joshsiv-mulga b3f1b678e0 fix(ddil): SSH witness via public IP, drop unreachable tunnel path ...

tofu-cluster bootstraps with --external-mode=pool which forces
dev_networking=false → no QEMU hostfwd dev NIC and no host route to the
ENI's PrivateIpAddress (tap on OVS br-int, 172.31.0.0/16 invisible to
host kernel). Previous tunnel-via-host fix could find the host but
couldn't dial the guest.

Switch to the path shell e2e already uses: default subnet has
MapPublicIpOnLaunch=true, daemon auto-allocates an EIP from the external
pool, and the runner reaches that IP via the same WAN subnet as the
cluster nodes. No host relay required, survives Scenario C (partition
only DROPs peer cluster IPs, not the runner's source IP).

Workflow now scp's ~/.ssh/spinifex-key from the primary node (the
counterpart to the public material bootstrap-install.sh imports) and
exports DDIL_GUEST_SSH_KEY so the harness can auth as ubuntu against
cloud-init's authorized_keys.

WitnessVM.GuestIP → WitnessVM.PublicIP. hostSigner / dialHost removed.

Continues mulga-siv-57.

2026-05-11 14:35:54 +10:00

..

assets

feat: VFIO GPU passthrough (#188)

2026-05-06 09:52:23 +10:00

workflows

fix(ddil): SSH witness via public IP, drop unreachable tunnel path

2026-05-11 14:35:54 +10:00

dependabot.yml

chore: reintroduce dev branch in CI + scripts

2026-04-30 11:50:13 +10:00