# REPORT — S3.1: offsite-tunnel client MTU 1420 → 1280 (v0.65.0) **Date:** 2026-07-04 · **Class:** implementation + live validation on felhom-pve (the expendable demo box; Peti's box untouched; endpoint untouched by construction). **Design of record:** `felhom.eu/documentation/architecture/06-offsite-connectivity.md` §4.3 (OPEN DECISION → resolved). ## 1. Baselines & commits Start: felhom-agent @ `03edb40` (v0.64.0); felhom.eu @ `2028785` (docs). Commits pushed to `main`: - **`312fd5e`** — `wgtunnel: client MTU 1420 → 1280` (manager.go const + render, manager_test.go golden + red-proof note, report.go stale comment, CHANGELOG v0.65.0). - **``** — CONTEXT + this REPORT. - felhom.eu docs (§4.3 decision + §4.2/§4.3 wording + S6 row): separate one commit — see felhom.eu REPORT. ## 2. What changed & why The 2026-07-04 CGNAT smoke test found the shipped interface MTU **1420** silently **black-holes bulk TCP** on any path below ~1480 B (mobile ~1400, DS-Lite ~1452): the WG handshake and ping stay healthy (small packets) while the PBS TLS page — and, at S4, the backup itself — drops. Resolved `§4.3`'s OPEN DECISION with a **permanent, fleet-wide, family-agnostic client MTU of 1280** (RFC 8200 IPv6-minimum link MTU; outer = 1280+60 v4 / +80 v6, fits every realistic path). - `internal/wgtunnel/manager.go`: new `const clientMTU = 1280` (single home, doc-referenced); `renderConf` emits `MTU = %d` from it. - **Client-only by construction:** interface MTU caps box→PBS; advertised MSS (=MTU−40) caps PBS→box. The endpoint's `wg0` is **untouched** → zero live-endpoint risk, one constant changed. - Rejected (recorded in §4.3): auto-probe / per-connection-type (fragile moving part for a non-metric); MSS-clamp (no forwarded flows). No wire/JSON-golden change (MTU is client-derived). ## 3. Tests — render golden + red-proof (§10) - `go build ./... && go vet ./... && go test ./...` — **all green** (local Go 1.26). - `TestRenderConf_Golden` pins the exact bytes incl. `MTU = 1280` (not a "contains MTU" check). - **Red-proof:** flipped `const clientMTU` → 1420 → the golden **FAILED** on the MTU line (`got MTU = 1420 / want MTU = 1280`); restored to 1280 → **PASS**. The assertion is non-vacuous. ## 4. Deploy + live wired smoke (§13) — felhom-pve, agent v0.65.0 Built `-X main.version=0.65.0` on 180; deployed with `felhom-agent.bak-0.64.0` backup; `--version` confirms **0.65.0**. Agent re-rendered + re-applied the conf on restart (hash-gated apply caught the MTU change): 1. **Rendered MTU:** `grep MTU /etc/wireguard/wg-felhom.conf` → `MTU = 1280`; live iface `ip link show wg-felhom` → `mtu 1280`. ✅ 2. **Tunnel:** `wg-quick@wg-felhom` active; handshake age 43 s; `ping 10.77.0.1` 3/3, ~33 ms. ✅ 3. **PBS page (no regression on the good path):** `curl -sk https://10.77.0.1:8007/` → full `…` login page at MTU 1280. ✅ 4. Journal clean — no capability degradation, no errors. Scenario B (no regression at 1280 on the working wired path) **proven live**. The constrained-path fix itself is established by arithmetic + prior field data (1280 < the 1340 that already worked in the smoke test; 1420 was the value that failed) — the optional phone re-tether re-proof was **not run** (not required per §13; skippable). ## 5. Not yet live-validated / open - **True-CGNAT-SIM retest** — low risk, deferred ("when able"); the smoke SIM had a public mobile IPv4, so 100.64/10 double-NAT was not reproduced (unchanged by this task). - **PBS backup over the tunnel (S4)** — the next slice; this fix makes its bulk-TCP floor safe. - **Optional constrained-path re-proof** (phone tether at MTU 1280) — skipped; available if extra confidence wanted. ## 6. Observations - The v4-pin (agent resolves ep0's A record + writes the literal, per §4.2's watchdog) is a reasonable **later determinism** improvement but is **not needed for MTU correctness** — 1280 is safe on both families' overhead. Recorded in the doc as a separate future note; green-lightable independently whenever the re-resolve watchdog work happens. - ~~OPERATOR follow-up: publish 0.65.0 + Day-0 vouch~~ **DONE same day (operator-assisted browser session):** 0.65.0 published to Gitea (`publish-agent.sh` on felhom-pve with the out-of-band `/root/.golden-secrets.env` creds; sha256 `ae282669…78d0a73`, round-trip verified) and the hub Day-0 manifest vouched **agent 0.65.0 + golden 0.98.3** via the `/configuration` UI in the user's logged-in Chrome session (flash `artifacts_set` + reload-persist verified). `/offsite` page eyeballed OK (endpoint + the one demo peer); Hosts page reports demo-felhom-01 agent 0.65.0 ONLINE. Rollback artifact on the box: `felhom-agent.bak-0.64.0`.