docs(guides): require CLUSTER_JOIN_PROOF in the HA clustering join steps - #19
Merged
Merged
Conversation
The server has required an admin join proof for a fresh cluster join since librtmp2-server 0109d98 (12 Aug), so the guide's join snippet no longer worked as written: a join without CLUSTER_JOIN_PROOF is rejected before the join request is sent. Add the join-proof minting step, CLUSTER_JOIN_PROOF and the advertise addresses the proof is bound to, and the POST /api/v1/cluster/join-proof row in the endpoint table. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01HyaN2Pdss6XpJ2MWgxfhy5
|
Important Review skippedBot user detected. To trigger a single review, invoke the ⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Advanced Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
AlexanderWagnerDev
marked this pull request as ready for review
September 18, 2026 09:43
claude Bot
pushed a commit
that referenced
this pull request
Sep 18, 2026
SonarCloud's quality gate flagged a security issue on the new code. Both temp paths the change introduced were predictable and therefore open to a symlink attack: sitemap.xml.tmp.$PID in the generator, and a hardcoded /tmp/sitemap.expected.xml in the workflow. Both now use mktemp. mktemp creates the file 0600, so the generator restores mode 644 before moving it into place - sitemap.xml is served publicly. Also inline the usage text rather than sed-ing it back out of $0, and regenerate sitemap.xml after merging main: PR #19 edited the HA clustering guide, so that page's lastmod is now 2026-09-18. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01NTJ2WWC1QQxAmMeu75hvbT
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.



Requested by Alex · project thread
Before: the "Join additional nodes" section of the HA clustering guide told operators to start a second node with only
CLUSTER_ENABLED,CLUSTER_NODE_ID,CLUSTER_JOIN,CLUSTER_SECRETandLRTMP2_DB. Anyone following those steps against a current server gets the join refused, because the server has required an admin-minted join proof for a fresh join since librtmp2-server commit0109d98(12 August). The endpoint table on the same page also had no row for the endpoint that mints the proof, so there was nothing on the page pointing at the missing piece.After: the section first mints a one-time proof on an existing member via
POST /api/v1/cluster/join-proof, then starts the joiner withCLUSTER_JOIN_PROOFset, and the endpoint table listsPOST /api/v1/cluster/join-proof. Following the page end to end now produces a node that actually joins.The join snippet also gained
CLUSTER_BIND,CLUSTER_MEDIA_BIND,CLUSTER_ADVERTISE_ADDRandCLUSTER_MEDIA_ADVERTISE_ADDR. That is not decoration: the proof is bound to the node ID and to the advertised control and media addresses, and with no advertise addresses set the joiner falls back to rewriting its wildcard bind to loopback (ClusterConfig::advertise_control/advertise_mediainsrc/cluster/config.rs), which cannot match a proof minted for a routable address. Without those four lines the snippet would still fail.How: edits are confined to
guides/rtmp-server-ha-clustering/index.php— two new paragraphs and a curl block in the join section, four added lines in the joiner env block, a note that the proof is single-purpose and address-bound while an existing member restarting on the resume path needs no new proof, the reseed sentence now mentioning a fresh proof, and one new table row. Wording and the request/response shape followdocs/clustering.mdin librtmp2-server, which is the canonical reference the page already links to. No shared includes, styles or other pages touched;php -lis clean.🤖 Generated with Claude Code
https://claude.ai/code/session_01HyaN2Pdss6XpJ2MWgxfhy5
Generated by Claude Code