From eb67d6361ed327e8fa584a33fdf120586893d161 Mon Sep 17 00:00:00 2001
From: ahmzaa <hamza@ahmza.com>
Date: Sat, 25 Jul 2026 01:39:09 +0100
Subject: [PATCH] Add Netbird connectivity debug step to deploy job

Temporary diagnostic step before 'Netbird Connect' that checks secret
presence (masked), DNS resolution, HTTPS reachability to the management
API, and the signal server TCP port from the runner. Helps distinguish
DNS/connectivity issues from auth/registration failures behind the
recurring 'netbird up' DeadlineExceeded error. Marked continue-on-error
so it never blocks the build.
---
 .github/workflows/build-docker-images.yml | 29 +++++++++++++++++++++++
 1 file changed, 29 insertions(+)

diff --git a/.github/workflows/build-docker-images.yml b/.github/workflows/build-docker-images.yml
index 2f7b7d7..86ecd69 100644
--- a/.github/workflows/build-docker-images.yml
+++ b/.github/workflows/build-docker-images.yml
@@ -53,6 +53,35 @@ jobs:
     needs: build
 
     steps:
+      - name: Debug Netbird connectivity
+        env:
+          NB_URL: ${{ secrets.NETBIRD_URL }}
+          NB_KEY: ${{ secrets.NETBIRD_SETUP_KEY }}
+        run: |
+          echo "=== Secret presence (values are masked) ==="
+          echo "NETBIRD_URL length: ${#NB_URL}"
+          echo "NETBIRD_SETUP_KEY length: ${#NB_KEY}"
+          if [ -z "$NB_URL" ]; then echo "WARNING: NETBIRD_URL is EMPTY"; fi
+          if [ -z "$NB_KEY" ]; then echo "WARNING: NETBIRD_SETUP_KEY is EMPTY"; fi
+
+          # Derive host from the URL without printing the full URL.
+          host="$(printf '%s' "$NB_URL" | sed -E 's#^[a-zA-Z]+://##; s#[:/].*$##')"
+          echo "Derived management host: ${host:-<none>}"
+
+          echo "=== DNS resolution ==="
+          getent hosts "$host" || nslookup "$host" || echo "DNS resolution FAILED for $host"
+
+          echo "=== HTTPS reachability (management API, :443) ==="
+          curl -sS -o /dev/null -w "HTTP %{http_code}  connect=%{time_connect}s  total=%{time_total}s\n" \
+            --max-time 15 "https://${host}/" || echo "curl to management API FAILED"
+
+          echo "=== Signal server port (:10000 gRPC) TCP check ==="
+          timeout 10 bash -c "cat < /dev/null > /dev/tcp/${host}/10000" \
+            && echo "TCP :10000 reachable" || echo "TCP :10000 NOT reachable (signal server / firewall?)"
+
+          echo "=== done (this step never fails the build) ==="
+        continue-on-error: true
+
       - name: Netbird Connect
         uses: Alemiz112/netbird-connect@v1
         with: