dank/serverAppConfigs
1
0
Fork 0
Code Issues 6 Pull Requests Actions Packages Projects Releases Wiki Activity

relay: bind 169.254.1.2 (host.containers.internal), not loopback

Browse Source 
A socket bound to 127.0.0.1 refuses container traffic that arrives via
the podman bridge: the first live webhook failed with 'dial tcp
169.254.1.2:18093: connection refused'. The relay now binds the
host-gateway endpoint — link-local to the podman bridge, off the LAN —
and the deployer's health probe follows it there.
This commit is contained in:
Frank
2026-09-17 13:26:24 -07:00
parent 5f55efcb9d
commit 8f747a2104
9 changed files with 31 additions and 21 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/observability_quadlet.bats
+6 -4
View File
@@ -461,16 +461,18 @@ assert any('ALERTS' in e for e in exprs), exprs
grep -q 'install_signal_relay' <(sed -n '/^deploy_observability()/,/^}/p' "$handler")
}
@test "the relay sends through the existing signal-cli account, loopback only" {
@test "the relay sends through the existing signal-cli account, podman-bridge only" {
# The credential is the account state under ~/.local/share/signal-cli;
# the number and account name are numbers, not secrets. The listener must
# stay on loopback — an unauthenticated message-sending endpoint on a
# host interface is the failure this whole unit family exists to avoid.
# bind 169.254.1.2 (host.containers.internal): a loopback bind refuses
# container traffic (measured 2026-09-17), and a host-interface bind
# would put an unauthenticated message-sending endpoint on the LAN —
# the failure this whole unit family exists to avoid.
local relay="$REPO_ROOT/scripts/signal-relay.py"
grep -q 'signal-cli' "$relay"
grep -q 'SIGNAL_CLI = "/usr/local/bin/signal-cli"' "$relay"
grep -q 'SIGNAL_ACCOUNT = "318311"' "$relay"
grep -q 'LISTEN_ADDR = ("127.0.0.1", 18093)' "$relay"
grep -q 'LISTEN_ADDR = ("169.254.1.2", 18093)' "$relay"
}
@test "the planner selects alertmanager for its config and relay files" {