max / makenotwork

Say that a tailnet bind alone does not make a source reachable The reachability note added with the port fix was wrong: it said a daemon bound to its tailnet address is visible from any machine on the tailnet. Measured 2026-07-29, a viewer on astra cannot open any port on fw13, ssh and ICMP included, while fw13 reaches astra fine. fw13's own firewall accepts everything arriving on tailscale0, so the drop is the tailnet ACL, which is one-directional between the user-owned hosts and the tagged ones. That distinction is the whole diagnosis for a source that reads unreachable from one host and healthy from another, so the file now points at the ACL rather than leaving `listen` looking like the only thing to check.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: Max Johnson <me@maxj.phd> · 2026-07-30 01:25 UTC

Commit: 7e42ed129eec352e80c532924efbb12d8f994277

Parent: 7e0915b

1 file changed, +11 insertions, -5 deletions

M viewer/deploy/viewer.toml.example +11 -5

			@@ -22,13 +22,19 @@
22	22		stale_after_secs = 60
23	23
24	24		# Each URL below is the address that daemon's own deploy example binds, which is
25		-	# the file to check when a source reads as unreachable. They are not uniform: a
26		-	# daemon binding loopback is only visible to a viewer on the same host, while one
27		-	# binding its tailnet address is visible from any machine on the tailnet.
	25	+	# the file to check when a source reads as unreachable. A daemon bound to
	26	+	# loopback is only visible to a viewer on the same host.
	27	+	#
	28	+	# A tailnet bind is necessary but not sufficient for a viewer on another machine:
	29	+	# the tailnet ACL decides separately whether that machine may open the port. As
	30	+	# of 2026-07-29 the ACL is one-directional between the user-owned hosts and the
	31	+	# tagged ones, so a viewer on astra cannot reach fw13's daemons at any port even
	32	+	# though both sit on the tailnet. Check the ACL, not just `listen`, when a source
	33	+	# reads unreachable from one host and fine from another.
28	34		[[source]]
29	35		name = "sando"
30		-	# Matches `listen` in sando/deploy/sando-daemon.toml.example. Tailnet-only by
31		-	# design, not 0.0.0.0, so a viewer on another tailnet host can reach it.
	36	+	# Matches `listen` in sando/deploy/sando-daemon.toml.example: fw13's tailnet
	37	+	# address, deliberately not 0.0.0.0, and reachable from fw13 itself.
32	38		url = "http://100.103.89.95:7766"
33	39		# Sando gates its reads, so a token is required. The token is NAMED here, never
34	40		# pasted: this file describes topology and has every reason to be readable,