@le-space/rootfs 0.6.34 → 0.6.36

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@le-space/rootfs",
-  "version": "0.6.34",
+  "version": "0.6.36",
   "description": "Shared rootfs contract parsing, reference profile assets, and build helpers.",
   "license": "MIT",
   "type": "module",

package/reference/orbitdb-relay/rootfs/orbitdb-relay-autotls-refresh.py

@@ -129,6 +129,13 @@ def build_secure_addrs(env_values: dict[str, str], zone: str) -> list[str]:
     if not ws_port:
         raise RuntimeError("missing EXTERNAL_RELAY_WS_PORT in environment file")
 
+    # IPv4 is NAT/port-mapped, so it is advertised on the externally assigned
+    # host port. IPv6 is globally routed with no NAT on the Aleph VM — reachable
+    # directly on the internal listen port, while the mapped host port is closed
+    # over IPv6. Advertise the IPv6 libp2p.direct AutoTLS addresses on the
+    # internal WS port so AutoNAT/AutoTLS dial-backs actually reach the relay.
+    ws_port_ipv6 = env_values.get("RELAY_WS_PORT", "").strip() or ws_port
+
     addrs: list[str] = []
 
     public_ipv4 = env_values.get("PUBLIC_IPV4", "").strip()
@@ -140,8 +147,8 @@ def build_secure_addrs(env_values: dict[str, str], zone: str) -> list[str]:
     public_ipv6 = env_values.get("PUBLIC_IPV6", "").strip()
     if public_ipv6:
         host6 = ipv6_domain(public_ipv6, zone)
-        addrs.append(f"/ip6/{public_ipv6}/tcp/{ws_port}/tls/sni/{host6}/ws")
-        addrs.append(f"/dns6/{host6}/tcp/{ws_port}/tls/ws")
+        addrs.append(f"/ip6/{public_ipv6}/tcp/{ws_port_ipv6}/tls/sni/{host6}/ws")
+        addrs.append(f"/dns6/{host6}/tcp/{ws_port_ipv6}/tls/ws")
 
     if not addrs:
         raise RuntimeError("missing PUBLIC_IPV4/PUBLIC_IPV6 in environment file")

package/reference/orbitdb-relay/rootfs/orbitdb-relay-bootstrap.sh

@@ -117,6 +117,25 @@ write_env_var "RELAY_WS_PORT" "9092"
 write_env_var "RELAY_WEBRTC_PORT" "9093"
 write_env_var "RELAY_QUIC_PORT" "9094"
 write_env_var "RELAY_DISABLE_WEBRTC" "1"
-write_env_var "RELAY_DISABLE_BOOTSTRAP" "1"
+# Bootstrap MUST stay enabled. The relay needs public IPFS/DHT peers so libp2p
+# AutoNAT can confirm a public address — the precondition for AutoTLS to fetch
+# the `*.libp2p.direct` certificate. With bootstrap disabled the relay comes up
+# isolated (0 peers, empty DHT routing table), AutoNAT never confirms, and
+# AutoTLS silently stops serving certs ("no public addresses"), so browsers can
+# only reach it through the Caddy `2n6.me` proxy. RELAY_DISABLE_BOOTSTRAP=1 is
+# for tests / deliberately isolated deployments only.
+write_env_var "RELAY_DISABLE_BOOTSTRAP" "0"
+# The kad-DHT must stay OFF on these 2 GB Aleph VMs. With it enabled the relay
+# announces itself into the public DHT and is then flooded with inbound
+# WebSocket connections: sockets pile up in CLOSE-WAIT (hundreds within
+# minutes), the single-threaded Node event loop saturates, and the process
+# hangs — /health, metrics and every libp2p transport stop responding while the
+# VM, Caddy and the TCP listeners still look healthy. `connectionManager
+# .maxConnections` does not prevent this: it bounds established connections,
+# not the inbound churn. Bootstrap above stays enabled, which gives AutoNAT the
+# handful of public peers it needs to confirm an address so AutoTLS can still
+# fetch its `*.libp2p.direct` certificate. Set RELAY_DISABLE_DHT=0 only on a
+# host that can absorb full DHT server load.
+write_env_var "RELAY_DISABLE_DHT" "1"
 write_env_var "ENABLE_GENERAL_LOGS" "1"
 write_env_var "DEBUG" "'libp2p:websockets:listener'"

