fix(broker): default LARRY_BROKER_URL -> https://broker.bjnoela.com + strip Tailscale error verbiage (v0.9.8)
The client default broker URL was the dead Tailnet IP http://100.86.16.114:8181, so every enrolled box on a non-tailnet network failed 'cannot reach the broker (fail-closed)' even though the broker is public at https://broker.bjnoela.com (Cloudflare). Repointed the default in lib/broker.sh + larry.sh to match install-larry.sh, and removed the 'LAN + Tailscale only / bring Tailscale up' text from the broker-unreachable error path (replaced with public-broker + egress-check guidance) per Bryan: Tailscale is never the fix on a restricted client network. VERSION/LARRY_VERSION 0.9.7->0.9.8 (load-bearing: self_update Phase A gates on .last-sync-version != LARRY_VERSION, so without the bump enrolled boxes skip re-syncing the fix), CHANGELOG entry, MANIFEST regenerated. Auth/kill-switch logic untouched. Vera CODE-PASS 2026-07-23 (Deliverables/qa/2026-07-23-vera-gate1-three-deliverables.md). Verified live: gundersen-epic enrolled + ran through the public broker 2026-07-23. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This commit is contained in:
parent
6900369a41
commit
abc0d096d0
23
CHANGELOG.md
23
CHANGELOG.md
@ -4,6 +4,29 @@ All notable changes to `cloverleaf-larry` / `larry-anywhere` are recorded here.
|
||||
Versioning is loose-semver; bumps trigger the in-process self-update on every
|
||||
running client via `LARRY_BASE_URL` + `MANIFEST`.
|
||||
|
||||
## v0.9.8 — 2026-07-23
|
||||
|
||||
Fix: stale broker default + stale "LAN + Tailscale only" messaging in the
|
||||
runtime client. Root cause of the Gundersen-box "can't reach the broker"
|
||||
reports — the public broker (`https://broker.bjnoela.com`, live and
|
||||
authenticated since 2026-07-09) was never the problem; the *client* was still
|
||||
defaulting to a dead Tailnet IP (`http://100.86.16.114:8181`) and telling
|
||||
users to bring Tailscale up, which was never going to fix it (Bryan-direct).
|
||||
|
||||
- **`lib/broker.sh`** — default `LARRY_BROKER_URL` changed from the dead
|
||||
Tailnet IP to `https://broker.bjnoela.com` (mirrors the already-correct
|
||||
`install-larry.sh` one-arg self-enroll default). Comment blocks rewritten
|
||||
to describe the public broker as the default, no Tailscale required.
|
||||
- **`larry.sh`** — same default-URL fix (two call sites: top-of-file env-var
|
||||
doc block, and the broker-config block right before the var is set). The
|
||||
two runtime error strings shown when the broker is unreachable
|
||||
("...LAN + Tailscale only... bring Tailscale up...") had the Tailscale
|
||||
verbiage removed entirely and replaced with accurate guidance: the broker
|
||||
is public, check the box's own outbound-HTTPS egress filtering first, or
|
||||
set `LARRY_BROKER_URL` if a different ingress was provisioned.
|
||||
- No change to broker/auth logic, the fail-closed kill-switch path, or any
|
||||
network/edge config — this is a client default + messaging fix only.
