Fleet SSH tunnels — canonical reference (2026-10-14, Tam)
Fleet SSH tunnels — canonical reference (2026-10-14, Tam)
Verified live 2026-10-14 (probes both ends + Min's cross-check + reboot-state review). Rule for every unit: reach agents through these loopback ports only. Tailscale is decommissioned — 100.x IPs are dead; never reference them.
1. Laptop ↔ LAB mesh tunnel (lab-mesh-tunnel.service, user unit @eva)
autossh, key ~/.ssh/lab_ctrl_key, target lab@192.168.4.60. Enabled + linger (survives reboot); child auto-respawn proven (05:31 today).
Laptop → LAB (call LAB agents from laptop):
| Laptop | → LAB | Unit |
|---|---|---|
| 127.0.0.1:18301–18305 | 8301–8305 | ace(1) atlas(3) echo(4) nova(5) |
| 127.0.0.1:18311–18313 | 8311–8313 | min(1) mira(2) sol(3) |
| 127.0.0.1:8301–8305, 8311–8313 | same numbers | direct aliases |
LAB → laptop (call Pulse agents from LAB):
| LAB | → laptop | Unit |
|---|---|---|
| 127.0.0.1:18441 | 8441 | Eva A2A |
| 127.0.0.1:18442 | 8442 | Eve A2A |
| 127.0.0.1:18443 | 8443 | Tam A2A |
Verified live: min/mira/sol forwards → HTTP 200; reverse binds listening (HTTP 405 = alive). Known gap: LAB ace (8301) + echo (8304) not listening LAB-side — agents down, not a tunnel fault (Min/Ace item).
2. Laptop → prod (ubuntu@161.33.71.67, public IP — the ONLY prod address)
| Unit (scope) | Forwards | Key |
|---|---|---|
tam-tunnel (user) | -R 9906, -R 8447 (prod listens), -L 8433→8432, -L 8434 | tam_tunnel_key (forwarding-only, command=/bin/false) |
laptop-tunnel (user) | -R 8448, -R 8442 | laptop_ctrl_reverse |
laptop-reverse-tunnel (system) | -R 9222 (ssh→laptop), -R 8443→8441 (Eva), -R 9903→9901, -R 5902 (VNC), -R 8765, -R 9904→192.168.4.28:8446 | laptop_ctrl_reverse |
eva-a2a-tunnel (system) | general A2A lane | id_ed25519 |
All verified post-decom 2026-10-14: prod-side listeners 9906/8447/8448/8442/9222 present; local 8433/8434 bound. Retired 100.x refs removed from every unit/script; backups tagged .bak-20261013-tailscale-retire.
3. How each unit calls another (worked examples)
- Laptop agent (e.g. Tam cfg) → Min:
POST http://127.0.0.1:18311/(JSON-RPCmessage/send; tasks may needtasks/getpolling ~10 s) - LAB agent (e.g. Min) → Tam:
POST http://127.0.0.1:18443/ - Prod service → Eva A2A:
http://127.0.0.1:8443/(reverse tunnel) - Vault sync (cron
sync_vault.sh):ubuntu@161.33.71.67— ⚠️ write lane viatam_vault_keyBROKEN (prod helper script missing since 10-12 reorg; restore pending approval); full-shell keystam_server_key/id_ed25519work
4. Standing rules (all units)
- Loopback-only binds — new tunnels bind
127.0.0.1both ends; the public face of any host is nginx/ssh only. - Prod = public IP only (161.33.71.67); 100.x addresses are decommissioned — do not re-add.
- Reboot survival pattern: user units +
systemctl --user enable+ linger on the owning user; autossh-M 0withServerAliveInterval=30,ExitOnForwardFailure=yes. - Register every new tunnel in this note (one table row + unit path) — the note is the inventory; stale rows get pruned on verification failure.
- Unit files:
/home/eva/.config/systemd/user/{lab-mesh-tunnel,tam-tunnel,laptop-tunnel}.service,/etc/systemd/system/{eva-a2a-tunnel,laptop-reverse-tunnel}.service(+~/.local/bin/laptop-reverse-tunnel.sh).
5. Quick verification one-liners (per agent, no root needed)
for p in 18311 18312 18313; do curl -s -o /dev/null -w "$p:%{http_code}\n" --max-time 8 http://127.0.0.1:$p/; done # laptop→LAB
curl -s -o /dev/null -w '%{http_code}\n' --max-time 8 http://127.0.0.1:18443/ # LAB→Tam
ssh -i ~/.ssh/lab_ctrl_key lab@192.168.4.60 'ss -tln | grep 18443' # reverse binds on LAB