novox/mesh-controller
6
0
Fork 0
Code Issues Pull Requests 5 Releases Wiki Activity

The mesh answers only its own names privately; a public name resolves publicly (hq ADR 0191) #235

Merged
jschoubben merged 1 commits from fix/the-mesh-resolves-only-its-own-names into main 2026-10-03 13:16:14 +00:00
Conversation 0 Commits 1 Files Changed 2
+50 -5
jschoubben commented 2026-10-03 13:14:02 +00:00
Owner
Copy Link
Copy Source

hq ADR 0191 (novox/hq#320).

routeNamesInTheMesh results are filtered through meshOwnNames: only names under the mesh suffix join the roster. Public routed names (*.novox.be, *.zurag.be) leave every machine's hosts region, so a resolver that also answers a LAN no longer hands non-members tunnel addresses (phone: couldn't connect to 10.10.0.1:143).

Verified before the change, live: hairpin to both public IPs works from ace, novox and a container on novox; <label>.<node>.internal resolves and serves with the internal cert; no route restricts by source.

Tests: new TestOnlyTheMeshsOwnNamesAreAnsweredPrivately; go test ./... and go vet pass.

hq ADR 0191 (novox/hq#320). `routeNamesInTheMesh` results are filtered through `meshOwnNames`: only names under the mesh suffix join the roster. Public routed names (`*.novox.be`, `*.zurag.be`) leave every machine's hosts region, so a resolver that also answers a LAN no longer hands non-members tunnel addresses (phone: couldn't connect to 10.10.0.1:143). Verified before the change, live: hairpin to both public IPs works from ace, novox and a container on novox; `<label>.<node>.internal` resolves and serves with the internal cert; no route restricts by source. Tests: new `TestOnlyTheMeshsOwnNamesAreAnsweredPrivately`; `go test ./...` and `go vet` pass.
jschoubben added 1 commit 2026-10-03 13:14:02 +00:00
The mesh answers only its own names privately; a public name resolves publicly (hq ADR 0191) 408f6dbad9 
Every routed public name was published into each machine's hosts region at its serving node's
private address. ace's resolver also answers its LAN, so a phone there got the control-node's
tunnel address for the mail server and could not connect. Routes have internal names under the
serving node (ADR 0151), so only names under the mesh suffix are published now.
jschoubben merged commit 62650cd48c into main 2026-10-03 13:16:14 +00:00
jschoubben deleted branch fix/the-mesh-resolves-only-its-own-names 2026-10-03 13:16:14 +00:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
No items
No labels
Milestone
No items
No Milestone
Assignees
Clear assignees
jschoubben miel.truyen
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: novox/mesh-controller#235