|
||||
|
||||
## v0.9.6 — 2026-06-08
|
||||
|
||||
Hands-on ergonomics for Bryan's Gundersen testing (Clover). Three changes, all
|
||||
|
||||
10
MANIFEST
10
MANIFEST
@ -23,17 +23,17 @@
|
||||
# scripts/make-manifest.sh and bump VERSION.
|
||||
|
||||
# Top-level scripts
|
||||
larry.sh 49cc8dcf8b1f5057aa816b28a07e718293f1d92a573268b65cdb288fc10ae71b
|
||||
larry.sh d877bf37a65e685ea27ef2503bc2dcce82cfafb255419b5d16995cee397a8cdd
|
||||
larry-tunnel.sh 6b050e4eeab15669f4858eaf3b807f168f211ced07815db9521bc40a093f6aaa
|
||||
larry-auth.sh a220cdf7878569dc3028951ee57fc8d5e706a8ca5c6aa45347b58facb386f831
|
||||
larry-rollback.sh 91b5e9aa6c79266bf306dcfba4ca791c07971bd6924d67a779037531648aa6d0
|
||||
install-larry.sh daf2814a41052783cd8bf4252cec9276878860be8945a7fe678182c51d7eac05
|
||||
install-larry.sh 19f42e8f6e54eaffffe33e1464a8d245721260aed047270a75987c0b25c936c0
|
||||
uninstall-larry.sh c53ad2d8354c7adeb243b541f027f3f481e4a8661eecfd7af14d7ca53cfcaad9
|
||||
|
||||
# Metadata
|
||||
VERSION 6c38d2d8c19dec053f658ac7e8963ce25e98f2ab00fe058e62c07010c1988c6c
|
||||
VERSION ff35aa972931add85900ecabdc1eb4659e398118d3c25601d762079b1ff97dcd
|
||||
MANUAL.md 5ff54d6d5fae826f8b3da1eb3be6476076bb15f9b1417a4de285e59ea37e1b1f
|
||||
CHANGELOG.md 8573fa4c1911f665f71f792d992ab331e5bb2aa5462ebd29c12994781588843e
|
||||
CHANGELOG.md 33705f676b4069da32b3600a43697a70bd48aea03af8b7d6b72db097a7a43a72
|
||||
|
||||
# Agent personas (system-prompt overlays)
|
||||
agents/larry.md 0a1ef737e7fc133ab35be09f79c3a4df33de814e0404b69b950932d0c8a01be1
|
||||
@ -55,7 +55,7 @@ lib/oauth.sh 04a93376f88fe53cc1c86a5dbe577735c60375dadd4f2fda55b921ef3cddf22b
|
||||
# v0.9.0: broker client — the remote kill-switch (default rail). Enroll+mint a
|
||||
# short-lived token, route LLM calls through the broker, fail-closed heartbeat,
|
||||
# best-effort PHI wipe on disable.
|
||||
lib/broker.sh 8ec200439329ca0f93003d0976589f427de29450bbc8afab0fe32838e862bdce
|
||||
lib/broker.sh 081f8bf48df2f70e25c58a10fe125460975ef1f503096c6a47550bcbcd7d8767
|
||||
|
||||
# Secure SSH with ControlMaster (password hidden from Larry-the-LLM)
|
||||
lib/ssh-helper.sh 18df1f1f1936c930ba0197c0e0b4bd89c027500de99b56067b620ca9144f6e9e
|
||||
|
||||
31
larry.sh
31
larry.sh
@ -56,9 +56,10 @@
|
||||
# per-client x-api-key rail (baked key, no kill-switch).
|
||||
# "oauth" opts INTO subscription OAuth — discouraged (it
|
||||
# impersonates Claude Code, flags your Max account).
|
||||
# LARRY_BROKER_URL broker base URL (default tailnet http://100.86.16.114:8181;
|
||||
# LAN http://192.168.20.135:8181). Broker is LAN+Tailscale
|
||||
# only — an egress-restricted box reaches it over Tailscale.
|
||||
# LARRY_BROKER_URL broker base URL. Default = the public broker
|
||||
# (https://broker.bjnoela.com), authenticated at the
|
||||
# edge — works from any box with normal outbound
|
||||
# HTTPS, no VPN/Tailscale/LAN required.
|
||||
# LARRY_DEPLOYMENT_ID this deployment's id in the broker registry.
|
||||
# LARRY_ENROLL_SECRET the per-deployment enrollment secret (or stored 0600 at
|
||||
# $LARRY_HOME/.enroll-secret). Baked at install, never logged.
|
||||
@ -99,7 +100,7 @@ set -o pipefail
|
||||
# ─────────────────────────────────────────────────────────────────────────────
|
||||
# Config
|
||||
# ─────────────────────────────────────────────────────────────────────────────
|
||||
LARRY_VERSION="0.9.7"
|
||||
LARRY_VERSION="0.9.8"
|
||||
LARRY_HOME="${LARRY_HOME:-$HOME/.larry}"
|
||||
|
||||
# ─────────────────────────────────────────────────────────────────────────────
|
||||
@ -249,13 +250,14 @@ LARRY_API_KEY_FILE="${LARRY_API_KEY_FILE:-$LARRY_HOME/.api-key}"
|
||||
# with no PHI and no broker reachability). PHI deployments must stay on broker.
|
||||
#
|
||||
# Broker config (resolved/loaded by lib/broker.sh):
|
||||
# LARRY_BROKER_URL broker base (default tailnet http://100.86.16.114:8181
|
||||
# so an off-LAN client works; LAN is :8181 on .20.135).
|
||||
# LARRY_BROKER_URL broker base. Default = the public broker
|
||||
# (https://broker.bjnoela.com); works out of the
|
||||
# box on any network with normal outbound HTTPS.
|
||||
# LARRY_DEPLOYMENT_ID this box's id in the broker registry.
|
||||
# LARRY_ENROLL_SECRET the enrollment secret (or $LARRY_HOME/.enroll-secret).
|
||||
# LARRY_PROFILE "default" | "phi" (phi => wipe local PHI on disable).
|
||||
# LARRY_HEARTBEAT_INTERVAL / LARRY_HEARTBEAT_MAX_MISS (default 60s / 3 misses).
|
||||
LARRY_BROKER_URL="${LARRY_BROKER_URL:-http://100.86.16.114:8181}"
|
||||
LARRY_BROKER_URL="${LARRY_BROKER_URL:-https://broker.bjnoela.com}"
|
||||
LARRY_DEPLOYMENT_ID="${LARRY_DEPLOYMENT_ID:-}"
|
||||
LARRY_PROFILE="${LARRY_PROFILE:-default}"
|
||||
LARRY_HEARTBEAT_INTERVAL="${LARRY_HEARTBEAT_INTERVAL:-60}"
|
||||
@ -1767,8 +1769,11 @@ if [ "$LARRY_AUTH_MODE" = "broker" ] && [ "$LARRY_NO_API" != "1" ]; then
|
||||
[ "${_BROKER_LAST_PROFILE:-$LARRY_PROFILE}" = "phi" ] && _broker_on_disabled
|
||||
else
|
||||
err "broker unreachable while minting a token — fail-closed, refusing to run."
|
||||
err " Reachability: the broker is LAN + Tailscale only. On an egress-restricted box,"
|
||||
err " ensure Tailscale is up and LARRY_BROKER_URL points at the tailnet ($LARRY_BROKER_URL)."
|
||||
err " Reachability: the broker is public at https://broker.bjnoela.com and should be"
|
||||
err " reachable from any network with normal outbound HTTPS. If this box can't reach it,"
|
||||
err " the likely cause is this box's own outbound-HTTPS egress filtering — check that"
|
||||
err " first, or set LARRY_BROKER_URL if Bryan has provisioned a different broker ingress."
|
||||
err " Currently configured: $LARRY_BROKER_URL"
|
||||
fi
|
||||
exit 1
|
||||
fi
|
||||
@ -1787,9 +1792,11 @@ if [ "$LARRY_AUTH_MODE" = "broker" ] && [ "$LARRY_NO_API" != "1" ]; then
|
||||
*)
|
||||
# Unreachable past the budget. This is the documented reachability failure.
|
||||
err "refusing to run: cannot reach the broker at $LARRY_BROKER_URL to confirm authorization (fail-closed)."
|
||||
err " The broker is LAN + Tailscale only (no public route). If this box is on a restricted"
|
||||
err " network, bring Tailscale up so it can reach the tailnet broker, or have Bryan provision"
|
||||
err " a reachable broker ingress. (Escape hatch, NO kill-switch: relaunch LARRY_AUTH_MODE=apikey.)"
