Skip to content

Reword bootstrap prompt: platform user, not 'enable tunneling' #23

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
tekn0ir merged 3 commits into from
Oct 16, 2026
Merged

Reword bootstrap prompt: platform user, not 'enable tunneling' #23

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
3b64ea7
Reword bootstrap prompt: platform user, not 'enable tunneling'
tekn0ir Oct 16, 2026
04c9b32
Tunneling-off message: it turns on by itself (default-on); point to t…
tekn0ir Oct 16, 2026
97f6eba
docs: the same Tunneling-off wording in README and port-forward
tekn0ir Oct 16, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 1 addition & 2 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -75,8 +75,7 @@ Securely connect to your edge devices through their tunnel. `tnctl` picks the tu
WireGuard when the device has an active WireGuard tunnel, otherwise the legacy SSH tunnel (deprecated; this
fallback goes away after production has moved to WireGuard). `tnctl devices` shows the tunnel of each
device in the `Tunnel` column (`wireguard`, `legacy`, `off`, or the WireGuard state such as `enrolling`).
If a device has no tunnel, the commands say: `Tunneling is not active for <device>. Turn it on under
Tunneling on the device page in the Teknoir console.`
If a device has no tunnel, the commands say: `Tunneling is not active for <device>. It turns on by itself once the device is bootstrapped and online; if it stays off, a teamspace admin turned it off or the device is flagged. See: tnctl wg status <device>`

- **SSH into a device**:
```bash
Expand Down
2 changes: 1 addition & 1 deletion cmd/transport.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,7 +22,7 @@ const (
// errTunnelingOff is the one message every command prints when a device has no
// usable tunnel.
func errTunnelingOff(deviceName string) error {
return fmt.Errorf("Tunneling is not active for %s. Turn it on under Tunneling on the device page in the Teknoir console.", deviceName)
return fmt.Errorf("Tunneling is not active for %s. It turns on by itself once the device is bootstrapped and online; if it stays off, a teamspace admin turned it off or the device is flagged. See: tnctl wg status %s", deviceName, deviceName)
}

// legacyFallbackNotice is printed once on stderr when the legacy tunnel is used.
Expand Down
2 changes: 1 addition & 1 deletion cmd/transport_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -32,7 +32,7 @@ func TestChooseTunnel(t *testing.T) {
{"wireguard enrolling, legacy active", testDevice(true, "enrolling", true), false, tunnelLegacy, true, ""},
{"state active but annotation missing, legacy active", testDevice(false, "active", true), false, tunnelLegacy, true, ""},
{"legacy only", testDevice(false, "", true), false, tunnelLegacy, true, ""},
{"neither", testDevice(false, "", false), false, 0, false, "Tunneling is not active for dev1. Turn it on under Tunneling on the device page in the Teknoir console."},
{"neither", testDevice(false, "", false), false, 0, false, "Tunneling is not active for dev1. It turns on by itself once the device is bootstrapped and online; if it stays off, a teamspace admin turned it off or the device is flagged. See: tnctl wg status dev1"},
{"wireguard enrolling, nothing else", testDevice(true, "enrolling", false), false, 0, false, "Tunneling is not active for dev1."},
{"forced, active", testDevice(true, "active", true), true, tunnelWireGuard, false, ""},
{"forced, not active, legacy active", testDevice(true, "enrolling", true), true, 0, false, "--wireguard: dev1 has no active WireGuard tunnel (enrolling)"},
Expand Down
3 changes: 1 addition & 2 deletions docs/commands/port-forward.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,8 +16,7 @@ One grammar: forward one of the device's **services** by its ID. The device may

`tnctl` picks the tunnel automatically (see [`ssh`](ssh.md#which-tunnel-is-used)): WireGuard when the
device has an active WireGuard tunnel, otherwise the legacy SSH tunnel (deprecated, goes away after production
has moved to WireGuard), otherwise the message `Tunneling is not active for <device>. Turn it on under
Tunneling on the device page in the Teknoir console.`
has moved to WireGuard), otherwise the message `Tunneling is not active for <device>. It turns on by itself once the device is bootstrapped and online; if it stays off, a teamspace admin turned it off or the device is flagged. See: tnctl wg status <device>`

## Over WireGuard

Expand Down
3 changes: 1 addition & 2 deletions docs/commands/socks-proxy.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -60,8 +60,7 @@ google-chrome --proxy-server="socks5://127.0.0.1:1080" --user-data-dir=$(mktemp
## Requirements

A set domain/namespace, an active legacy tunnel for the device, and local `ssh`/`ncat`. If the device has
no tunnel at all, the message is `Tunneling is not active for <device>. Turn it on under Tunneling on the
device page in the Teknoir console.` See **[Remote Access](../concepts/remote-access.md)**.
no tunnel at all, the message is `Tunneling is not active for <device>. It turns on by itself once the device is bootstrapped and online; if it stays off, a teamspace admin turned it off or the device is flagged. See: tnctl wg status <device>` See **[Remote Access](../concepts/remote-access.md)**.

## See also

Expand Down
2 changes: 1 addition & 1 deletion docs/commands/ssh.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -26,7 +26,7 @@ omitted.
3. Otherwise it stops with one message, the same for `ssh`, `port-forward` and `socks-proxy`:

