Follow-on to 4aa7a890 now that the encryption premise is
corrected: reframe *why* we want a `wg` mesh under TIPC (#502)
rather than leaving a "wg adds the crypto TIPC lacks" reading
lying around, since that reading is flat wrong.
The motivation is different but still real,
- TIPC's keys are **symmetric + pre-shared**, so distribution,
rotation and revocation are all on the operator; `wg` brings
public-key identity and a handshake.
- `wg` is an overlay *every* tpt can sit on (tcp now, quic
later), not a TIPC-only mechanism.
- NAT traversal / roaming, which raw TIPC bearers have no story
for at all.
Which to actually default to wants **benchmarking** — native
crypto skips a tunnel hop and may win for LAN-local clusters.
Also lean much harder on the udp-bearer-only caveat in the
handoff doc; it's the one that bites. A wg iface is L3/`tun` w/
no L2 addr, so there's no device for `media eth` to name — which
means #378's "ethernet bearers pair most excellently w/ wg
tunnelling" framing does NOT hold: on a given link the L2 path
and the wg path are mutually exclusive. Any design assuming both
is broken from the start.
(this patch was generated in some part by `claude-code` using `claude-opus-5` (`anthropic`))
Anticipating gh #502 — TIPC over a WireGuard mesh as our go-to
multihost tpt deployment — plus a cold-start handoff for whoever
(or whatever) picks this up next.
The wg deats, both verified locally,
- a wg iface is L3/`tun` (`POINTOPOINT,NOARP`, `link/none`, no
L2 addr) so TIPC's `eth` media **cannot** bind it; the udp
bearer is *mandatory* over wg, not merely an alternative.
Also its ~1420 MTU sits under ethernet's 1500.
- the composed deployment maddr is
`/ip4/<pub>/udp/51820/wg/u<key>/tipc/<stype>/<inst>/<scope>`.
XXX note the tipc segment has NO locative part unlike tcp's
inner `/ip4/../tcp/..` — a service name is
location-independent, so wg carries routing and tipc carries
identity. That's the argument for one `/tipc` proto w/ a
structured value in the #498 spec proposal.
XXX ALSO correcting a premise: TIPC is **not** unencrypted. It
ships AES-GCM crypto (`tipc node set key`, linux 5.9+) w/
cluster/master/per-node keys + rekeying. Those keys are
symmetric+pre-shared tho, so wg is still preferred for
public-key identity, NAT traversal, and one overlay every tpt
can share.
`01_tipc_HANDOFF.md` is deliberately provider-neutral: env
setup, the hard-won kernel facts table, the two closed design
decisions (+why), what landed, the pre-land TODOs and the repo's
working conventions.
(this patch was generated in some part by `claude-code` using `claude-opus-5` (`anthropic`))
Plan 01 §8's deployment deliverable, under
`examples/multihost/` (like the `wg_lan` set) since these need
the `tipc` kernel module — and, for the 2-host pair, a live
bearer — so they can't satisfy `test_docs_examples.py`'s
"walk `examples/` and assert rc == 0". `'multihost'` is already
in that test's exclusion list.
- `single_host.py` — boots a 4-actor tree and shells out to
`tipc nametable show` before/during/after. Watching 4 service
names appear in the KERNEL's table and vanish on teardown,
entirely outside any `tractor` API, is the single best demo
this backend has.
- `watch_nametable.py` — the same story push-based, via
`open_topology_events()`: live `[+] published` / `[-]
withdrawn` as actors come and go.
- `host_a_srv.py` + `host_b_client.py` — the cross-node pair.
Note what's absent from both: any IP, hostname or port. Both
sides name the same *service* and the kernel routes it.
- `README.md` — the manual smoke test (bearer setup, `tipc link
list` verify) per §7.3, plus the gotchas: silent crosstalk,
graceful-close-looks-like-`ECONNRESET`, the interim maddr.
Both single-host scripts were RUN against a live kernel and
their real output is what's pasted in the README.
(this patch was generated in some part by `claude-code` using `claude-opus-5` (`anthropic`))
Gud Boi