Land lan-hosts role: LAN-pin kai-server to dodge the flaky tailnet path #267

New issue

Closed

opened 2026-06-07 18:54:11 +00:00 by coilysiren · 1 comment

coilysiren commented

2026-06-07 18:54:11 +00:00

Owner

Mac-side workaround for the flaky tailnet path to kai-server. See o2r channel HDBF; relates to #251.

What landed

ansible/roles/lan-hosts (commit 2076d52 on fix/tap-writer-workingdir): pins fleet hostnames to their LAN IPs in /etc/hosts via a managed blockinfile, gated on being on the home /24 so a freshen off-LAN self-cleans. Wired into freshen.yml (tags lan-hosts, hosts).

Inert by default

lan_hosts_enabled defaults to false. The role writes nothing until it is flipped, pending the decision below.

Decision pending

/etc/hosts pin (current impl) vs an ssh-config kai-server-lan alias. The /etc/hosts approach is wrong off-LAN and only self-cleans on a freshen run while travelling. The ssh-alias is safer for a roaming laptop.

Why (debug findings, captured through the o2r ansible-debug repo)

tailscale ping kai-server is DIRECT over link-local en0, yet TCP :22 over the tailnet IP times out intermittently while :22 on the LAN IP is reliably open. The fault is the tailnet WireGuard TCP path, not on-box sshd.
nc to the public WAN :443 from the Mac succeeds, so cross-host hairpin works. The Archer A20's broken hairpin is the same-host loopback case (the cert-manager self-check), not this path.

Mac-side workaround for the flaky tailnet path to kai-server. See o2r channel HDBF; relates to #251. ## What landed `ansible/roles/lan-hosts` (commit 2076d52 on `fix/tap-writer-workingdir`): pins fleet hostnames to their LAN IPs in /etc/hosts via a managed `blockinfile`, gated on being on the home /24 so a freshen off-LAN self-cleans. Wired into `freshen.yml` (tags `lan-hosts`, `hosts`). ## Inert by default `lan_hosts_enabled` defaults to `false`. The role writes nothing until it is flipped, pending the decision below. ## Decision pending - **/etc/hosts pin** (current impl) vs an **ssh-config `kai-server-lan` alias**. The /etc/hosts approach is wrong off-LAN and only self-cleans on a freshen run while travelling. The ssh-alias is safer for a roaming laptop. ## Why (debug findings, captured through the o2r ansible-debug repo) - `tailscale ping kai-server` is DIRECT over link-local en0, yet TCP :22 over the tailnet IP times out intermittently while :22 on the LAN IP is reliably open. The fault is the tailnet WireGuard TCP path, not on-box sshd. - `nc` to the public WAN :443 from the Mac succeeds, so cross-host hairpin works. The Archer A20's broken hairpin is the same-host loopback case (the cert-manager self-check), not this path.

coilysiren commented

2026-06-07 18:54:51 +00:00

Author

Owner

Duplicate of #266 (double POST). Closing.

coilysiren closed this issue

2026-06-07 18:54:52 +00:00