A cross-node module reaches the broker by the hub's overlay name #27

2026-09-16T23:44:08Z

jschoubben commented

2026-09-16 23:44:08 +00:00

The broker credential handed to a module named the genesis MESH_BROKER_ADDRESS (the broker's public endpoint), which a joined node's firewall does not admit — a cross-node consumer timed out fetching the broker's certificate. brokerReachableAt now returns the broker as the target node can reach it: a node on the overlay gets the hub's .internal name (fingerprint pinning makes the host swap safe for TLS); a node not yet on the overlay keeps the genesis address, so bring-up is unchanged. Both credential paths (module issue, builder issue) use it.

Reachability half of hq issue 055. Proven green by the two-node bed in mesh-lab.

https://claude.ai/code/session_01D6qtiYU3P9jk3pnAXyAFyx

The broker credential handed to a module named the genesis MESH_BROKER_ADDRESS (the broker's public endpoint), which a joined node's firewall does not admit — a cross-node consumer timed out fetching the broker's certificate. `brokerReachableAt` now returns the broker as the target node can reach it: a node on the overlay gets the hub's `.internal` name (fingerprint pinning makes the host swap safe for TLS); a node not yet on the overlay keeps the genesis address, so bring-up is unchanged. Both credential paths (module issue, builder issue) use it. Reachability half of hq issue 055. Proven green by the two-node bed in mesh-lab. https://claude.ai/code/session_01D6qtiYU3P9jk3pnAXyAFyx

jschoubben added 1 commit 2026-09-16 23:44:09 +00:00

A cross-node module reaches the broker by the hub's overlay name, not the public address afce2a5f41

The broker credential handed to a module named the genesis MESH_BROKER_ADDRESS — the
broker's public endpoint. That is reachable from the control-node itself but not routed
to another node, whose firewall admits only the overlay (from:mesh); a consumer on a
joined node timed out fetching the broker's certificate and never connected.

brokerReachableAt returns the broker's address as the given node can reach it: a node on
the overlay gets the hub's `.internal` name (which every node resolves and the firewall
admits, the fingerprint pin making the host swap safe for TLS); a node not yet on the
overlay — at genesis, before any `overlay place`, when the builder's account is issued —
keeps the genesis address, so bring-up is unchanged. Both credential paths (module issue
and builder issue) use it. This is the reachability half of novox/hq issue 055.

https://claude.ai/code/session_01D6qtiYU3P9jk3pnAXyAFyx

jschoubben merged commit 5718add8c3 into main

2026-09-16 23:44:42 +00:00

jschoubben deleted branch multi-node/broker-reaches-over-overlay

2026-09-16 23:44:42 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: novox/mesh-controller#27