novox/hq
7
0
Fork 0
Code Issues Pull Requests 3 Releases Wiki Activity

Merge pull request 'To-be 8: a port may be reached from the machine's own local network (issue 154, ADR 0340)' (#339) from design/154-local-network into main

Browse Source
This commit was merged in pull request #339.
This commit is contained in:
mesh-admin
2026-10-13 06:22:48 +00:00
parent 0e6bc1bc80 5d861fefcb
commit 8e6ca012c5
1 changed files with 15 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
03-DESIGN/01-to-be/08-connectivity.md
+15 -1
View File
@@ -22,8 +22,9 @@ code:
- mesh-host internal/apply (the service that reflects a rule set; a whole file handed to its new owner)
- mesh-controller cmd/mesh-controller/nodes.go (a token issued for a machine's tunnel key, ADR 0169)
- mesh-host cmd/mesh-host/join_tunnel.go (a machine joins through the tunnel, ADR 0169)
updated: 2026-10-08
updated: 2026-10-13
decisions:
- "ADR 0340"
- "ADR 0247"
- "ADR 0226"
- "ADR 0223"
@@ -1070,6 +1071,19 @@ One value, three readers:
| `internal` | the machine port, to the private network | the internal name | the mesh's own authority |
| `public` | the machine port, to anywhere | the public name | the public authority |
| `both` | the machine port, to anywhere | both names | each name's own authority |
| `local-network` | the machine port, to the private network and the machine's local networks | the internal name | the mesh's own authority |
*2026-10-13.* **A port may be reached from the machine's own local network, and only its private
part** (ADR 0340). A home server serves devices on its own network that will never be nodes, and until
now the only value that reached them was `anywhere`, which says the internet. A new source,
`local-network`, and the reach of the same name mean the networks the machine is attached to through
its uplink, as the node-engine reports them among its facts. Only networks wholly in a private range
count (RFC 1918, and unique local addresses for IPv6); a public subnet the machine sits on is never
counted, so the source cannot open a port to the internet. The filter renders it on that port's rule
alone, as the subnets it resolved to. A machine that reports no private network has a `local-network`
port admitted from no local network, and the rule set and the plan say so. The plan shows what each
such port resolved to, and `node` shows which attached networks counted and why the others did not.
A laptop that travels admits whichever local network it is on, which the plan makes visible.
*2026-10-02.* **The proxy serves an internal name to the private network only**
(ADR 0138,