A computed module says what its machine opens, so a hub can be filtered

The machine that most needed a firewall was the one that could not have one. A
hub is dialled by every node at other sites and needs its port open; a machine
that is not a hub dials out and needs nothing open. They are the same module,
and `listens` in a manifest is one answer for every machine that runs it — so
the machine a static answer gets wrong is the one facing the public internet.

A generator can now say what it opens, in a second interface rather than a
method on every generator: most have nothing to say here, and requiring an
empty method of each would be a cost paid everywhere for one caller.

The port is the one in the endpoint, which is where the interface takes its
ListenPort from. One source, so a rule set cannot open a port the interface is
not on. Open to everywhere and deliberately: a node at another site is not on
the private network until this port lets it on, so restricting it to the mesh
would be a rule that can never be satisfied by the thing it exists for.

And a generator that cannot say is refused rather than read as silence. Closing
a port on the evidence of a failure to look is how a machine is severed by a
fault somewhere else — and the machine it would sever is the hub, whose only
route to being fixed is the network it just closed.

internal/overlay/generator.go

@@ -1,6 +1,12 @@
 package overlay
 
-import "encoding/json"
+import (
+	"encoding/json"
+	"fmt"
+	"strconv"
+
+	"github.com/novox/mesh-control/internal/catalogue"
+)
 
 // The private network as a module rather than as code beside the module system.
 //
@@ -195,3 +201,46 @@ func DomainManifest() map[string]any {
 // reaches the broker, which is what being in the mesh is — so it answers "not part of this" for
 // everyone instead of refusing for want of a hub.
 func Empty() *Generator { return &Generator{graph: Graph{}} }
+
+// Listens is the port this node accepts the private network on, which only a hub has.
+//
+// **A fact about this machine's place in the mesh, not about the module.** Every machine on the
+// network runs the same module; a hub is dialled by every node at other sites and needs its port
+// open, and a machine that is not a hub dials out and needs nothing open at all. A static field in
+// a manifest is one answer for every machine that runs it, so it cannot say this — and the machine
+// it would get wrong is the one facing the public internet, which is the machine that most needs
+// filtering.
+//
+// The port is the one in the endpoint, which is also where the interface takes its ListenPort
+// from. One source, so a rule set cannot open a port the interface is not on.
+func (g *Generator) Listens(node string) ([]catalogue.Listening, error) {
+	for _, n := range g.nodes {
+		if n.Name != node {
+			continue
+		}
+		if !n.Reachable() {
+			// It dials out and nothing dials it. Opening a port here would be opening one on a
+			// machine nothing connects to, which is not harmless — it is a rule with no source
+			// that somebody later has to work out the reason for.
+			return nil, nil
+		}
+		port := portOf(n.Endpoint)
+		if port == "" {
+			return nil, fmt.Errorf(
+				"%s is reachable at %q and no port can be read from it, so what it must accept "+
+					"the private network on is unknown", node, n.Endpoint)
+		}
+		number, err := strconv.Atoi(port)
+		if err != nil {
+			return nil, fmt.Errorf("%s is reachable at %q, and %q is not a port", node, n.Endpoint, port)
+		}
+		return []catalogue.Listening{{
+			Port: number, Protocol: "udp", From: catalogue.FromEverywhere,
+			// From everywhere, and deliberately: a node at another site is not on the private
+			// network until this port lets it on, so restricting this to the mesh would be a
+			// rule that can never be satisfied by the thing it exists for.
+			Why: "the private network — a node at another site has no other way in",
+		}}, nil
+	}
+	return nil, nil
+}