From 4930aa7956ae61024ceaeaed39a5bcdfc1599947 Mon Sep 17 00:00:00 2001
From: Thomas Eizinger <thomas@eizinger.io>
Date: Tue, 14 Oct 2025 10:32:05 +1100
Subject: [PATCH] feat: allow setting Internet Resource from headless client
 (#10553)

Currently, the Internet Resource cannot be toggled on/off in the
headless client. With #10509, the default state of the Internet Resource
is now disabled, meaning users of the headless client are no longer able
to use the Internet Resource.

We fix this by introducing a new CLI argument
`--activate-internet-resource` that can also be set via the env variable
`FIREZONE_ACTIVATE_INTERNET_RESOURCE=true`.

Resolves: #8342
---
 rust/headless-client/src/main.rs              | 12 +++++++++++-
 website/src/components/Changelog/Headless.tsx |  4 ++++
 2 files changed, 15 insertions(+), 1 deletion(-)

diff --git a/rust/headless-client/src/main.rs b/rust/headless-client/src/main.rs
index b4c41d59e..2e0a5d7d9 100644
--- a/rust/headless-client/src/main.rs
+++ b/rust/headless-client/src/main.rs
@@ -101,6 +101,16 @@ struct Cli {
     #[arg(short = 'i', long, env = "FIREZONE_ID")]
     firezone_id: Option<String>,
 
+    /// Activate the Internet Resource.
+    ///
+    /// To actually use the Internet Resource, the user must also have a policy granting access to the Internet Resource.
+    #[arg(
+        long,
+        env = "FIREZONE_ACTIVATE_INTERNET_RESOURCE",
+        default_value_t = false
+    )]
+    activate_internet_resource: bool,
+
     /// Disable sentry.io crash-reporting agent.
     #[arg(long, env = "FIREZONE_NO_TELEMETRY", default_value_t = false)]
     no_telemetry: bool,
@@ -341,7 +351,7 @@ fn try_main() -> Result<()> {
             Arc::new(tcp_socket_factory),
             Arc::new(UdpSocketFactory::default()),
             portal,
-            false,
+            cli.activate_internet_resource,
             rt.handle().clone(),
         );
 
diff --git a/website/src/components/Changelog/Headless.tsx b/website/src/components/Changelog/Headless.tsx
index 8e73a1b88..c0ac614e9 100644
--- a/website/src/components/Changelog/Headless.tsx
+++ b/website/src/components/Changelog/Headless.tsx
@@ -13,6 +13,10 @@ export default function Headless({ os }: { os: OS }) {
         <ChangeItem pull="10533">
           Improves reliability by caching DNS responses as per their TTL.
         </ChangeItem>
+        <ChangeItem pull="10553">
+          Adds a CLI switch `--activate-internet-resource`. By default, the
+          Internet Resource is now off.
+        </ChangeItem>
       </Unreleased>
       <Entry version="1.5.3" date={new Date("2025-09-10")}>
         <ChangeItem pull="10126">