```text
Tunneling is not active for <device>. Turn it on under Tunneling on the device page in the Teknoir console.
Tunneling is not active for <device>. It turns on by itself once the device is bootstrapped and online; if it stays off, a teamspace admin turned it off or the device is flagged. See: tnctl wg status <device>
```

!!! note "The legacy SSH tunnel is deprecated"
Expand Down
5 changes: 3 additions & 2 deletions docs/getting-started.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -69,8 +69,9 @@ tnctl socks-proxy my-device 1080

!!! warning "Tunneling must be active"
The `ssh`, `port-forward`, and `socks-proxy` commands need an active tunnel for the target device
(WireGuard, or the deprecated legacy SSH tunnel as a fallback). Turn it on under Tunneling on the device
page in the Teknoir console; if it is off, `tnctl` says so. `socks-proxy` works over the legacy tunnel
(WireGuard, or the deprecated legacy SSH tunnel as a fallback). Tunneling turns on by itself once a
bootstrapped device is online; a teamspace admin can turn it off on the device's Tunneling tab. If it is
off, `tnctl` says so (`tnctl wg status <device>` shows why). `socks-proxy` works over the legacy tunnel
only, and `port-forward` forwards a device service (`tnctl port-forward <device>` lists them).

## A typical workflow
Expand Down
6 changes: 3 additions & 3 deletions pkg/templates/partials/user_invocation.sh.tmpl
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,19 +2,19 @@ CREATE_USER=${CREATE_USER:-ask}
if [ "${OS_BUILD}" ] || [ "${CREATE_USER}" = true ]; then
setup_user
else
warn "To enable tunneling, the user ${_FIRST_USER_NAME} has to be created."
warn "The platform user ${_FIRST_USER_NAME} is used for SSH and remote maintenance over the tunnel."
if id -u "${_FIRST_USER_NAME}" >/dev/null 2>&1; then
warn "The user ${_FIRST_USER_NAME} already exist! This operation will change the password and OVERWRITE ssh keys for this users."
fi
warn "Do you want to add \"${_FIRST_USER_NAME}\" as a user and enable tunneling? [yY]"
warn "Do you want to add the platform user \"${_FIRST_USER_NAME}\" (used for SSH and remote maintenance over the tunnel)? [yY]"
read REPLY

case ${REPLY} in
[Yy]* )
setup_user
;;
* )
info "Skipping tunneling setup"
info "Skipping the platform user setup"
;;
esac
fi
2 changes: 1 addition & 1 deletion pkg/templates/partials/user_setup.sh.tmpl
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -30,7 +30,7 @@ setup_user() {
usermod --password $(openssl passwd -1 "${_FIRST_USER_PASS}") "${_FIRST_USER_NAME}"
else
warn "Could not set password for user ${_FIRST_USER_NAME}"
info "Skipping tunneling setup"
info "Skipping the platform user setup"
exit
fi

Expand Down
8 changes: 4 additions & 4 deletions pkg/templates/testdata/agent.golden.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -844,7 +844,7 @@ setup_user() {
usermod --password $(openssl passwd -1 "${_FIRST_USER_PASS}") "${_FIRST_USER_NAME}"
else
warn "Could not set password for user ${_FIRST_USER_NAME}"
info "Skipping tunneling setup"
info "Skipping the platform user setup"
exit
fi

Expand Down Expand Up @@ -922,19 +922,19 @@ CREATE_USER=${CREATE_USER:-ask}
if [ "${OS_BUILD}" ] || [ "${CREATE_USER}" = true ]; then
setup_user
else
warn "To enable tunneling, the user ${_FIRST_USER_NAME} has to be created."
warn "The platform user ${_FIRST_USER_NAME} is used for SSH and remote maintenance over the tunnel."
if id -u "${_FIRST_USER_NAME}" >/dev/null 2>&1; then
warn "The user ${_FIRST_USER_NAME} already exist! This operation will change the password and OVERWRITE ssh keys for this users."
fi
warn "Do you want to add \"${_FIRST_USER_NAME}\" as a user and enable tunneling? [yY]"
warn "Do you want to add the platform user \"${_FIRST_USER_NAME}\" (used for SSH and remote maintenance over the tunnel)? [yY]"
read REPLY

case ${REPLY} in
[Yy]* )
setup_user
;;
* )
info "Skipping tunneling setup"
info "Skipping the platform user setup"
;;
esac
fi
Expand Down
8 changes: 4 additions & 4 deletions pkg/templates/testdata/agent.roles.golden.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1001,7 +1001,7 @@ setup_user() {