package/reference/orbitdb-relay/rootfs/orbitdb-relay-configure.sh

@@ -13,6 +13,17 @@ CADDYFILE="${CADDYFILE:-/etc/caddy/Caddyfile}"
 CADDY_UPSTREAM_WSS_PORT="${CADDY_UPSTREAM_WSS_PORT:-9092}"
 CADDY_UPSTREAM_HOST="${CADDY_UPSTREAM_HOST:-127.0.0.1}"
 CADDY_UPSTREAM_METRICS_PORT="${CADDY_UPSTREAM_METRICS_PORT:-9090}"
+# Internal libp2p listen ports. On the Aleph VM, IPv4 is NAT/port-mapped (so it
+# is announced on the externally assigned host ports), but IPv6 is globally
+# routed with NO NAT — the VM is reachable directly on the real listen ports,
+# and the mapped host ports are closed over IPv6. IPv6 must therefore be
+# announced on these internal ports, otherwise AutoNAT/AutoTLS dial-backs to the
+# IPv6 address hit a closed mapped port, the address is never confirmed, and
+# `*.libp2p.direct` AutoTLS never provisions a certificate over IPv6.
+RELAY_TCP_LISTEN_PORT="${RELAY_TCP_LISTEN_PORT:-9091}"
+RELAY_WS_LISTEN_PORT="${RELAY_WS_LISTEN_PORT:-${CADDY_UPSTREAM_WSS_PORT}}"
+RELAY_WEBRTC_LISTEN_PORT="${RELAY_WEBRTC_LISTEN_PORT:-9093}"
+RELAY_QUIC_LISTEN_PORT="${RELAY_QUIC_LISTEN_PORT:-9094}"
 AUTOTLS_REFRESH_SERVICE="${AUTOTLS_REFRESH_SERVICE:-orbitdb-relay-autotls-refresh.service}"
 BOOTSTRAP_REFRESH_TIMER="${BOOTSTRAP_REFRESH_TIMER:-orbitdb-relay-bootstrap-refresh.timer}"
 BOOTSTRAP_REFRESH_SERVICE="${BOOTSTRAP_REFRESH_SERVICE:-orbitdb-relay-bootstrap-refresh.service}"
@@ -203,7 +214,7 @@ announce=(
 
 if [ -n "${PUBLIC_IPV6}" ]; then
   announce+=(
-    "/ip6/${PUBLIC_IPV6}/tcp/${TCP_PORT}"
+    "/ip6/${PUBLIC_IPV6}/tcp/${RELAY_TCP_LISTEN_PORT}"
   )
 fi
 
@@ -214,20 +225,20 @@ fi
 
 announce+=("/ip4/${PUBLIC_IPV4}/tcp/${WS_PORT}/ws")
 if [ -n "${PUBLIC_IPV6}" ]; then
-  announce+=("/ip6/${PUBLIC_IPV6}/tcp/${WS_PORT}/ws")
+  announce+=("/ip6/${PUBLIC_IPV6}/tcp/${RELAY_WS_LISTEN_PORT}/ws")
 fi
 
 if [ -n "${WEBRTC_PORT}" ]; then
   announce+=("/ip4/${PUBLIC_IPV4}/udp/${WEBRTC_PORT}/webrtc-direct")
   if [ -n "${PUBLIC_IPV6}" ]; then
-    announce+=("/ip6/${PUBLIC_IPV6}/udp/${WEBRTC_PORT}/webrtc-direct")
+    announce+=("/ip6/${PUBLIC_IPV6}/udp/${RELAY_WEBRTC_LISTEN_PORT}/webrtc-direct")
   fi
 fi
 
 if [ -n "${QUIC_PORT}" ]; then
   announce+=("/ip4/${PUBLIC_IPV4}/udp/${QUIC_PORT}/quic-v1")
   if [ -n "${PUBLIC_IPV6}" ]; then
-    announce+=("/ip6/${PUBLIC_IPV6}/udp/${QUIC_PORT}/quic-v1")
+    announce+=("/ip6/${PUBLIC_IPV6}/udp/${RELAY_QUIC_LISTEN_PORT}/quic-v1")
   fi
 fi