jfraeys/infra
Watch
1
0
Fork
You've already forked infra
 0
Code Issues 21 Pull requests 4 Projects Releases Packages Wiki Activity Actions

fix(staging): retry the TCP connectivity probes that expect an open port #137

Merged
jfraeys merged 1 commit from jfraeys/fix/connectivity-probe-retries into main 2026-10-13 19:06:15 -04:00
Conversation 0 Commits 1 Files changed 1 +16
jfraeys commented 2026-10-13 19:03:19 -04:00
Owner
Copy link

Staging run API 604 (UI #413, the push for #136) failed in the connectivity check on exactly one probe: 'tailnet Postfix relay (ACL tag:web -> services:25) -> got filtered, wanted open'. Everything else passed in that run (hardening validation on both nodes including the journald check, tailnet SSH, Forgejo API, LLDAP, public ports, HTTPS via Traefik).

Nothing merged since the last green run (UI #408) touches Postfix, the firewall or the ACLs (#135 is a merge record; #136 changed only the trivy script, lint and tests). The TCP probe is a single sample, whereas the HTTPS and LLDAP probes right below it retry 6 x 10 s; a container that is still starting leaves its published port dropped, which the probe reports as 'filtered'. This is the likely cause, not a proven one.

  • Both 'Probe TCP reachability' tasks (web->services and services->web) now use until/retries: 6 attempts, 10 s apart, only for probes with expect: open (a banner, when given, must also match). Closed/reachable probes run once, as before.
  • Tested with a stub probe that answers filtered twice then 'open 220 ready': the open probe took 3 attempts, the closed probe 1. ansible-lint, yamllint and --syntax-check pass.
  • If the same probe still fails after 60 s the cause is real (not startup timing) and the failure message is unchanged.
  • Merging touches playbooks/**, so it starts a staging run on the current main (which includes #136); a green run produces the promotion PR for the trivy-report fix.

🤖 Generated with Claude Code

Staging run API 604 (UI #413, the push for #136) failed in the connectivity check on exactly one probe: 'tailnet Postfix relay (ACL tag:web -> services:25) -> got filtered, wanted open'. Everything else passed in that run (hardening validation on both nodes including the journald check, tailnet SSH, Forgejo API, LLDAP, public ports, HTTPS via Traefik). Nothing merged since the last green run (UI #408) touches Postfix, the firewall or the ACLs (#135 is a merge record; #136 changed only the trivy script, lint and tests). The TCP probe is a single sample, whereas the HTTPS and LLDAP probes right below it retry 6 x 10 s; a container that is still starting leaves its published port dropped, which the probe reports as 'filtered'. This is the likely cause, not a proven one. - Both 'Probe TCP reachability' tasks (web->services and services->web) now use until/retries: 6 attempts, 10 s apart, only for probes with expect: open (a banner, when given, must also match). Closed/reachable probes run once, as before. - Tested with a stub probe that answers filtered twice then 'open 220 ready': the open probe took 3 attempts, the closed probe 1. ansible-lint, yamllint and --syntax-check pass. - If the same probe still fails after 60 s the cause is real (not startup timing) and the failure message is unchanged. - Merging touches playbooks/**, so it starts a staging run on the current main (which includes #136); a green run produces the promotion PR for the trivy-report fix. 🤖 Generated with [Claude Code](https://claude.com/claude-code)
fix(staging): retry the TCP connectivity probes that expect an open port
All checks were successful
Lint / lint (pull_request) Successful in 1m51s
Details
Secret scan / scan (pull_request) Successful in 14s
Details
299d00f858
 
Run 604 (UI #413) failed on one sample of tailnet web -> services:25 ('filtered') right after the services deploy, while the HTTPS and
LLDAP probes just below already retry 6 x 10 s. A container still starting leaves its published port silently dropped. Retry the
open-expecting probes the same way; closed-expecting probes are not retried.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
jfraeys/infra!137
No description provided.