From 836ff035749010cf9460f2da2c0dfe0a474ec619 Mon Sep 17 00:00:00 2001 From: Dorian Date: Thu, 23 Jul 2026 23:51:24 +0100 Subject: [PATCH] =?UTF-8?q?docs(handoff):=20app=20direct=20ports=20are=20I?= =?UTF-8?q?Pv4-only=20over=20the=20mesh=20=E2=80=94=20node-side=20task?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Co-Authored-By: Claude Fable 5 --- ...HANDOFF-2026-07-23-companion-apk-deploy.md | 26 +++++++++++++++++++ 1 file changed, 26 insertions(+) diff --git a/docs/HANDOFF-2026-07-23-companion-apk-deploy.md b/docs/HANDOFF-2026-07-23-companion-apk-deploy.md index 7f290b92..108a59e0 100644 --- a/docs/HANDOFF-2026-07-23-companion-apk-deploy.md +++ b/docs/HANDOFF-2026-07-23-companion-apk-deploy.md @@ -142,3 +142,29 @@ Chain of findings, each verified live: slow, it's failing outright. The private-tree option (detach fleet from the public v0l mesh, root at vps2) looks like the real fix; app-side patience only helps once discovery succeeds at all. + +## NEXT (00:00, Mac agent → dev-box agent): app ports are IPv4-only over the mesh + +The kiosk now loads over the ULA — but opening any APP dies with +`ERR_CONNECTION_REFUSED` on `http://[]:/` (user-verified with +:8334, and it will be every app). Cause is the same class as the :80 nginx +bug you fixed: the web UI builds app URLs from the current host + the app's +DIRECT port (Direct Port Rule), so over the mesh that's `[ULA]:8334` — but +container-published ports only bind 0.0.0.0 (verified: `192.168.63.249:8334` +→ HTTP 200, ULA:8334 → refused). + +Fix needs to cover EVERY catalog app port and survive app install/remove. +Two shapes; pick what fits the container layer best: + +1. **IPv6 publish at the container layer** — publish ports on `[::]` too + (pasta/rootless podman support address-specific `-p` entries), wired into + the container manager so new apps get it automatically; or +2. **Host-side v6→v4 forwarders** — generated nginx `stream {}` (or + systemd-socket) blocks: `listen [::]:` → `127.0.0.1:`, one + per catalog app port, regenerated on app install/remove, self-healed at + boot like your :80 fix. Keeps the Direct Port Rule URL contract intact + without touching containers. + +Whichever you choose, please also extend your bootstrap self-heal to cover +it, and verify from the mesh side (curl the ULA on 2–3 app ports from vps2 +or the phone) — not just from the LAN. -- 2.47.2