Repository navigation
fix(pm-stack): align ready-for-agent bind scope to loopback + tailnet (#1181) - #4657
Conversation
…#1181) The app ran with bare --host (0.0.0.0:6056, every interface incl. any future WAN-facing one) while Grist, Pad and the aggregator bind loopback + tailnet only. Upstream --host takes a single address, so: the app drops --host and keeps its loopback default, and the Nix module (the live source — the running unit is home-manager generated) adds a socket-activated systemd-socket-proxyd unit listening on the tailnet address and forwarding to 127.0.0.1:6056. Standalone unit file kept in sync (loopback-only there), aggregator topology string and README row updated. Deploy = merge + nixos-rebuild from the primary; verify with ss (6056 on 127.0.0.1 + tailnet only) and the aggregator health probe.
|
Warning Review limit reachedYou've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Next included review available in 6 minutes. View limit details
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. CodeRabbit Verify
|
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 5ec2fc6ddc
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| }; | ||
|
|
||
| Service = { | ||
| ExecStart = "/run/current-system/sw/bin/systemd-socket-proxyd 127.0.0.1:6056"; |
There was a problem hiding this comment.
On the NixOS deployment, this points into the system profile's bin directory, but systemd-socket-proxyd is installed as a helper under lib/systemd, not bin; a repo-wide search found no wrapper or symlink exposing it at this path. Consequently, incoming tailnet connections activate a service that fails to execute, while the app now accepts only loopback connections, removing remote access. Reference ${config.systemd.package}/lib/systemd/systemd-socket-proxyd instead. The upstream service example likewise uses ExecStart=/usr/lib/systemd/systemd-socket-proxyd.
Useful? React with 👍 / 👎.
| Socket = { | ||
| ListenStream = "${cfg.tailnetAddress}:6056"; | ||
| }; |
There was a problem hiding this comment.
If the lingering user manager starts before Tailscale assigns cfg.tailnetAddress at boot, this socket fails with EADDRNOTAVAIL. It is enabled through the user's sockets.target, with neither address-readiness ordering nor a retry mechanism, so the later appearance of the tailnet address does not restore remote access without restarting the socket. Set FreeBind = true so the listener can be established before the address exists; the systemd socket documentation states that this option defaults to false and recommends it when binding a specific IP address.
Useful? React with 👍 / 👎.
Closes the bind-scope half of #1181 (issue stays open until the deploy verification below lands).
Problem (verified by triage task 2470, 2026-11-02)
ready-for-agent listened on
0.0.0.0:6056(livessprobe) while Grist (8484), Pad (7777) and the aggregator (4870) bind loopback + the host tailnet address only. The all-interfaces bind also claims any future WAN-facing interface — broader than the stack's settled access model (loopback + tailnet; public only behind a password).Fix
Upstream
ready-for-agent start --host <addr>binds a single address, so loopback+tailnet needs a forward for one of them:nixos/services/pm-apps/default.nix(the live source — the running unit is home-manager generated from this module): the app drops bare--hostand keeps upstream's loopback default; a new socket-activatedready-for-agent-tailnetunit runssystemd-socket-proxydon${tailnetAddress}:6056→127.0.0.1:6056— the same scope Grist/Pad get from dual port publishes.pm-stack/ready-for-agent/systemd/ready-for-agent.service: kept in sync (loopback bind; header explains the tailnet proxy lives in the Nix module; a standalone install is loopback-only).pm-stack/aggregator/src/topology.ts+pm-stack/README.md: bind rows now state loopback + tailnet (the topology row's "(bind scope tracked in fix(pm-stack): ready-for-agent binds 0.0.0.0:6056 while the rest of the stack binds loopback+tailnet - align bind scopes #1181)" marker is resolved).Verification done
nix-instantiate --parseon the module: OK.bun test test/topology.test.ts— 2 pass.http://127.0.0.1:6056; browser service-links use the tailnet host — both preserved. No LAN-address consumer exists in the repo.Deploy / remaining verification (post-merge)
Rebuild from the laptop primary (
nixos-rebuild switch), then confirm:ssshows 6056 on127.0.0.1+ the tailnet address only, the UI answers on both, and the aggregator health probe for ready-for-agent stays green. Task 6555 tracks this in the queue result.Queue: task 6555 (repo-health-code-pilot), follow-up to triage task 2470.
Open in [code]smith · Need help on this PR? Tag
@codesmith-botwith what you need.