Say in to-be 8 that a port may be reached from the machine's own local network (issue 154, ADR 0340)

A local service could only be declared public, which says the internet; ADR 0340 adds local-network, private ranges only, and needs a design home.
2026-10-13 08:14:43 +02:00
parent 0e6bc1bc80
commit d50e6df906
1 changed files with 15 additions and 1 deletions
@@ -22,8 +22,9 @@ code:
  - mesh-host internal/apply (the service that reflects a rule set; a whole file handed to its new owner)
  - mesh-controller cmd/mesh-controller/nodes.go (a token issued for a machine's tunnel key, ADR 0169)
  - mesh-host cmd/mesh-host/join_tunnel.go (a machine joins through the tunnel, ADR 0169)
-updated: 2026-10-08
+updated: 2026-10-13
 decisions:
+  - "ADR 0340"
  - "ADR 0247"
  - "ADR 0226"
  - "ADR 0223"
@@ -1070,6 +1071,19 @@ One value, three readers:
 | `internal` | the machine port, to the private network | the internal name | the mesh's own authority |
 | `public` | the machine port, to anywhere | the public name | the public authority |
 | `both` | the machine port, to anywhere | both names | each name's own authority |
+| `local-network` | the machine port, to the private network and the machine's local networks | the internal name | the mesh's own authority |
+
+*2026-10-13.* **A port may be reached from the machine's own local network, and only its private
+part** (ADR 0340). A home server serves devices on its own network that will never be nodes, and until
+now the only value that reached them was `anywhere`, which says the internet. The fourth source,
+`local-network`, and the reach of the same name mean the networks the machine is attached to through
+its uplink, as the node-engine reports them among its facts. Only networks wholly in a private range
+count (RFC 1918, and unique local addresses for IPv6); a public subnet the machine sits on is never
+counted, so the source cannot open a port to the internet. The filter renders it on that port's rule
+alone, as the subnets it resolved to. A machine that reports no private network has a `local-network`
+port admitted from no local network, and the rule set and the plan say so. The plan shows what each
+such port resolved to, and `node` shows which attached networks counted and why the others did not.
+A laptop that travels admits whichever local network it is on, which the plan makes visible.

 *2026-10-02.* **The proxy serves an internal name to the private network only**
 (ADR 0138,