dank/serverAppConfigs
1
0
Fork 0
Code Issues 6 Pull Requests Actions Packages Projects Releases Wiki Activity

relay: bind the host LAN IP, admit the podman bridge subnet only

Browse Source 
169.254.1.2 is not a local address on this host (netavark runs its
bridges in aardvark-dns' netns), so the relay cannot bind it — and a
loopback bind refuses container traffic. Probe-socket proof: a host
socket on 192.168.0.143:18094 answers the container's 169.254.1.2:18094
dial while the LAN IP refuses from the container. The relay binds
192.168.0.143:18093 and the deployer installs an iptables INPUT pair
(ACCEPT 10.89.0.0/16, DROP rest) so the unauthenticated endpoint stays
off the LAN.
This commit is contained in:
Frank
2026-09-17 13:52:20 -07:00
parent 8f747a2104
commit f73fd43027
9 changed files with 52 additions and 33 deletions
Download Patch File Download Diff File Expand all files Collapse all files
dankclaw/observability/quadlet/prometheus.container
+2 -2
View File
@@ -29,8 +29,8 @@
# /etc/prometheus/rules/ (installed from shared/prometheus/rules/ by the
# deployer). Delivery went live 2026-09-17: the alerting block in
# prometheus.yml points at alertmanager:9093, which webhooks every firing
# group to the host-side Signal relay (169.254.1.2:18093, the
# host.containers.internal endpoint), which sends through signal-cli account 318311.
# group to the host-side Signal relay (192.168.0.143:18093, reached from
# the container as host.containers.internal), which sends through signal-cli account 318311.
# The Grafana dashboard's ALERTS panel remains the second surface.
#
# The config volume is also why rules belong in git: editing them in the UI is