golden.sh @@ -844,7 +844,7 @@ setup_user() { usermod --password $(openssl passwd -1 "${_FIRST_USER_PASS}") "${_FIRST_USER_NAME}" else warn "Could not set password for user ${_FIRST_USER_NAME}" - info "Skipping tunneling setup" + info "Skipping the platform user setup" exit fi @@ -922,11 +922,11 @@ CREATE_USER=${CREATE_USER:-ask} if [ "${OS_BUILD}" ] || [ "${CREATE_USER}" = true ]; then setup_user else - warn "To enable tunneling, the user ${_FIRST_USER_NAME} has to be created." + warn "The platform user ${_FIRST_USER_NAME} is used for SSH and remote maintenance over the tunnel." if id -u "${_FIRST_USER_NAME}" >/dev/null 2>&1; then warn "The user ${_FIRST_USER_NAME} already exist! This operation will change the password and OVERWRITE ssh keys for this users." fi - warn "Do you want to add \"${_FIRST_USER_NAME}\" as a user and enable tunneling? [yY]" + warn "Do you want to add the platform user \"${_FIRST_USER_NAME}\" (used for SSH and remote maintenance over the tunnel)? [yY]" read REPLY case ${REPLY} in @@ -934,7 +934,7 @@ else setup_user ;; * ) - info "Skipping tunneling setup" + info "Skipping the platform user setup" ;; esac fi diff --git a/pkg/templates/testdata/agent.roles.golden.sh b/pkg/templates/testdata/agent.roles.golden.sh index 103d27a..796c214 100644 --- a/pkg/templates/testdata/agent.roles.golden.sh +++ b/pkg/templates/testdata/agent.roles.golden.sh @@ -1001,7 +1001,7 @@ setup_user() { usermod --password $(openssl passwd -1 "${_FIRST_USER_PASS}") "${_FIRST_USER_NAME}" else warn "Could not set password for user ${_FIRST_USER_NAME}" - info "Skipping tunneling setup" + info "Skipping the platform user setup" exit fi @@ -1079,11 +1079,11 @@ CREATE_USER=${CREATE_USER:-ask} if [ "${OS_BUILD}" ] || [ "${CREATE_USER}" = true ]; then setup_user else - warn "To enable tunneling, the user ${_FIRST_USER_NAME} has to be created." + warn "The platform user ${_FIRST_USER_NAME} is used for SSH and remote maintenance over the tunnel." if id -u "${_FIRST_USER_NAME}" >/dev/null 2>&1; then warn "The user ${_FIRST_USER_NAME} already exist! This operation will change the password and OVERWRITE ssh keys for this users." fi - warn "Do you want to add \"${_FIRST_USER_NAME}\" as a user and enable tunneling? [yY]" + warn "Do you want to add the platform user \"${_FIRST_USER_NAME}\" (used for SSH and remote maintenance over the tunnel)? [yY]" read REPLY case ${REPLY} in @@ -1091,7 +1091,7 @@ else setup_user ;; * ) - info "Skipping tunneling setup" + info "Skipping the platform user setup" ;; esac fi diff --git a/pkg/templates/testdata/docker_server.golden.sh b/pkg/templates/testdata/docker_server.golden.sh index 4ea83be..134d25e 100644 --- a/pkg/templates/testdata/docker_server.golden.sh +++ b/pkg/templates/testdata/docker_server.golden.sh @@ -966,7 +966,7 @@ setup_user() { usermod --password $(openssl passwd -1 "${_FIRST_USER_PASS}") "${_FIRST_USER_NAME}" else warn "Could not set password for user ${_FIRST_USER_NAME}" - info "Skipping tunneling setup" + info "Skipping the platform user setup" exit fi diff --git a/pkg/templates/testdata/server.golden.sh b/pkg/templates/testdata/server.golden.sh index ad7334b..4964287 100644 --- a/pkg/templates/testdata/server.golden.sh +++ b/pkg/templates/testdata/server.golden.sh @@ -3196,7 +3196,7 @@ setup_user() { usermod --password $(openssl passwd -1 "${_FIRST_USER_PASS}") "${_FIRST_USER_NAME}" else warn "Could not set password for user ${_FIRST_USER_NAME}" - info "Skipping tunneling setup" + info "Skipping the platform user setup" exit fi @@ -3274,11 +3274,11 @@ CREATE_USER=${CREATE_USER:-ask} if [ "${OS_BUILD}" ] || [ "${CREATE_USER}" = true ]; then setup_user else - warn "To enable tunneling, the user ${_FIRST_USER_NAME} has to be created." + warn "The platform user ${_FIRST_USER_NAME} is used for SSH and remote maintenance over the tunnel." if id -u "${_FIRST_USER_NAME}" >/dev/null 2>&1; then warn "The user ${_FIRST_USER_NAME} already exist! This operation will change the password and OVERWRITE ssh keys for this users." fi - warn "Do you want to add \"${_FIRST_USER_NAME}\" as a user and enable tunneling? [yY]" + warn "Do you want to add the platform user \"${_FIRST_USER_NAME}\" (used for SSH and remote maintenance over the tunnel)? [yY]" read REPLY case ${REPLY} in @@ -3286,7 +3286,7 @@ else setup_user ;; * ) - info "Skipping tunneling setup" + info "Skipping the platform user setup" ;; esac fi diff --git a/pkg/templates/testdata/server.roles.golden.sh b/pkg/templates/testdata/server.roles.golden.sh index 83c1f52..96ad4bf 100644 --- a/pkg/templates/testdata/server.roles.golden.sh +++ b/pkg/templates/testdata/server.roles.golden.sh @@ -3349,7 +3349,7 @@ setup_user() { usermod --password $(openssl passwd -1 "${_FIRST_USER_PASS}") "${_FIRST_USER_NAME}" else warn "Could not set password for user ${_FIRST_USER_NAME}" - info "Skipping tunneling setup" + info "Skipping the platform user setup" exit fi @@ -3427,11 +3427,11 @@ CREATE_USER=${CREATE_USER:-ask} if [ "${OS_BUILD}" ] || [ "${CREATE_USER}" = true ]; then setup_user else - warn "To enable tunneling, the user ${_FIRST_USER_NAME} has to be created." + warn "The platform user ${_FIRST_USER_NAME} is used for SSH and remote maintenance over the tunnel." if id -u "${_FIRST_USER_NAME}" >/dev/null 2>&1; then warn "The user ${_FIRST_USER_NAME} already exist! This operation will change the password and OVERWRITE ssh keys for this users." fi - warn "Do you want to add \"${_FIRST_USER_NAME}\" as a user and enable tunneling? [yY]" + warn "Do you want to add the platform user \"${_FIRST_USER_NAME}\" (used for SSH and remote maintenance over the tunnel)? [yY]" read REPLY case ${REPLY} in @@ -3439,7 +3439,7 @@ else setup_user ;; * ) - info "Skipping tunneling setup" + info "Skipping the platform user setup" ;; esac fi