fix: wrap missed NATS/S3 dial sites with admin.DialTarget (#159)

siv-8.5 migrated daemon + awsgw but missed the sidecar services and
the spx CLI. vpcd and viperblockd read cfg.NatsHost / cfg.S3Host raw
from spinifex.toml; when BindIP=0.0.0.0 the TLS handshake fails SAN
verification because 0.0.0.0 is not a cert SAN. Same for the spx get
CLI path.

Call sites:
  spinifex/services/viperblockd/viperblockd.go:173  (NATS)
  spinifex/services/viperblockd/viperblockd.go:407  (S3 s3.S3Config)
  spinifex/services/viperblockd/viperblockd.go:533  (S3 nbd.NBDKitConfig)
  spinifex/services/vpcd/vpcd.go:277                (NATS)
  cmd/spinifex/cmd/get.go:93                        (CLI NATS)

admin.DialTarget rewrites 0.0.0.0:N to 127.0.0.1:N — loopback is always
a SAN and in-process sidecars share the host with NATS/predastore.
This commit is contained in:
Josh Siviour
2026-04-23 14:42:13 +10:00
committed by GitHub
parent 75fb15be2b
commit 604693ea0c
3 changed files with 8 additions and 5 deletions
+2 -1
View File
@@ -26,6 +26,7 @@ import (
"strings"
"time"
"github.com/mulgadc/spinifex/spinifex/admin"
"github.com/mulgadc/spinifex/spinifex/config"
"github.com/mulgadc/spinifex/spinifex/types"
"github.com/mulgadc/spinifex/spinifex/utils"
@@ -90,7 +91,7 @@ func loadConfigAndConnect() (*config.ClusterConfig, *nats.Conn, error) {
}
nodeConfig := cfg.Nodes[cfg.Node]
nc, err := utils.ConnectNATS(nodeConfig.NATS.Host, nodeConfig.NATS.ACL.Token, nodeConfig.NATS.CACert)
nc, err := utils.ConnectNATS(admin.DialTarget(nodeConfig.NATS.Host), nodeConfig.NATS.ACL.Token, nodeConfig.NATS.CACert)
if err != nil {
return nil, nil, fmt.Errorf("failed to connect to NATS: %w", err)
}
+4 -3
View File
@@ -12,6 +12,7 @@ import (
"syscall"
"time"
"github.com/mulgadc/spinifex/spinifex/admin"
"github.com/mulgadc/spinifex/spinifex/nbd"
"github.com/mulgadc/spinifex/spinifex/types"
"github.com/mulgadc/spinifex/spinifex/utils"
@@ -170,7 +171,7 @@ func (svc *Service) Reload() (err error) {
func launchService(cfg *Config) (err error) {
// Connect to NATS
nc, err := utils.ConnectNATS(cfg.NatsHost, cfg.NatsToken, cfg.NatsCACert)
nc, err := utils.ConnectNATS(admin.DialTarget(cfg.NatsHost), cfg.NatsToken, cfg.NatsCACert)
if err != nil {
slog.Error("Failed to connect to NATS", "err", err)
return err
@@ -404,7 +405,7 @@ func launchService(cfg *Config) (err error) {
Region: cfg.Region,
AccessKey: cfg.AccessKey,
SecretKey: cfg.SecretKey,
Host: cfg.S3Host,
Host: admin.DialTarget(cfg.S3Host),
}
// TODO: Improve based on system availability. Default 128MB cache
@@ -530,7 +531,7 @@ func launchService(cfg *Config) (err error) {
PidFile: nbdPidFile,
PluginPath: cfg.PluginPath,
BaseDir: cfg.BaseDir,
Host: cfg.S3Host,
Host: admin.DialTarget(cfg.S3Host),
Verbose: false,
Size: utils.SafeUint64ToInt64(vb.GetVolumeSize()),
Volume: ebsRequest.Name,
+2 -1
View File
@@ -11,6 +11,7 @@ import (
"strings"
"syscall"
"github.com/mulgadc/spinifex/spinifex/admin"
"github.com/mulgadc/spinifex/spinifex/utils"
)
@@ -274,7 +275,7 @@ func launchService(cfg *Config) error {
slog.Info("OVN preflight passed (br-int exists, ovn-controller running)")
// Connect to NATS
nc, err := utils.ConnectNATS(cfg.NatsHost, cfg.NatsToken, cfg.NatsCACert)
nc, err := utils.ConnectNATS(admin.DialTarget(cfg.NatsHost), cfg.NatsToken, cfg.NatsCACert)
if err != nil {
slog.Error("Failed to connect to NATS", "err", err)
return err