From d50e6df90619f345ed11349b1a7314efd103f657 Mon Sep 17 00:00:00 2001 From: jochen Date: Tue, 13 Oct 2026 08:14:43 +0200 Subject: [PATCH] Say in to-be 8 that a port may be reached from the machine's own local network (issue 154, ADR 0340) A local service could only be declared public, which says the internet; ADR 0340 adds local-network, private ranges only, and needs a design home. --- 03-DESIGN/01-to-be/08-connectivity.md | 16 +++++++++++++++- 1 file changed, 15 insertions(+), 1 deletion(-) diff --git a/03-DESIGN/01-to-be/08-connectivity.md b/03-DESIGN/01-to-be/08-connectivity.md index 49711c05..3c5d3bf7 100644 --- a/03-DESIGN/01-to-be/08-connectivity.md +++ b/03-DESIGN/01-to-be/08-connectivity.md @@ -22,8 +22,9 @@ code: - mesh-host internal/apply (the service that reflects a rule set; a whole file handed to its new owner) - mesh-controller cmd/mesh-controller/nodes.go (a token issued for a machine's tunnel key, ADR 0169) - mesh-host cmd/mesh-host/join_tunnel.go (a machine joins through the tunnel, ADR 0169) -updated: 2026-10-08 +updated: 2026-10-13 decisions: + - "ADR 0340" - "ADR 0247" - "ADR 0226" - "ADR 0223" @@ -1070,6 +1071,19 @@ One value, three readers: | `internal` | the machine port, to the private network | the internal name | the mesh's own authority | | `public` | the machine port, to anywhere | the public name | the public authority | | `both` | the machine port, to anywhere | both names | each name's own authority | +| `local-network` | the machine port, to the private network and the machine's local networks | the internal name | the mesh's own authority | + +*2026-10-13.* **A port may be reached from the machine's own local network, and only its private +part** (ADR 0340). A home server serves devices on its own network that will never be nodes, and until +now the only value that reached them was `anywhere`, which says the internet. The fourth source, +`local-network`, and the reach of the same name mean the networks the machine is attached to through +its uplink, as the node-engine reports them among its facts. Only networks wholly in a private range +count (RFC 1918, and unique local addresses for IPv6); a public subnet the machine sits on is never +counted, so the source cannot open a port to the internet. The filter renders it on that port's rule +alone, as the subnets it resolved to. A machine that reports no private network has a `local-network` +port admitted from no local network, and the rule set and the plan say so. The plan shows what each +such port resolved to, and `node` shows which attached networks counted and why the others did not. +A laptop that travels admits whichever local network it is on, which the plan makes visible. *2026-10-02.* **The proxy serves an internal name to the private network only** (ADR 0138,