Archived
jschoubben
25e42b3ad6
The broker's amqps port is opened from anywhere so a node can enrol before it has an overlay address — but only in the input chain. The broker is a published container port, so a cross-node dial is DNAT'd and forwarded, never reaching input; it survived on the first connection's conntrack entry and no more. Adopting the foundation's own broker restarts it, dropping that entry, after which a joined node could never receive another declaration. The forward chain now carries the foundation ports too, from anywhere, matching their input rule. Intermittent in the built-store-cross-node bed: it passed whenever the broker did not happen to restart after the joined node first connected.