usermod --password $(openssl passwd -1 "${_FIRST_USER_PASS}") "${_FIRST_USER_NAME}"
else
warn "Could not set password for user ${_FIRST_USER_NAME}"
info "Skipping tunneling setup"
info "Skipping the platform user setup"
exit
fi

Expand Down Expand Up @@ -1079,19 +1079,19 @@ CREATE_USER=${CREATE_USER:-ask}
if [ "${OS_BUILD}" ] || [ "${CREATE_USER}" = true ]; then
setup_user
else
warn "To enable tunneling, the user ${_FIRST_USER_NAME} has to be created."
warn "The platform user ${_FIRST_USER_NAME} is used for SSH and remote maintenance over the tunnel."
if id -u "${_FIRST_USER_NAME}" >/dev/null 2>&1; then
warn "The user ${_FIRST_USER_NAME} already exist! This operation will change the password and OVERWRITE ssh keys for this users."
fi
warn "Do you want to add \"${_FIRST_USER_NAME}\" as a user and enable tunneling? [yY]"
warn "Do you want to add the platform user \"${_FIRST_USER_NAME}\" (used for SSH and remote maintenance over the tunnel)? [yY]"
read REPLY

case ${REPLY} in
[Yy]* )
setup_user
;;
* )
info "Skipping tunneling setup"
info "Skipping the platform user setup"
;;
esac
fi
Expand Down
2 changes: 1 addition & 1 deletion pkg/templates/testdata/docker_server.golden.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -966,7 +966,7 @@ setup_user() {
usermod --password $(openssl passwd -1 "${_FIRST_USER_PASS}") "${_FIRST_USER_NAME}"
else
warn "Could not set password for user ${_FIRST_USER_NAME}"
info "Skipping tunneling setup"
info "Skipping the platform user setup"
exit
fi

Expand Down
8 changes: 4 additions & 4 deletions pkg/templates/testdata/server.golden.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3196,7 +3196,7 @@ setup_user() {
usermod --password $(openssl passwd -1 "${_FIRST_USER_PASS}") "${_FIRST_USER_NAME}"
else
warn "Could not set password for user ${_FIRST_USER_NAME}"
info "Skipping tunneling setup"
info "Skipping the platform user setup"
exit
fi

Expand Down Expand Up @@ -3274,19 +3274,19 @@ CREATE_USER=${CREATE_USER:-ask}
if [ "${OS_BUILD}" ] || [ "${CREATE_USER}" = true ]; then
setup_user
else
warn "To enable tunneling, the user ${_FIRST_USER_NAME} has to be created."
warn "The platform user ${_FIRST_USER_NAME} is used for SSH and remote maintenance over the tunnel."
if id -u "${_FIRST_USER_NAME}" >/dev/null 2>&1; then
warn "The user ${_FIRST_USER_NAME} already exist! This operation will change the password and OVERWRITE ssh keys for this users."
fi
warn "Do you want to add \"${_FIRST_USER_NAME}\" as a user and enable tunneling? [yY]"
warn "Do you want to add the platform user \"${_FIRST_USER_NAME}\" (used for SSH and remote maintenance over the tunnel)? [yY]"
read REPLY

case ${REPLY} in
[Yy]* )
setup_user
;;
* )
info "Skipping tunneling setup"
info "Skipping the platform user setup"
;;
esac
fi
Expand Down
8 changes: 4 additions & 4 deletions pkg/templates/testdata/server.roles.golden.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3349,7 +3349,7 @@ setup_user() {
usermod --password $(openssl passwd -1 "${_FIRST_USER_PASS}") "${_FIRST_USER_NAME}"
else
warn "Could not set password for user ${_FIRST_USER_NAME}"
info "Skipping tunneling setup"
info "Skipping the platform user setup"
exit
fi

Expand Down Expand Up @@ -3427,19 +3427,19 @@ CREATE_USER=${CREATE_USER:-ask}
if [ "${OS_BUILD}" ] || [ "${CREATE_USER}" = true ]; then
setup_user
else
warn "To enable tunneling, the user ${_FIRST_USER_NAME} has to be created."
warn "The platform user ${_FIRST_USER_NAME} is used for SSH and remote maintenance over the tunnel."
if id -u "${_FIRST_USER_NAME}" >/dev/null 2>&1; then
warn "The user ${_FIRST_USER_NAME} already exist! This operation will change the password and OVERWRITE ssh keys for this users."
fi
warn "Do you want to add \"${_FIRST_USER_NAME}\" as a user and enable tunneling? [yY]"
warn "Do you want to add the platform user \"${_FIRST_USER_NAME}\" (used for SSH and remote maintenance over the tunnel)? [yY]"
read REPLY

case ${REPLY} in
[Yy]* )
setup_user
;;
* )
info "Skipping tunneling setup"
info "Skipping the platform user setup"
;;
esac
fi
Expand Down
Loading