kevinveenbirkenbachandClaude Opus 5 fc3c27246b fix(svc-net-tor): give every onion port probe its own circuit ...

Tor attaches a stream to an onion to the rendezvous circuit that matches its
isolation and keeps it there until SocksTimeout; it never moves the stream to a
fresh circuit. The probe connected without SOCKS authentication and gave up
after 60s, so a dead rendezvous circuit would absorb both passes. That is the
most likely reading of run 35661520542 (web-app-mastodon#1, public Tor), where
<onion>:80 timed out twice right after curl had reached the same onion port.

Authenticate every connect with fresh random username/password credentials.
Tor accepts any and, under its default IsolateSOCKSAuth, builds a separate
rendezvous circuit per credential set, so a retry can no longer land on the
circuit that failed the attempt before.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

2026-09-22 13:41:09 +02:00

..

cli

feat(ci): deploy only the variants a change reaches

2026-09-21 22:51:03 +02:00

group_vars

fix(litellm): publish a backend only when the gateway's own flag enables it

2026-09-15 02:06:38 +02:00

library

…

plugins

style(quality): apply what the gate wrote back into the tree

2026-09-17 19:35:05 +02:00

roles

fix(svc-net-tor): give every onion port probe its own circuit

2026-09-22 13:41:09 +02:00

scripts

fix(diagnostics): let the in-zone probes read the drop-in that holds the zone

2026-09-03 12:50:58 +02:00

utils

feat(ci): deploy only the variants a change reaches

2026-09-21 22:51:03 +02:00

__init__.py

…