#106 - e2e: auxiliary federated test homeserver — unlock the federation scenario class - dark/nether-voicebridge

robocub commented

2026-07-12 13:34:09 +00:00

Collaborator

The entire #96/#97/#103 incident class was invisible to the harness because it can only mint LOCAL users — federation (slow joins, invite handshakes, via routing, v12 rooms minted remotely, malformed responses) is exactly where the first real users bled. Documented as a limitation in the testing-design doc; this issue is the capability.

Proposal: a small auxiliary homeserver as a TEST FIXTURE, run by us (see below for why not a friend's):

Incus container on cubuntu next to the others; Tuwunel (pin a version knowingly — being ABLE to run a different version than prod is a feature: it reproduces version-skew bugs like the tinier.town corruption).
Own server_name (e.g. e2e-hs.nether.im), DNS direct to the container, NOT Cloudflare-fronted (clean federation path, and it exercises the non-CF configuration prod cannot).
TLS via Let's Encrypt (caddy in front or Tuwunel-native); .well-known/SRV as needed; registration CLOSED; a dedicated appservice registration so the harness can mint @nvbfed_* users on it exactly like the nvbtest pattern.
e2e.toml gains a [federation] section (aux HS url + as_token); scenarios skip cleanly when absent, so the suite still runs anywhere.

Scenarios unlocked (the point): federated DM invite → accept → greet (the #97 race with REAL multi-second joins); federated link with a remotely-minted v12 room (the #103 acceptance test, automated); slow-join greeting window; cold-outreach UTD (#104) against a genuinely remote crypto user; and later a chaos tier — a small proxy in front of the aux HS mangling make_join/invite responses to reproduce the tinier.town failure class deterministically.

Why not a friend's homeserver: great for organic diversity (that is what @qwertyad and @dau already provide), unusable as fixture — no as_token for minting users, no determinism (their updates/uptime), test churn pollutes a server people live on, no fault injection, and consent gets murky the day a scenario misbehaves. Friends are the field; the fixture must be ours.

Operator supplies: DNS record + container creation (shared-infra rule). Agent side: Tuwunel config, appservice, harness plumbing, first scenarios.

The entire #96/#97/#103 incident class was invisible to the harness because it can only mint LOCAL users — federation (slow joins, invite handshakes, via routing, v12 rooms minted remotely, malformed responses) is exactly where the first real users bled. Documented as a limitation in the testing-design doc; this issue is the capability. **Proposal: a small auxiliary homeserver as a TEST FIXTURE, run by us** (see below for why not a friend's): - Incus container on cubuntu next to the others; Tuwunel (pin a version knowingly — being ABLE to run a different version than prod is a feature: it reproduces version-skew bugs like the tinier.town corruption). - Own server_name (e.g. `e2e-hs.nether.im`), DNS direct to the container, **NOT Cloudflare-fronted** (clean federation path, and it exercises the non-CF configuration prod cannot). - TLS via Let's Encrypt (caddy in front or Tuwunel-native); `.well-known`/SRV as needed; registration CLOSED; a dedicated appservice registration so the harness can mint `@nvbfed_*` users on it exactly like the nvbtest pattern. - `e2e.toml` gains a `[federation]` section (aux HS url + as_token); scenarios skip cleanly when absent, so the suite still runs anywhere. **Scenarios unlocked (the point):** federated DM invite → accept → greet (the #97 race with REAL multi-second joins); federated `link` with a remotely-minted v12 room (the #103 acceptance test, automated); slow-join greeting window; cold-outreach UTD (#104) against a genuinely remote crypto user; and later a chaos tier — a small proxy in front of the aux HS mangling `make_join`/`invite` responses to reproduce the tinier.town failure class deterministically. **Why not a friend's homeserver:** great for organic diversity (that is what @qwertyad and @dau already provide), unusable as fixture — no as_token for minting users, no determinism (their updates/uptime), test churn pollutes a server people live on, no fault injection, and consent gets murky the day a scenario misbehaves. Friends are the field; the fixture must be ours. Operator supplies: DNS record + container creation (shared-infra rule). Agent side: Tuwunel config, appservice, harness plumbing, first scenarios.

robocub commented

2026-07-12 13:38:52 +00:00

Author

Collaborator

Design revision after operator input (firewall reality): cubuntu has no open inbound — everything public rides the Cloudflare tunnel. So the aux homeserver goes through the SAME tunnel as nether.im, and the original "not CF-fronted" requirement is DROPPED — the tunnel route is (a) proven (inbound federation to nether.im works today), (b) client-accessible from anywhere without tailscale, and (c) actually higher prod-parity: the test server replicates prod's real networking, quirks included.

Federation between the two servers hairpins: tuwunel → CF edge → tunnel → aux container. Tailscale-only was considered and rejected: homeserver SSRF protections block private-range federation targets, DNS/cert contortions, and no plain-client access.

Two known CF gotchas to apply on day one (both have documented fixes from prod history): extend the /.well-known/ Cloudflare cache exclusion to the new hostname (the nether.im OIDC-login lesson), and mind the CF user-agent filtering that once bit the harness.

Operator supplies: the tunnel hostname route + DNS + container. Then agent work as scoped.

**Design revision after operator input (firewall reality):** cubuntu has no open inbound — everything public rides the Cloudflare tunnel. So the aux homeserver goes through the SAME tunnel as nether.im, and the original "not CF-fronted" requirement is DROPPED — the tunnel route is (a) proven (inbound federation to nether.im works today), (b) client-accessible from anywhere without tailscale, and (c) actually higher prod-parity: the test server replicates prod's real networking, quirks included. Federation between the two servers hairpins: tuwunel → CF edge → tunnel → aux container. Tailscale-only was considered and rejected: homeserver SSRF protections block private-range federation targets, DNS/cert contortions, and no plain-client access. Two known CF gotchas to apply on day one (both have documented fixes from prod history): extend the `/.well-known/` Cloudflare cache exclusion to the new hostname (the nether.im OIDC-login lesson), and mind the CF user-agent filtering that once bit the harness. Operator supplies: the tunnel hostname route + DNS + container. Then agent work as scoped.

robocub referenced this issue

2026-07-12 14:07:19 +00:00

nether.autos: community federation self-test service (exploration) — the behavioral tier no existing tool covers #108

robocub referenced this issue

2026-07-12 14:07:55 +00:00

infra: nether.autos incus container — federated-fixture setup runbook (new-session handoff for #106/#108) #109

robocub commented

2026-07-12 14:07:56 +00:00

Author

Collaborator

Concrete implementation plan now lives in the nether.autos handoff runbook (see newest issue referencing #106) — domain chosen, CF-tunnel design confirmed, operator creates the container + tailscale and hands a fresh session the runbook. This issue stays as the scenario-scope reference; #108 tracks the community-service exploration the fixture prototypes.

robocub referenced this issue

2026-07-12 21:10:32 +00:00

infra: nether.autos incus container — federated-fixture setup runbook (new-session handoff for #106/#108) #109

Rows
Columns

e2e: auxiliary federated test homeserver — unlock the federation scenario class #106