fix: correct stale app.netbird.io management URL (#401)

[lfarkas]

Summary

Fixes #401. Affected NetBird Cloud users fail to connect with a gRPC TLS error:
authentication handshake failed: credentials: cannot check peer: missing selected ALPN property.

Root cause: the client dials app.netbird.io:443 (the web dashboard) for the
Management gRPC service instead of api.netbird.io:443 (the management API).
app.netbird.io is fronted by a proxy that terminates TLS for the browser UI
without negotiating the HTTP/2 h2 ALPN that gRPC-go >= 1.67 enforces, so the
handshake aborts. The wrong host is a stale value persisted in /config/config.json
from an older setup; the add-on leaves management_url empty and never passes
--management-url, so NetBird keeps the persisted value rather than its correct
built-in default (api.netbird.io). NetBird's own UpdateOldManagementURL
migration only rewrites api.netbird.io/api.wiretrustee.com hosts, so an
app.netbird.io value is never auto-corrected.

Fix: the service script now self-heals — when the user has set no management_url
and the persisted Management host is app.netbird.io, it passes
--management-url https://api.netbird.io. NetBird then rewrites and persists the
corrected URL. Self-hosted users (who set a non-empty management_url) are untouched,
and the rewrite is idempotent on later boots.

Test Plan

• bash -n and shellcheck on the modified service script: clean.
• Verified the jq extraction + host-match against realistic config.json shapes:
  stale app.netbird.io with/without :443 port -> corrected; api.netbird.io,
  self-hosted host, missing ManagementURL, and missing config file -> left untouched.
• Confirmed upstream bundled v0.74.3 default is api.netbird.io and app.netbird.io
  is only the admin/dashboard URL.

🤖 Generated with Claude Code

Summary by CodeRabbit

• Bug Fixes
  • Improves startup reliability by automatically recovering from stale NetBird Cloud Management URL settings.
  • Detects and corrects an outdated dashboard-only endpoint so the service connects to the right API URL.
  • Emits a warning when it applies the configuration correction.

[coderabbitai]

Warning

Review limit reached

@lfarkas, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 53 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: dedeac66-fc0b-45a3-952c-e0002ebfb39b

📥 Commits

Reviewing files that changed from the base of the PR and between a1c7528 and 58d9864.

📒 Files selected for processing (1)

• netbird/rootfs/etc/s6-overlay/s6-rc.d/netbird/run

📝 Walkthrough

Walkthrough

The NetBird startup script checks persisted configuration when management_url is unset and replaces app.netbird.io with https://api.netbird.io before constructing startup options.

Changes

Management URL self-healing

Layer / File(s)	Summary
Startup management URL correction netbird/rootfs/etc/s6-overlay/s6-rc.d/netbird/run	Reads the persisted management URL, warns when its host is app.netbird.io, and sets the API management URL only when no URL was explicitly configured.

Estimated code review effort: 2 (Simple) | ~10 minutes

Poem

A rabbit checked the config at dawn,
Found the dashboard path was wrong.
“Hop to the API,” it said with cheer,
And kept explicit choices clear.
NetBird starts along its way!

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly matches the main fix: correcting the stale app.netbird.io management URL for issue #401.
Linked Issues check	✅ Passed	The change detects persisted app.netbird.io config and rewrites it to api.netbird.io, which addresses the reported cloud connection failure.
Out of Scope Changes check	✅ Passed	The PR is narrowly scoped to the NetBird management URL self-heal and does not introduce unrelated changes.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/401-management-url-alpn

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[Copilot]

Pull request overview

This PR fixes a NetBird Cloud connectivity failure caused by a stale persisted management_url pointing to https://app.netbird.io (dashboard) instead of the gRPC management API endpoint https://api.netbird.io, which can trigger TLS/ALPN handshake failures for gRPC.

Changes:

• Adds a startup-time “self-heal” in the s6 run script: when the user has not configured management_url and /config/config.json contains ManagementURL.Host under app.netbird.io, it forces --management-url https://api.netbird.io.
• Logs a warning when performing the auto-correction, relying on NetBird to persist the corrected value afterward.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@netbird/rootfs/etc/s6-overlay/s6-rc.d/netbird/run`:
- Around line 35-41: Update the jq filter in the management URL self-healing
block to read the flat .ManagementURL string instead of .ManagementURL.Host,
while preserving the existing app.netbird.io host check and correction to
https://api.netbird.io.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 6172cef5-ec8d-4e16-909f-5ffb88bbe03b

📥 Commits

Reviewing files that changed from the base of the PR and between ac817db and 8a4d5c7.

📒 Files selected for processing (1)

• netbird/rootfs/etc/s6-overlay/s6-rc.d/netbird/run