feat(mesh): app direct ports reachable over the mesh — IPv4 listeners mirrored onto [::] · 2ad57c63f1 - archy

lfg2025/archy

feat(mesh): app direct ports reachable over the mesh — IPv4 listeners mirrored onto [::]

The companion reaches the node at its fips0 ULA, and the web UI builds app
links as http://[<ULA>]:<direct port> — but rootless-podman published ports
bind 0.0.0.0 only, so every app URL was refused over the mesh (:8334 first).
A reconcile loop in the backend mirrors public IPv4 listeners: any port
>=1024 on 0.0.0.0 without an IPv6 any-listener gets a v6-ONLY [::] forwarder
to 127.0.0.1, following /proc/net/tcp* so install/remove and hardcoded
companion ports are covered without touching a single container. Purely
additive: IPv4/LAN/Tor access paths are untouched, v6only listeners cannot
collide with or intercept v4 traffic, and foreign IPv6 listeners win.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

This commit is contained in:

archipelago

2026-07-23 19:09:14 -04:00

co-authored by

Claude Fable 5

parent 6c48de20e3

commit 2ad57c63f1

4 changed files with 154 additions and 0 deletions

core/Cargo.lock

Generated

View File

@@ -145,6 +145,7 @@ dependencies = [
  "serde_yaml",
  "serial2-tokio",
  "sha2 0.10.9",
  "socket2 0.5.10",
  "tar",
  "tempfile",
  "thiserror 1.0.69",