Swarm resolves exactly as before: the meshed arm puts every node and the
backup host into the group, the direct arm none, and advertise_addr stays ''
there.
WIREGUARD_ENABLED followed the deployment mode alone. A swarm's backup host
is deployed in its own play, which resolves to compose mode, so the role was
included there and skipped: the hub listed it as a data peer and no tunnel
ever answered for it.
The layer now runs in swarm, as before, and on any host that owns a mesh
address the CLI wrote for it, read through the mesh_address lookup. A
compose host without a mesh stays untouched.
Proven on the local swarm lab (svc-dns-unbound, development layout): the
backup host brought up data at 10.100.1.12, passed the handshake and MTU
gate against the hub, the hub saw both data peers handshake, the backup host
reached a worker on the swarm mesh through the manager, and the drill and
both passes stayed green.
The guarantees were asserted against the declared swarm and data pair,
so they proved two meshes work rather than that the planner works. A
deployment declares its own, and the review asks for any number of them with
the nodes arranged however the client wants.
The same invariants now run over generated topologies: one to eight meshes,
three arrangements each, hosts dealt out so some belong to several meshes and
some to none. 2247 subtests, four seconds, and the planner needed no change to
pass them.
A consumer that admits mesh traffic needs every range a member can arrive
from, so a deployment carving its meshes from more than one pool extends this
rather than each consumer.
One SPOT the mesh writer reads and Ansible resolves. 10.100.0.0/16 is chosen to
clear every range the platform already allocates: Docker holds 10.208.0.0/12,
nested Docker 192.168.67.0/24 and 192.168.68.0/22, the swarm lab
192.168.244.0/24, and per-role subnets sit in the lower 192.168.0.0/16. An
overlap surfaces as unroutable peers long after the deploy reports green.
The data mesh selects its backup spoke by the svc-bkp- prefix rather than by
name, mirroring IS_BACKUP_HOST, so a new backup role joins without editing this
declaration.
Two MTU values are pinned rather than discovered. The overlay stacks VXLAN
inside WireGuard: 1500 on the underlay leaves 1420 after the WireGuard header
and 1370 after VXLAN, and a path that exceeds it drops large payloads only,
which reads as flaky CI rather than as a misconfiguration.
evangelostsak