mac-proxy: name the shared ward-tailnet docker network for carry reach #402

New issue

Closed

opened 2026-06-25 21:55:39 +00:00 by coilysiren · 2 comments

coilysiren commented

2026-06-25 21:55:39 +00:00

Owner

What

Give the standing mac-proxy SOCKS5 box a stable, explicitly-named docker network so other containers (ward agent carries) can attach to it and dial it by name. Part of the standing-shared-proxy design in agentic-os#291.

Why

ward carries on Docker Desktop cannot reach the tailnet-only Ollama tower. mac-proxy already runs as a restart: unless-stopped userspace tailscale SOCKS5 box inside the same LinuxKit VM/daemon as the carries, already listening on 0.0.0.0:1055. A carry only needs to share a user-defined docker network with it to resolve mac-proxy by name (the default bridge does no name resolution). Compose already stands up a user-defined network for this stack - this issue just pins its name so ward can attach deterministically.

Change

In ansible/roles/mac-proxy/files/compose.yaml:

Declare a network with a fixed docker name (not the compose-prefixed default) and attach the tailscale service to it:

services:
  tailscale:
    # ...unchanged...
    networks: [ ward-tailnet ]
networks:
  ward-tailnet:
    name: ward-tailnet      # literal docker network name, not <project>_ward-tailnet

Keep everything else as-is: restart: unless-stopped, the 127.0.0.1:1055:1055 host publish (Mac-host tools keep using that), 0.0.0.0:1055 listener, tag:proxy key from SSM.

In ansible/roles/mac-proxy/tasks/main.yml:

No structural change required - docker compose up -d creates the named network. If the role does an explicit readiness check, optionally assert the ward-tailnet network exists after converge.

Out of scope / contract

The network name ward-tailnet is the shared contract with the ward side (the carry attaches with --network ward-tailnet and dials socks5h://mac-proxy:1055). Do not rename it without updating coilyco-flight-deck/ward. Tracked under agentic-os#291.
No ACL or key changes: tag:proxy -> kai-tower-3026:11434 is already merged/applied (infrastructure#400), and the key already lives at /coilysiren/mac-proxy/ts-authkey.

Done when

docker network inspect ward-tailnet exists after the role converges, with the mac-proxy container attached, and host-side curl --proxy socks5h://127.0.0.1:1055 ... still works.
docs/FEATURES.md for the role notes the shared ward-tailnet network and its consumer (ward carries).

## What Give the standing `mac-proxy` SOCKS5 box a **stable, explicitly-named docker network** so other containers (ward agent carries) can attach to it and dial it by name. Part of the standing-shared-proxy design in agentic-os#291. ## Why ward carries on Docker Desktop cannot reach the tailnet-only Ollama tower. mac-proxy already runs as a `restart: unless-stopped` userspace tailscale SOCKS5 box **inside the same LinuxKit VM/daemon as the carries**, already listening on `0.0.0.0:1055`. A carry only needs to share a **user-defined** docker network with it to resolve `mac-proxy` by name (the default bridge does no name resolution). Compose already stands up a user-defined network for this stack - this issue just pins its name so ward can attach deterministically. ## Change In `ansible/roles/mac-proxy/files/compose.yaml`: - Declare a network with a **fixed docker name** (not the compose-prefixed default) and attach the `tailscale` service to it: ```yaml services: tailscale: # ...unchanged... networks: [ ward-tailnet ] networks: ward-tailnet: name: ward-tailnet # literal docker network name, not <project>_ward-tailnet ``` - Keep everything else as-is: `restart: unless-stopped`, the `127.0.0.1:1055:1055` host publish (Mac-host tools keep using that), `0.0.0.0:1055` listener, `tag:proxy` key from SSM. In `ansible/roles/mac-proxy/tasks/main.yml`: - No structural change required - `docker compose up -d` creates the named network. If the role does an explicit readiness check, optionally assert the `ward-tailnet` network exists after converge. ## Out of scope / contract - The network name `ward-tailnet` is the **shared contract** with the ward side (the carry attaches with `--network ward-tailnet` and dials `socks5h://mac-proxy:1055`). Do not rename it without updating coilyco-flight-deck/ward. Tracked under agentic-os#291. - No ACL or key changes: `tag:proxy -> kai-tower-3026:11434` is already merged/applied (infrastructure#400), and the key already lives at `/coilysiren/mac-proxy/ts-authkey`. ## Done when - `docker network inspect ward-tailnet` exists after the role converges, with the `mac-proxy` container attached, and host-side `curl --proxy socks5h://127.0.0.1:1055 ...` still works. - `docs/FEATURES.md` for the role notes the shared `ward-tailnet` network and its consumer (ward carries).

