evangelostsak 10f0b94877 test(inventory): pin mesh planning, which fails silently when wrong ...

Every failure mode here is invisible at deploy time. A spoke missing from the
hub's peer list configures cleanly and never handshakes. A public key that does
not answer for its private half looks identical until traffic is attempted. A
partial rotation leaves the hub holding an old key while the spoke presents a
new one, and the handshake is refused with nothing logged on either side.

The load-bearing case is the hub filter: the manager is a member of
svc-swarm-node as well as the hub group, so left unfiltered it peers with
itself, which WireGuard accepts and which then routes the hub's own traffic
into its own tunnel.

The subnet guards are asserted against the shipped declaration too, so the
configuration proves its own collision checks rather than only the synthetic
ones.

2026-09-18 09:29:16 +02:00

..

deploy

fix(coredns): answer every record type for the test zone instead of forwarding it

2026-09-12 09:35:58 +02:00

inventory

test(inventory): pin mesh planning, which fails silently when wrong

2026-09-18 09:29:16 +02:00

recover

…

__init__.py

…