|
||||
err " The broker is public at https://broker.bjnoela.com and should be reachable from any"
|
||||
err " network with normal outbound HTTPS. If unreachable, this box's own outbound-HTTPS"
|
||||
err " egress filtering (corporate proxy / SNI block) is the likely cause — check that, or"
|
||||
err " set LARRY_BROKER_URL if Bryan has provisioned a different broker ingress."
|
||||
err " (Escape hatch, NO kill-switch: relaunch LARRY_AUTH_MODE=apikey.)"
|
||||
exit 1
|
||||
;;
|
||||
esac
|
||||
|
||||
@ -26,22 +26,24 @@
|
||||
# treated as "not authorized" — never as "assume OK and keep running".
|
||||
#
|
||||
# REACHABILITY (the critical design tension, flagged for Bryan): broker-mode
|
||||
# means the client MUST reach the broker to function. The broker is LAN +
|
||||
# Tailscale only (no public route). On an egress-restricted box (the Gundersen
|
||||
# Cloudflare block that 28'd git.bjnoela.com), the client reaches the broker over
|
||||
# TAILSCALE (LARRY_BROKER_URL=http://100.86.16.114:8181). If neither LAN nor
|
||||
# Tailscale can reach the broker, broker-mode fail-closes = the agent will not
|
||||
# run. That is a correct KILL state but a useless WORKING state, so a deployment
|
||||
# on a locked-down network MUST have Tailscale (or a future hardened public
|
||||
# broker ingress). See the README "Reachability" section.
|
||||
# means the client MUST reach the broker to function. The broker is PUBLIC at
|
||||
# https://broker.bjnoela.com (authenticated at the edge — CF admin-block,
|
||||
# Traefik deny-all, app-level token checks; /token and /v1/messages both 401
|
||||
# without credentials). That public URL is the default and works from any
|
||||
# network with normal outbound HTTPS — no Tailscale, VPN, or LAN needed. If
|
||||
# a box still can't reach it, the most likely cause is that box's own
|
||||
# outbound-HTTPS egress filtering (corporate proxy / SNI block), not a
|
||||
# broker-side gap. See the README "Reachability" section.
|
||||
#
|
||||
# SOURCING NOTE: pure function defs; no set -e/-u/-o pipefail changes (the caller
|
||||
# owns those). Listed in MANIFEST so it propagates + stays auditable.
|
||||
|
||||
# ── Config (caller sets these before sourcing; sane defaults here) ───────────
|
||||
# LARRY_BROKER_URL broker base URL (LAN: http://192.168.20.135:8181 ;
|
||||
# Tailscale: http://100.86.16.114:8181). Default = tailnet
|
||||
# so an off-LAN client works out of the box.
|
||||
# LARRY_BROKER_URL broker base URL. Default = the public broker
|
||||
# (https://broker.bjnoela.com), authenticated at the
|
||||
# edge, so any client with normal outbound HTTPS works
|
||||
# out of the box. Override only if Bryan provisions a
|
||||
# different broker ingress for your deployment.
|
||||
# LARRY_DEPLOYMENT_ID this deployment's id in the broker registry.
|
||||
# LARRY_ENROLL_SECRET the per-deployment enrollment secret (or in
|
||||
# $LARRY_HOME/.enroll-secret, mode 0600).
|
||||
@ -51,7 +53,7 @@
|
||||
# (default 3). misses are unreachable broker; an
|
||||
# explicit authorized:false fails closed IMMEDIATELY.
|
||||
|
||||
LARRY_BROKER_URL="${LARRY_BROKER_URL:-http://100.86.16.114:8181}"
|
||||
LARRY_BROKER_URL="${LARRY_BROKER_URL:-https://broker.bjnoela.com}"
|
||||
LARRY_DEPLOYMENT_ID="${LARRY_DEPLOYMENT_ID:-}"
|
||||
LARRY_ENROLL_SECRET="${LARRY_ENROLL_SECRET:-}"
|
||||
LARRY_PROFILE="${LARRY_PROFILE:-default}"
|
||||
|
||||
Loading…
Reference in New Issue
Block a user