PhilippTheServer

networking

Overlay meshes, routing, MTU, and the layers that fail quietly.

  1. Traefik's 60-Second readTimeout Covers the Whole Request Body

    "Expected filesize of 104857600 bytes but read 29491200": Traefik's readTimeout defaults to 60s and bounds the whole request body, so slow uploads get cut.

    kubernetes networking reliability testing

  2. Multicast Service Discovery on a Host With a WireGuard Interface

    "Required key not available" (ENOKEY) on multicast sendto: kernel WireGuard has no peer for 239.0.0.0/8. Filter interfaces on IFF_MULTICAST and IFF_POINTOPOINT.

    networking linux cpp embedded testing

  3. Running a Self-Hosted Tailscale Control Server Behind a Reverse Proxy

    Headscale behind Traefik: tls.options=no-h2@file with alpnProtocols http/1.1, because the Tailscale noise handshake breaks when ALPN negotiates h2.

    networking dns security docker

  4. nginx: The Map Variable That Fixes the URI in proxy_pass

    nginx: [emerg] invalid URI prefix in proxy_pass: a regex location needs a bare upstream, and a map on $uri keeps a path-specific Cache-Control header.

    docker networking observability ci-cd

  5. kube-proxy in iptables Mode and Native nftables Rules in the Forward Chain

    kube-proxy iptables-nft sync silently aborts on native nftables rules a mesh agent adds to the FORWARD chain. Fix: nft delete rule by handle, ip and ip6.

    kubernetes networking linux reliability

  6. Prometheus HTTP Service Discovery Backed by a Live Inventory

    Prometheus http_sd_configs: the targets and labels JSON an inventory endpoint must return, refresh_interval, and why targets persist when it is down.

    observability automation networking

  7. Forward Auth: Putting Real Authentication in Front of Software That Has None

    Traefik forwardAuth with X-Auth-Request-User: strip the header first or clients can spoof it. oauth2-proxy and Keycloak in front of apps with no login.

    identity networking security

  8. WireGuard Route Selection: Per-Host /32 Versus Subnet Routes With NAT

    WireGuard AllowedIPs overlap: a /24 on a gateway peer and a /32 on a direct peer break the return path. Longest-prefix-match and a /32 on both ends.

    networking linux

  9. Group-Based Default-Deny Instead of Hand-Maintained Peer Lists

    NetBird Default policy replaced by group-based default-deny: auto_groups on setup keys, role:/tier: group names, and a script diffing live policies.

    networking identity

  10. Overlay Mesh Networking with NetBird: Peer Addressing and the Public DNS Fallthrough

    NetBird mesh hostnames resolve to the public host via a zone wildcard when the mesh resolver is down. Fix: a *.mesh blackhole record and accept-new.

    networking dns security linux

  11. How a VPN Client Silently Shrinks Your Pod Network MTU

    Frag needed and DF set (mtu = 1420): a VPN hop below the CNI's auto-detected 1500 MTU stalls large pod transfers. Reproducing it and pinning the MTU.

    kubernetes networking

  12. ndots and the Accidental Search-Domain Leak in Pod DNS

    dnsConfig.searches with ndots:5 lets an internal wildcard answer external names. Why ndots:1 only half fixes it and a trailing dot fully does.

    kubernetes dns networking

  13. Runtime Configuration for an Angular Container Without Rebuilding

    Angular environment.ts is baked in at ng build. Load config.json via APP_INITIALIZER, generated by envsubst in /docker-entrypoint.d at container start.

    frontend docker infrastructure-as-code networking

  14. Powering and Discovering Peripherals over PoE with Multicast Announcements

    IP_ADD_MEMBERSHIP multicast discovery for PoE sensors in Python: announcer, collector with expiry, and why IGMP snooping without a querier breaks it.

    networking embedded

All topics · All writing