admin/felhom-agent
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
734f45c422bcc58cc35b382527f24cbbaa9c47a3
felhom-agent/REPORT.md
T
admin c618fc69f7 docs(REPORT): publish + Day-0 vouch of 0.65.0 completed (operator-assisted) 
Gitea publish sha256 ae282669… round-trip verified; hub manifest now vouches
agent 0.65.0 + golden 0.98.3 (flash + reload-persist verified); /offsite +
Hosts pages eyeballed (0.65.0 ONLINE).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6
2026-07-04 14:15:10 +02:00

4.7 KiB
Raw Blame History

REPORT — S3.1: offsite-tunnel client MTU 1420 → 1280 (v0.65.0)

Date: 2026-07-04 · Class: implementation + live validation on felhom-pve (the expendable demo box; Peti's box untouched; endpoint untouched by construction). Design of record: felhom.eu/documentation/architecture/06-offsite-connectivity.md §4.3 (OPEN DECISION → resolved).

1. Baselines & commits

Start: felhom-agent @ 03edb40 (v0.64.0); felhom.eu @ 2028785 (docs). Commits pushed to main:

  • 312fd5e — wgtunnel: client MTU 1420 → 1280 (manager.go const + render, manager_test.go golden + red-proof note, report.go stale comment, CHANGELOG v0.65.0).
  • <this commit> — CONTEXT + this REPORT.
  • felhom.eu docs (§4.3 decision + §4.2/§4.3 wording + S6 row): separate one commit — see felhom.eu REPORT.

2. What changed & why

The 2026-07-04 CGNAT smoke test found the shipped interface MTU 1420 silently black-holes bulk TCP on any path below ~1480 B (mobile ~1400, DS-Lite ~1452): the WG handshake and ping stay healthy (small packets) while the PBS TLS page — and, at S4, the backup itself — drops. Resolved §4.3's OPEN DECISION with a permanent, fleet-wide, family-agnostic client MTU of 1280 (RFC 8200 IPv6-minimum link MTU; outer = 1280+60 v4 / +80 v6, fits every realistic path).

  • internal/wgtunnel/manager.go: new const clientMTU = 1280 (single home, doc-referenced); renderConf emits MTU = %d from it.
  • Client-only by construction: interface MTU caps box→PBS; advertised MSS (=MTU−40) caps PBS→box. The endpoint's wg0 is untouched → zero live-endpoint risk, one constant changed.
  • Rejected (recorded in §4.3): auto-probe / per-connection-type (fragile moving part for a non-metric); MSS-clamp (no forwarded flows). No wire/JSON-golden change (MTU is client-derived).

3. Tests — render golden + red-proof (§10)

  • go build ./... && go vet ./... && go test ./... — all green (local Go 1.26).
  • TestRenderConf_Golden pins the exact bytes incl. MTU = 1280 (not a "contains MTU" check).
  • Red-proof: flipped const clientMTU → 1420 → the golden FAILED on the MTU line (got MTU = 1420 / want MTU = 1280); restored to 1280 → PASS. The assertion is non-vacuous.

4. Deploy + live wired smoke (§13) — felhom-pve, agent v0.65.0

Built -X main.version=0.65.0 on 180; deployed with felhom-agent.bak-0.64.0 backup; --version confirms 0.65.0. Agent re-rendered + re-applied the conf on restart (hash-gated apply caught the MTU change):

  1. Rendered MTU: grep MTU /etc/wireguard/wg-felhom.conf → MTU = 1280; live iface ip link show wg-felhom → mtu 1280. ✅
  2. Tunnel: wg-quick@wg-felhom active; handshake age 43 s; ping 10.77.0.1 3/3, ~33 ms. ✅
  3. PBS page (no regression on the good path): curl -sk https://10.77.0.1:8007/ → full <!DOCTYPE html>… login page at MTU 1280. ✅
  4. Journal clean — no capability degradation, no errors.

Scenario B (no regression at 1280 on the working wired path) proven live. The constrained-path fix itself is established by arithmetic + prior field data (1280 < the 1340 that already worked in the smoke test; 1420 was the value that failed) — the optional phone re-tether re-proof was not run (not required per §13; skippable).

5. Not yet live-validated / open

  • True-CGNAT-SIM retest — low risk, deferred ("when able"); the smoke SIM had a public mobile IPv4, so 100.64/10 double-NAT was not reproduced (unchanged by this task).
  • PBS backup over the tunnel (S4) — the next slice; this fix makes its bulk-TCP floor safe.
  • Optional constrained-path re-proof (phone tether at MTU 1280) — skipped; available if extra confidence wanted.

6. Observations

  • The v4-pin (agent resolves ep0's A record + writes the literal, per §4.2's watchdog) is a reasonable later determinism improvement but is not needed for MTU correctness — 1280 is safe on both families' overhead. Recorded in the doc as a separate future note; green-lightable independently whenever the re-resolve watchdog work happens.
  • OPERATOR follow-up: publish 0.65.0 + Day-0 vouch DONE same day (operator-assisted browser session): 0.65.0 published to Gitea (publish-agent.sh on felhom-pve with the out-of-band /root/.golden-secrets.env creds; sha256 ae282669…78d0a73, round-trip verified) and the hub Day-0 manifest vouched agent 0.65.0 + golden 0.98.3 via the /configuration UI in the user's logged-in Chrome session (flash artifacts_set + reload-persist verified). /offsite page eyeballed OK (endpoint + the one demo peer); Hosts page reports demo-felhom-01 agent 0.65.0 ONLINE. Rollback artifact on the box: felhom-agent.bak-0.64.0.
Reference in New Issue View Git Blame Copy Permalink