The web front keeps what it serves, its certificates and what it refuses on the bus, with tools to read them (issue 774)

Conversation 1 Commits 2 Files Changed 13

+1583 -118

2 Commits

Author SHA1 Message Date

Author	SHA1	Message	Date
jschoubben	b7c3868980	Keep a scan out of route-proxy's unrouted state: only names under a served domain, a few a minute, no visitor address (issue 774) mesh/delivery merged: source.main moved to novox/mesh-controller@159db37618c2 Details mesh/check being carried to b7c3868980f3 on 159db37618c2 \| from a4426190b0c7 Review of `ddae6729`: a scanner's random Host or SNI names each became a key, bounded only by the bucket's lifetime and size, and every failed write was retried at each change and logged each time. A refused name is now kept by name only under the registrable domain of a name the proxy serves, and at most five new names a minute; every other refusal is counted in memory and written once a minute under <node>._other (last minute, since start), which route_proxy_unrouted shows. A refused write of that state is dropped and logged once until a write succeeds; trimming memory to 4096 names moved from the request to the writer. The visitor's address is no longer kept: the journal has it. Quick: drop unrouted keys from strangers by a fixed allow-list. Thorough: bound by the proxy's own domains, by rate, and by never retrying. Chose thorough: the scan is constant on a public machine.	2026-10-30 23:03:00 +01:00
jschoubben	ddae6729c1	Give route-proxy its state on the bus and three tools, so a site's route, certificate and last answer are read from the mesh instead of with curl (issue 774) The web front kept nothing on the bus: whether grafana or drive was routed, where to, with which certificate, and what it last answered could only be learned with curl or the container's log. The proxy now keeps `routes` and `unrouted` (announced readable, keyed <node>.<name>), written on change by one writer: route set changes, certificates stored by autocert's cache or failing at a handshake, upstream answers that differ from the last written (or are a minute old), and names refused in a request or a handshake. The provider helper's bundle serves route_proxy_routes, route_proxy_route and route_proxy_unrouted from those states. Quick: log the routes at start and grep the journal. Thorough: the state on the bus and the tools that read it, mesh-wide, in one call. Chose thorough: the operator's question is mesh-wide and recurs, and the log says nothing about certificates or answers. Tests: two table tests added (the ledger, the tools), both failing without the change; four authority tests and four skipped-route tests merged into two, so the module has four fewer.	2026-10-30 22:58:04 +01:00

b7c3868980

Keep a scan out of route-proxy's unrouted state: only names under a served domain, a few a minute, no visitor address (issue 774)

mesh/delivery merged: source.main moved to novox/mesh-controller@159db37618c2

Details

mesh/check being carried to b7c3868980f3 on 159db37618c2 | from a4426190b0c7

Review of ddae6729: a scanner's random Host or SNI names each became a key, bounded only by the
bucket's lifetime and size, and every failed write was retried at each change and logged each time.

A refused name is now kept by name only under the registrable domain of a name the proxy serves, and
at most five new names a minute; every other refusal is counted in memory and written once a minute
under <node>._other (last minute, since start), which route_proxy_unrouted shows. A refused write of
that state is dropped and logged once until a write succeeds; trimming memory to 4096 names moved
from the request to the writer. The visitor's address is no longer kept: the journal has it.

Quick: drop unrouted keys from strangers by a fixed allow-list. Thorough: bound by the proxy's own
domains, by rate, and by never retrying. Chose thorough: the scan is constant on a public machine.

2026-10-30 23:03:00 +01:00

jschoubben

ddae6729c1

Give route-proxy its state on the bus and three tools, so a site's route, certificate and last answer are read from the mesh instead of with curl (issue 774)

The web front kept nothing on the bus: whether grafana or drive was routed, where to, with which
certificate, and what it last answered could only be learned with curl or the container's log.

The proxy now keeps `routes` and `unrouted` (announced readable, keyed <node>.<name>), written on
change by one writer: route set changes, certificates stored by autocert's cache or failing at a
handshake, upstream answers that differ from the last written (or are a minute old), and names
refused in a request or a handshake. The provider helper's bundle serves route_proxy_routes,
route_proxy_route and route_proxy_unrouted from those states.

Quick: log the routes at start and grep the journal. Thorough: the state on the bus and the tools
that read it, mesh-wide, in one call. Chose thorough: the operator's question is mesh-wide and
recurs, and the log says nothing about certificates or answers.

Tests: two table tests added (the ledger, the tools), both failing without the change; four
authority tests and four skipped-route tests merged into two, so the module has four fewer.

2026-10-30 22:58:04 +01:00

The web front keeps what it serves, its certificates and what it refuses on the bus, with tools to read them (issue 774) #485