admin
c618fc69f7
Gitea publish sha256 ae282669… round-trip verified; hub manifest now vouches agent 0.65.0 + golden 0.98.3 (flash + reload-persist verified); /offsite + Hosts pages eyeballed (0.65.0 ONLINE). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6
77 lines
4.7 KiB
Markdown
77 lines
4.7 KiB
Markdown
# REPORT — S3.1: offsite-tunnel client MTU 1420 → 1280 (v0.65.0)
|
||
|
||
**Date:** 2026-07-04 · **Class:** implementation + live validation on felhom-pve (the expendable
|
||
demo box; Peti's box untouched; endpoint untouched by construction). **Design of record:**
|
||
`felhom.eu/documentation/architecture/06-offsite-connectivity.md` §4.3 (OPEN DECISION → resolved).
|
||
|
||
## 1. Baselines & commits
|
||
|
||
Start: felhom-agent @ `03edb40` (v0.64.0); felhom.eu @ `2028785` (docs). Commits pushed to `main`:
|
||
|
||
- **`312fd5e`** — `wgtunnel: client MTU 1420 → 1280` (manager.go const + render, manager_test.go
|
||
golden + red-proof note, report.go stale comment, CHANGELOG v0.65.0).
|
||
- **`<this commit>`** — CONTEXT + this REPORT.
|
||
- felhom.eu docs (§4.3 decision + §4.2/§4.3 wording + S6 row): separate one commit — see felhom.eu REPORT.
|
||
|
||
## 2. What changed & why
|
||
|
||
The 2026-07-04 CGNAT smoke test found the shipped interface MTU **1420** silently **black-holes
|
||
bulk TCP** on any path below ~1480 B (mobile ~1400, DS-Lite ~1452): the WG handshake and ping stay
|
||
healthy (small packets) while the PBS TLS page — and, at S4, the backup itself — drops. Resolved
|
||
`§4.3`'s OPEN DECISION with a **permanent, fleet-wide, family-agnostic client MTU of 1280** (RFC
|
||
8200 IPv6-minimum link MTU; outer = 1280+60 v4 / +80 v6, fits every realistic path).
|
||
|
||
- `internal/wgtunnel/manager.go`: new `const clientMTU = 1280` (single home, doc-referenced);
|
||
`renderConf` emits `MTU = %d` from it.
|
||
- **Client-only by construction:** interface MTU caps box→PBS; advertised MSS (=MTU−40) caps
|
||
PBS→box. The endpoint's `wg0` is **untouched** → zero live-endpoint risk, one constant changed.
|
||
- Rejected (recorded in §4.3): auto-probe / per-connection-type (fragile moving part for a
|
||
non-metric); MSS-clamp (no forwarded flows). No wire/JSON-golden change (MTU is client-derived).
|
||
|
||
## 3. Tests — render golden + red-proof (§10)
|
||
|
||
- `go build ./... && go vet ./... && go test ./...` — **all green** (local Go 1.26).
|
||
- `TestRenderConf_Golden` pins the exact bytes incl. `MTU = 1280` (not a "contains MTU" check).
|
||
- **Red-proof:** flipped `const clientMTU` → 1420 → the golden **FAILED** on the MTU line
|
||
(`got MTU = 1420 / want MTU = 1280`); restored to 1280 → **PASS**. The assertion is non-vacuous.
|
||
|
||
## 4. Deploy + live wired smoke (§13) — felhom-pve, agent v0.65.0
|
||
|
||
Built `-X main.version=0.65.0` on 180; deployed with `felhom-agent.bak-0.64.0` backup; `--version`
|
||
confirms **0.65.0**. Agent re-rendered + re-applied the conf on restart (hash-gated apply caught
|
||
the MTU change):
|
||
|
||
1. **Rendered MTU:** `grep MTU /etc/wireguard/wg-felhom.conf` → `MTU = 1280`; live iface
|
||
`ip link show wg-felhom` → `mtu 1280`. ✅
|
||
2. **Tunnel:** `wg-quick@wg-felhom` active; handshake age 43 s; `ping 10.77.0.1` 3/3, ~33 ms. ✅
|
||
3. **PBS page (no regression on the good path):** `curl -sk https://10.77.0.1:8007/` → full
|
||
`<!DOCTYPE html>…` login page at MTU 1280. ✅
|
||
4. Journal clean — no capability degradation, no errors.
|
||
|
||
Scenario B (no regression at 1280 on the working wired path) **proven live**. The constrained-path
|
||
fix itself is established by arithmetic + prior field data (1280 < the 1340 that already worked in
|
||
the smoke test; 1420 was the value that failed) — the optional phone re-tether re-proof was **not
|
||
run** (not required per §13; skippable).
|
||
|
||
## 5. Not yet live-validated / open
|
||
|
||
- **True-CGNAT-SIM retest** — low risk, deferred ("when able"); the smoke SIM had a public mobile
|
||
IPv4, so 100.64/10 double-NAT was not reproduced (unchanged by this task).
|
||
- **PBS backup over the tunnel (S4)** — the next slice; this fix makes its bulk-TCP floor safe.
|
||
- **Optional constrained-path re-proof** (phone tether at MTU 1280) — skipped; available if extra
|
||
confidence wanted.
|
||
|
||
## 6. Observations
|
||
|
||
- The v4-pin (agent resolves ep0's A record + writes the literal, per §4.2's watchdog) is a
|
||
reasonable **later determinism** improvement but is **not needed for MTU correctness** — 1280 is
|
||
safe on both families' overhead. Recorded in the doc as a separate future note; green-lightable
|
||
independently whenever the re-resolve watchdog work happens.
|
||
- ~~OPERATOR follow-up: publish 0.65.0 + Day-0 vouch~~ **DONE same day (operator-assisted browser
|
||
session):** 0.65.0 published to Gitea (`publish-agent.sh` on felhom-pve with the out-of-band
|
||
`/root/.golden-secrets.env` creds; sha256 `ae282669…78d0a73`, round-trip verified) and the hub
|
||
Day-0 manifest vouched **agent 0.65.0 + golden 0.98.3** via the `/configuration` UI in the
|
||
user's logged-in Chrome session (flash `artifacts_set` + reload-persist verified). `/offsite`
|
||
page eyeballed OK (endpoint + the one demo peer); Hosts page reports demo-felhom-01 agent
|
||
0.65.0 ONLINE. Rollback artifact on the box: `felhom-agent.bak-0.64.0`.
|