Repository navigation
dev2-edge: route unrouted Moshpit names to the c0mpute edge - #252
Merged
Merged
Conversation
Every label.ending SNI with no route of its own and an ending that is not an IANA TLD goes to moshpit-proxy's c0mpute edge on 127.0.0.1:8456, which serves c0mpute sites and splices every other connection back to nginx :8444. Real TLDs are wildcard entries from dev2/edge/iana-tlds.txt, so no ICANN apex takes the hop. Port 80 gains a regex server proxying the same names to the edge's http port, parking the ones it answers 421 for, exactly as the catch-all did. alt.2600 leaves Caddy: it is now a c0mpute site. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
ThreatCrush Security Scan41 finding(s) HIGH/CRITICAL: 15 | MEDIUM: 12 | LOW: 14
Snippets are redacted; ThreatCrush never prints matched credential material. |
This was referenced Nov 9, 2026
ralyodio
added a commit
that referenced
this pull request
Nov 9, 2026
…probe (#253) restore_live ran extractall inside the new 'remove the :80 file' branch, after the tar was closed, so a failed re-apply restored nothing (#252). And probe_one called edge-sweep with /dev/null, which the usage check rejected before EDGE_SWEEP_ONE was looked at, so every re-probe read 000/000/000. Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
dev2's :443 belongs to the nginx stream SNI router and no fleet box has a free IPv4 :443, so the c0mpute edge (moshpit-proxy, profullstack/moshpit-proxy#32) runs on dev2 behind it.
dev2/edge/iana-tlds.txt, IANA 2026110900) are.tldwildcard entries to nginx :8444, and a short regex~^[a-z0-9-]+\.[a-z0-9-]+$sends the remaining two-label (Moshpit) names to the edge on 127.0.0.1:8456. Exact names (Caddy's Moshpit sites, keep_on_nginx) still win. One 4 KiB nginx token cannot hold a negative lookahead over 1,437 TLDs, hence the include.EDGE_PROXY_PROTOCOL=1,EDGE_FALLBACK=127.0.0.1:8444) terminates only names the registry says are c0mpute sites and splices everything else back to nginx, PROXY header included, so deadman.switch, watch.wallet and the other nginx-served Moshpit names answer as before.conf.d/c0mpute-edge-http.conf, a regex server for the same names: ACME passthrough, https upgrade for real TLDs, proxy to the edge's http port, and the edge's 421 (not a c0mpute site) parks the name exactly like the userdirs catch-all. Reuses$moshpit_parkedfrom root-ubuntu.sh.nginx -tof the rendered stream and http blocks passes on dev2. vitest dev2-edge 15/15.🤖 Generated with Claude Code