[misc] Installation fallback for when host is missing openssl dependency

[adikavemen]

Describe your changes

Added checks for openssl dependency being met in the installation script. When the dependency is not met the script spins up temporary alpine openssl containers to generate keys. Tries to use pre-existing openssl image if present. Handles clean up if images are retrieved.

Issue ticket number and link

Stack

Checklist

• Is it a bug fix
• Is a typo/documentation fix
• Is a feature enhancement
• It is a refactor
• Created tests that fail without the change (if possible)
• This change does not modify the public API, gRPC protocols, functionality behavior, CLI / service flags, or introduce a new feature — OR I have discussed it with the NetBird team beforehand (link the issue / Slack thread in the description). See CONTRIBUTING.md.

By submitting this pull request, you confirm that you have read and agree to the terms of the Contributor License Agreement.

Documentation

Select exactly one:

• I added/updated documentation for this change
• Documentation is not needed for this change (explain why)
  This PR does not change how the script already functions. It provides a fallback for when openssl is not available on the host.

Docs PR URL (required if "docs added" is checked)

Paste the PR link from https://github.com/netbirdio/docs here: N/A

Summary by CodeRabbit

Summary by CodeRabbit

• Chores
  • Improved the getting-started setup by initializing default configuration values before secret generation.
  • Updated secret generation to adapt to the environment: uses locally available cryptographic tooling when present, otherwise generates secrets via a containerized fallback.
  • Maintains consistent secret formatting across scenarios and streamlines related cleanup.

[CLAassistant]

All committers have signed the CLA.

[coderabbitai]

📝 Walkthrough

Walkthrough

initialize_default_values in getting-started.sh now pre-initializes NETBIRD_STUN_PORT, NETBIRD_RELAY_AUTH_SECRET, and DATASTORE_ENCRYPTION_KEY, then generates secrets conditionally: using local openssl if available, or falling back to docker run alpine/openssl with optional image cleanup afterward.

Changes

Conditional Secret Generation with Docker Fallback

Layer / File(s)	Summary
Conditional openssl / Docker fallback for secret generation infrastructure_files/getting-started.sh	Variables for STUN port, relay auth secret, and datastore encryption key are pre-initialized. Secret generation branches on local openssl availability: local path uses openssl rand directly; fallback uses docker run alpine/openssl and conditionally removes the pulled image. Padding-stripping behavior per variable is preserved.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

Poem

🐰 Hop hop, the script now checks the shell,
No openssl? Docker does it well!
A container spins, then fades away,
The secrets bloom at start of day.
Base64 pads trimmed just so —
The rabbit keeps the certs in flow! 🔑

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description check	✅ Passed	The description covers all required template sections with appropriate details: change description, checklist completion, documentation decision with explanation, and CLA confirmation.
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title mentions 'Installation fallback for when host is missing openssl dependency' which directly relates to the main change - adding a fallback mechanism when openssl is not available locally.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@infrastructure_files/getting-started.sh`:
- Around line 352-356: The openssl detection using `if openssl &> /dev/null` is
broken because running openssl without arguments returns exit code 1, making
this condition always false and the subsequent code for setting
NETBIRD_RELAY_AUTH_SECRET and DATASTORE_ENCRYPTION_KEY unreachable. Replace the
condition check with `if command -v openssl &> /dev/null` to properly verify
that the openssl command is available on the system.
- Around line 361-372: The variable OPENSSL_IMAGE needs to be double-quoted in
all usages throughout the script to prevent word splitting and globbing issues.
Add double quotes around $OPENSSL_IMAGE in three locations: the two docker run
commands that use it to generate secrets (NETBIRD_RELAY_AUTH_SECRET and
DATASTORE_ENCRYPTION_KEY), and the docker rmi command that removes the image.
This ensures the variable is treated as a single argument even if it contains
spaces or special characters.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: d6d4d97a-a229-432d-b0d3-8a7d9e01a381

📥 Commits

Reviewing files that changed from the base of the PR and between b19467e and 3ae38f1.

📒 Files selected for processing (1)

• infrastructure_files/getting-started.sh

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[adikavemen]

Hi @pappz & @riccardomanfrin sorry for the ping. Just wanted to get some visibility on this PR.

[champtar]

@adikavemen why not use head -c 32 /dev/urandom | base64 ?

[adikavemen]

@champtar I was unaware of /dev/urandom and how openssl often uses it. Openssl was what was previously used in the script so I was using the same key generation method. Openssl remains the better option as it would use available hardware in keygen where possible. It also uses more bits in encryption which makes openssl more secure than using /dev/urandom this way