coilysiren referenced this issue from coilyco-flight-deck/agentic-os

2026-06-25 21:56:02 +00:00

agent carries: standing restart:unless-stopped SOCKS proxy box for tower reach #291

coilysiren commented

2026-06-25 21:56:12 +00:00

Author

Owner

🔒 Reserved by ward agent --driver claude — container ward-infrastructure-issue-402-claude-5d82e994 on host docker-desktop is carrying this issue (reserved 2026-06-25T21:56:12Z). Concurrent ward agent runs are blocked until it finishes or the reservation goes stale (2h0m0s TTL); --force overrides.

— Claude (she/her), via ward agent

🔒 Reserved by `ward agent --driver claude` — container `ward-infrastructure-issue-402-claude-5d82e994` on host `docker-desktop` is carrying this issue (reserved 2026-06-25T21:56:12Z). Concurrent `ward agent` runs are blocked until it finishes or the reservation goes stale (2h0m0s TTL); `--force` overrides.  — Claude (she/her), via `ward agent`

coilysiren referenced this issue from a commit

2026-06-25 21:59:14 +00:00

feat(mac-proxy): name the shared ward-tailnet docker network

coilysiren closed this issue

2026-06-25 21:59:14 +00:00

coilysiren referenced this issue from a commit

2026-06-25 21:59:14 +00:00

Merge issue-402: name the shared ward-tailnet docker network (closes #402)

coilysiren commented

2026-06-25 21:59:56 +00:00

Author

Owner

Smaller change than the title suggests, in the best way. The compose edit was three lines: a networks: [ward-tailnet] on the service plus a top-level network pinned with name: ward-tailnet so docker doesn't prefix it. I added a docker network inspect assertion to the role so a converge that silently drops the network fails loud, which felt right for a cross-repo contract.

The one thing that fought back was nothing about the proxy at all - it was the pre-commit gate. The code-comments hook rejects YAML comments below the top header block (a key-sorter would drift them), so my inline rationale next to the networks: stanza had to move up top and get trimmed under the 90-char cap. And the container was missing trufflehog and couldn't provision uv's python into the root-owned /opt/uv, so I installed trufflehog locally and pointed UV_PYTHON_INSTALL_DIR at $HOME to get pylint green. Worth flagging as a container-image rough edge, not a code one.

Confidence is high on the infra side: YAML validates, all hooks pass, CI lint + secret scan are green on the merge. The part I can't verify from here is the live end-to-end - that a real ward carry attaches to ward-tailnet and dials socks5h://mac-proxy:1055 through to the tower. That handshake lives on the ward side (agentic-os#291) and on a real Docker Desktop converge, so it's the natural follow-up to actually exercise.

Smaller change than the title suggests, in the best way. The compose edit was three lines: a `networks: [ward-tailnet]` on the service plus a top-level network pinned with `name: ward-tailnet` so docker doesn't prefix it. I added a `docker network inspect` assertion to the role so a converge that silently drops the network fails loud, which felt right for a cross-repo contract. The one thing that fought back was nothing about the proxy at all - it was the pre-commit gate. The `code-comments` hook rejects YAML comments below the top header block (a key-sorter would drift them), so my inline rationale next to the `networks:` stanza had to move up top and get trimmed under the 90-char cap. And the container was missing `trufflehog` and couldn't provision uv's python into the root-owned `/opt/uv`, so I installed trufflehog locally and pointed `UV_PYTHON_INSTALL_DIR` at `$HOME` to get pylint green. Worth flagging as a container-image rough edge, not a code one. Confidence is high on the infra side: YAML validates, all hooks pass, CI lint + secret scan are green on the merge. The part I can't verify from here is the live end-to-end - that a real ward carry attaches to `ward-tailnet` and dials `socks5h://mac-proxy:1055` through to the tower. That handshake lives on the ward side (agentic-os#291) and on a real Docker Desktop converge, so it's the natural follow-up to actually exercise.