felhom.eu/REPORT.md

felhom.eu — task reports

Overwrite this file with a summary of the most recent task only (uniform with the other repos; not cumulative). The cumulative hub history lives in hub/CHANGELOG.md; the scripts history lives in scripts/CHANGELOG.md.

SPIKE — immediate-sync transport (hub→box "sync now") — 2026-07-16

Docs-only spike. No production code, no image, no manifest change. Every live mutation on the demo arc was inventoried and reverted; the arc was re-verified green. Findings doc: documentation/audits/SPIKE-immediate-sync-transport-2026-07-16.md. Baselines re-confirmed at session start: felhom.eu a50822af v0.57.0 · felhom-agent c040c180 v0.88.0 · felhom-controller 8f3564c1 v0.138.0.

Question

Viktor's ruling: a user-triggered config change must round-trip in seconds, not the 15-min report cycle. Measure the two candidate "sync now" transports empirically before any Task-2 spec.

Verdict — both GO, and complementary (not competing)

• (b) long-poll — recommended primary for user config. A hanging GET the hub completes on change. Reaches the controller (the config puller) with a hub-only change, no ep0 coupling, no WG dependency, no agent train. Binding ceiling today = 60 s, from TWO places measured/sourced: nginx proxy_read_timeout 60 s (proven from the upstream-timeout log line; ingress-nginx's default single retry pushes the client-visible 504 to ~120 s) and the hub's in-code http.Server{WriteTimeout: 60s} (hub/cmd/hub/main.go:339-341). Both are config lifts.
• (a) ep0-relayed poke — reserved as the agent-plane nudge. Hub → forced-command on ep0 → ep0 originates a contentless UDP datagram → box. Reaches the agent (WG terminates host-side), ~0.42 s per fresh SSH session (~0.40 s of that is SSH setup; a pooled session → ~27 ms + 18 ms). Needs zero infra change on ep0 or the box and is cryptographically confined to registered peers — but needs an agent train (UDP listener → heartbeat trigger).
• Interval shortening stays REJECTED (fleet-wide continuous load, no true immediacy).

Evidence highlights

• Viktor's Q2: hub.felhom.eu is DNS-only (CNAME → dooplex.hopto.org → the operator home line 37.191.56.193), no Cloudflare; split-horizon to the nginx-internal LB 192.168.0.192 on-LAN. Real chain: client → operator home-NAT → nginx-internal → hub pod.
• P1 ep0→box origination works with ip_forward and the forward chain untouched (endpoint- originated traffic never transits the forward chain); ~29 ms last hop; negative proven at the kernel crypto layer (EKEYREJECTED to an unregistered /32).
• P2 5/5 pokes delivered end-to-end; the hub image is Alpine (no ssh/bash/python) → a production poke must reuse the in-process x/crypto/ssh client (the wgsync pattern); a lost poke is harmless by construction.
• P3 tuned ingress holds cleanly to 600 s on-LAN, and the operator home NAT holds an idle held connection the full 600 s — so the NAT is not the constraint (≤10 min); only the twin 60 s config limits are.

Ground-truth drift caught since the 07-05 OOB spike (recorded as findings)

• ep0 ip_forward is now 1 (was 0) — the OOB operator-peer feature has shipped; a second real box (10.77.0.3) is now on the arc (untouched).
• The operator /32 (10.77.0.250) is now durably rendered into the box's wg-felhom conf — the 07-05 finding-1 gap is closed.
• Cleanup bar was set to the live baseline (ip_forward=1, root ak = 2), not the plan's stale "must be 0" assumption.

Cleanup (verified)

ep0 forced-command line removed (root ak 2→2, 0 spike lines), poke script shredded, ip_forward still 1, forward chain empty; k8s sleeper (deploy/svc/ingress/cm) deleted; throwaway keypair shredded; box nft empty, no listeners, no temp files. Arc green: tunnel live (felhom-offsite active), guest 9201 controller healthy, hub pod 1/1, reconciler still pushing 3 peers.