refactor(headless-client): deprecate subcommands for now (#4953)

Closes #4907

They're still accepted, but the binary entirely determines the behavior.
This makes the code for CLI parsing and token handling simpler with
fewer branches, so it's easier to be sure it's correct.

Replaces #4942 which isn't doing what I intended anymore.

docker-compose.yml

@@ -320,7 +320,6 @@ services:
         - type=registry,ref=us-east1-docker.pkg.dev/firezone-staging/cache/client:main
       args:
         PACKAGE: firezone-headless-client
-    # Add "standalone" to the command here once PR $4604 merges
     image: ${CLIENT_IMAGE:-us-east1-docker.pkg.dev/firezone-staging/firezone/dev/client}:${CLIENT_TAG:-main}
     cap_add:
       - NET_ADMIN

rust/headless-client/src/lib.rs

@@ -53,8 +53,10 @@ const TOKEN_ENV_KEY: &str = "FIREZONE_TOKEN";
 #[derive(clap::Parser)]
 #[command(author, version, about, long_about = None)]
 struct Cli {
+    // Needed to preserve CLI arg compatibility
+    // TODO: Remove
     #[command(subcommand)]
-    command: Option<Cmd>,
+    _command: Option<Cmd>,
 
     #[arg(
         short = 'u',
@@ -104,22 +106,10 @@ struct Cli {
     max_partition_time: Option<humantime::Duration>,
 }
 
-impl Cli {
-    fn command(&self) -> Cmd {
-        // Needed for backwards compatibility with old Docker images
-        self.command.unwrap_or(Cmd::Auto)
-    }
-}
-
 #[derive(clap::Subcommand, Clone, Copy)]
 enum Cmd {
-    /// If there is a token on disk, run in standalone mode. Otherwise, run as an IPC service. This will be removed in a future version.
-    #[command(hide = true)]
-    Auto,
-    /// Listen for IPC connections and act as a privileged tunnel process for a GUI client
     #[command(hide = true)]
     IpcService,
-    /// Act as a CLI-only Client
     Standalone,
 }
 
@@ -139,7 +129,7 @@ pub enum IpcServerMsg {
     TunnelReady,
 }
 
-pub fn run() -> Result<()> {
+pub fn run_only_headless_client() -> Result<()> {
     let mut cli = Cli::parse();
 
     // Modifying the environment of a running process is unsafe. If any other
@@ -168,27 +158,14 @@ pub fn run() -> Result<()> {
     let rt = tokio::runtime::Builder::new_current_thread()
         .enable_all()
         .build()?;
-    let (_shutdown_tx, shutdown_rx) = mpsc::channel(1);
-
-    match cli.command() {
-        Cmd::Auto => {
-            if let Some(token) = get_token(token_env_var, &cli)? {
-                run_standalone(cli, rt, &token)
-            } else {
-                imp::run_ipc_service(cli, rt, shutdown_rx)
-            }
-        }
-        Cmd::IpcService => imp::run_ipc_service(cli, rt, shutdown_rx),
-        Cmd::Standalone => {
-            let token = get_token(token_env_var, &cli)?.with_context(|| {
-                format!(
-                    "Can't find the Firezone token in ${TOKEN_ENV_KEY} or in `{}`",
-                    cli.token_path
-                )
-            })?;
-            run_standalone(cli, rt, &token)
-        }
-    }
+
+    let token = get_token(token_env_var, &cli)?.with_context(|| {
+        format!(
+            "Can't find the Firezone token in ${TOKEN_ENV_KEY} or in `{}`",
+            cli.token_path
+        )
+    })?;
+    run_standalone(cli, rt, &token)
 }
 
 // Allow dead code because Windows doesn't have an obvious SIGHUP equivalent

rust/headless-client/src/main.rs

@@ -1,3 +1,3 @@
 fn main() -> anyhow::Result<()> {
-    firezone_headless_client::run()
+    firezone_headless_client::run_only_headless_client()
 }