Repository navigation
Conversation
Since #817, -rpcallowip gates the TLS JSON-RPC listener once the list has an entry. The stack template's list named only loopback and the stack subnet, which were meant for the plain listener, while its TLS listener binds 0.0.0.0 and is published. So every client on the LAN was dropped before the handshake: on the appliance all four boot tests fail "JSON-RPC is reachable over TLS" with an unexpected EOF, and the satd log reads "RPC TLS connection rejected: source IP not in the listener's allowlist". satd-init now writes rpcallowip=0.0.0.0/0. The plain listener is kept off the LAN by the network instead, as Electrum, Esplora and metrics already were: it is never published directly, and the appliance's nftables admits only the stack subnet to 8332. The subnet no longer reaches bitcoin.conf, so satd-init stops reading SATD_STACK_SUBNET and the appliance's render path stops passing it. compose.yml keeps passing it (and keeps its subnet fixed) because an older SATD_IMAGE's satd-init still uses it; the StartOS package does the same for its pinned image and can drop it when the pin moves. satd-init-test.sh checks that the rendered TLS listener admits a client outside the stack subnet; it fails with the old two lines put back. Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com> (cherry picked from commit 4920545)
bkeroack
added
the
appliance-ci
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Forward-port of #887 from
release/0.6to master: agit cherry-pick -xof 4920545. It applies cleanly, and its patch is identical to the release commit's.Since #817,
-rpcallowipgates the TLS JSON-RPC listener. The stack template's allowlist (loopback plus the stack subnet) therefore refused every LAN client of the published TLS port before the handshake. That broke all four appliance boot tests on thev0.6.0-rc1tag.satd-initnow writesrpcallowip=0.0.0.0/0. The plain listener is kept off the LAN by the network instead, as the other plain listeners already were. See #887 for the evidence, the reproduction on the rc1 binary and the version-skew notes (compose and StartOS keep passingSATD_STACK_SUBNETfor older images).Locally on this branch,
satd-init-test.sh(including the new "the TLS listener admits a client outside the stack subnet" check) andcompose-test.shpass. Theappliance-cilabel runs the image boot test here, as it did on #887.🤖 Generated with Claude Code