The broker opening is only on the broker's host, not every node #74

2026-09-26T20:20:18Z

jschoubben commented

2026-09-26 20:20:18 +00:00

Enrolling ace applied adoption.opening-tcp-5671-incoming to it — a from-anywhere (v4+v6) opening for 5671 where nothing on ace listens (the ace session caught it). The foundation opening exists to widen the broker's from: mesh listen to from-anywhere, because a machine enrolling isn't on the mesh yet and its first dial would be refused mesh-only — but that belongs on the broker's host alone; a node that only dials out needs no incoming rule. foundationPortsFor keeps the port only when a module resolved onto this node listens on it. Two tests (broker host keeps it; a dial-only node gets nothing); full suite green.

Enrolling ace applied `adoption.opening-tcp-5671-incoming` to it — a from-anywhere (v4+v6) opening for 5671 where nothing on ace listens (the ace session caught it). The foundation opening exists to *widen* the broker's `from: mesh` listen to from-anywhere, because a machine enrolling isn't on the mesh yet and its first dial would be refused mesh-only — but that belongs on the broker's host alone; a node that only dials out needs no incoming rule. `foundationPortsFor` keeps the port only when a module resolved onto this node listens on it. Two tests (broker host keeps it; a dial-only node gets nothing); full suite green.

jschoubben added 1 commit 2026-09-26 20:20:19 +00:00

The broker opening is only on the broker's host, not every node 48d8c89749

Enrolling ace applied adoption.opening-tcp-5671-incoming to it, opening
5671 from anywhere (v4+v6) where nothing listens — the ace session
caught it. foundation ports widen the broker's from:mesh port to
from-anywhere so a machine that is not yet on the mesh can make its
first dial; that belongs on the broker's host alone. foundationPortsFor
keeps the port only when a module resolved onto this node listens on
it, so novox opens 5671 and a node that merely dials out opens nothing.
Two tests, both directions.

jschoubben merged commit d2ab0b2b82 into main

2026-09-26 20:20:51 +00:00

jschoubben deleted branch fix/foundation-opening-only-on-the-broker-host

2026-09-26 20:20:51 +00:00

jschoubben referenced this issue from a commit

2026-09-26 21:32:32 +00:00

An empty declaration is sent, so a node drops what it last held (hq 127)

jschoubben referenced this pull request

2026-09-26 21:32:37 +00:00

An empty declaration is sent, so a node drops what it last held (hq 127) #77

Sign in to join this conversation.