From 580b89a0de01e231c471e697021fb605a5271b3f Mon Sep 17 00:00:00 2001 From: Takwa Date: Tue, 13 Oct 2026 15:59:57 +0200 Subject: [PATCH] Reserve ports 9800-9801 for the monitoring Traefik The monitoring Traefik on lith-1 moves to the host network (ipni/infra#158), so its ping (9800) and metrics (9801) entrypoints become host ports. Reserve them so an outbound connection is never given one as its source port. Takes effect on the next site.yml run (common role), like the rest of this list: the 8000 and 8443 added in #2 are not on the boxes yet either. Co-Authored-By: Claude Opus 5.5 --- group_vars/ipfs_nodes/main.yml | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/group_vars/ipfs_nodes/main.yml b/group_vars/ipfs_nodes/main.yml index d176670..87a6dd8 100644 --- a/group_vars/ipfs_nodes/main.yml +++ b/group_vars/ipfs_nodes/main.yml @@ -134,7 +134,9 @@ sysctl_tuning: # 5011 bootstrapper API 5012 bootstrap-b API # 5021 content kubo RPC API (loopback) # 6443-6444 k3s API 8190-8193 needle APIs (loopback, four instances) - # 8000 Healthchecks (healthchecks_host only) 8443 monitoring Traefik (argocd_hub only) + # 8000 Healthchecks (healthchecks_host only) + # 8443 monitoring Traefik HTTPS, 9800 its ping, 9801 its metrics (argocd_hub only, + # host network: ipni/infra kubernetes/manifests/eu/lith1/monitoring/values/traefik.yaml) # 8472/udp flannel VXLAN # 9094 content ipfs-cluster REST API (loopback) # 9095 content ipfs-cluster IPFS proxy (loopback) @@ -144,7 +146,7 @@ sysctl_tuning: # 9901 route-origin Envoy admin 9902 bootstrap-wss Envoy admin # 9903 bootstrap-b's bootstrap-wss Envoy admin # 10010 containerd 10248-10259 kubelet/kube-proxy/k3s - net.ipv4.ip_local_reserved_ports: "443,4001-4002,4004-4007,4011-4012,4101,4443,4453,5011-5012,5021,6443-6444,8000,8190-8193,8443,8472,9094-9097,9443,9901-9904,10010,10248-10259" + net.ipv4.ip_local_reserved_ports: "443,4001-4002,4004-4007,4011-4012,4101,4443,4453,5011-5012,5021,6443-6444,8000,8190-8193,8443,8472,9094-9097,9443,9800-9801,9901-9904,10010,10248-10259" net.ipv4.tcp_fin_timeout: 15 # Must equal what k3s's kube-proxy sets on every start: max(32768 * CPUs, # 131072), i.e. 1048576 on these 32-core boxes. A fixed lower value both