A website on every address steps aside for websites that name an address on the same port

The wildcard then listens on the machine's other addresses only, in the built-in proxy and in Traefik,
and follows the machine when it gains or loses an address.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

.gitea/workflows/ci.yml

@@ -44,7 +44,7 @@ jobs:
       # Catches platform-specific breakage before a release is tagged.
       - name: Every release platform compiles
         run: |
-          for t in linux/amd64 linux/arm64 linux/arm windows/amd64 darwin/amd64 darwin/arm64; do
+          for t in linux/amd64 windows/amd64; do
             echo "building for $t"
             GOOS=${t%/*} GOARCH=${t#*/} GOARM=7 CGO_ENABLED=0 go build -o /dev/null ./cmd/blacktip
           done

.gitea/workflows/release.yml

@@ -59,4 +59,4 @@ jobs:
             *-*) ;;                       # pre-releases (v1.0.0-rc1) don't move :latest
             *) tags="$tags -t $image:latest" ;;
           esac
-          docker buildx build --platform linux/amd64,linux/arm64 $tags --push .
+          docker buildx build --platform linux/amd64 $tags --push .

README.md

@@ -38,7 +38,7 @@ Settings and secrets can live in a `.env` file instead of the command line; see
 
 ## Deploying
 
-Releases are built by Gitea Actions. Pushing a tag such as `v0.2.0` runs `.gitea/workflows/release.yml`, which tests the code, builds Blacktip for Linux (amd64, arm64, armv7), Windows (amd64) and macOS (amd64, arm64), publishes the archives with a `SHA256SUMS` file on the Releases page, and pushes a multi-architecture container image to this server's registry (`git.veillax.com/veillax/blacktip`). Every push and pull request runs `.gitea/workflows/ci.yml`: formatting, vet, tests, and a check that every release platform still compiles.
+Releases are built by Gitea Actions. Pushing a tag such as `v0.2.0` runs `.gitea/workflows/release.yml`, which tests the code, builds Blacktip for Linux (amd64) and Windows (amd64), publishes the archives with a `SHA256SUMS` file on the Releases page, and pushes a container image (linux/amd64) to this server's registry (`git.veillax.com/veillax/blacktip`). Every push and pull request runs `.gitea/workflows/ci.yml`: formatting, vet, tests, and a check that every release platform still compiles.
 
 **On a Linux server (systemd)**
 
@@ -52,7 +52,7 @@ sudoedit /etc/blacktip/blacktip.env   # your settings and secrets
 sudo systemctl start blacktip
 ```
 
-Use `linux_arm64` or `linux_arm` for Raspberry Pi and other ARM machines. To upgrade, repeat the same steps: your settings and data are kept. `sudo ./install.sh --uninstall` removes the service and binary but leaves `/etc/blacktip` and `/var/lib/blacktip` alone. `blacktip -version` tells you which build is running.
+Releases are published for x86-64 only; for ARM machines build it yourself (`TARGETS=linux/arm64 sh deploy/build.sh`). To upgrade, repeat the same steps: your settings and data are kept. `sudo ./install.sh --uninstall` removes the service and binary but leaves `/etc/blacktip` and `/var/lib/blacktip` alone. `blacktip -version` tells you which build is running.
 
 **Updates**
 

blacktip.go

@@ -38,6 +38,13 @@ type Config struct {
 	DataDir    string
 	Docker     bool // report local Docker containers for discovery
 
+	// Version is the release this binary was built from, reported to Hammerhead. AutoUpdate says
+	// whether the program may update itself; only then does it act on an update request from
+	// Hammerhead, by calling UpdateNow (which normally restarts the process into the new binary).
+	Version    string
+	AutoUpdate bool
+	UpdateNow  func(ctx context.Context, progress func(stage string, pct int, line string)) (newVersion string, err error)
+
 	// Traefik, when its Path is set, serves http/https resources instead of the built-in proxy.
 	Traefik TraefikConfig
 
@@ -106,6 +113,14 @@ type Blacktip struct {
 
 	logq       chan model.LogEntry
 	reportMu   sync.Mutex
+	updating   atomic.Bool
+	addrSig    string // machine addresses a wildcard website was spread across, "" when none was
+	updateMsg  string // outcome of the update Hammerhead asked for, reported back
+	updateID   string // the request that updateMsg answers
+	updStage   string // progress of the running update, reported to Hammerhead
+	updPct     int
+	updLog     []string
+	updSent    time.Time
 	dockerMu   sync.Mutex
 	dockerAt   time.Time
 	dockerList []model.Container
@@ -233,6 +248,50 @@ func (b *Blacktip) fetchConfig(ctx context.Context) (*model.EdgeConfig, error) {
 	return &cfg, json.NewDecoder(resp.Body).Decode(&cfg)
 }
 
+// hostIPv4 lists every IPv4 address on this machine, loopback included: what a wildcard bind covers.
+func hostIPv4() []string {
+	var ips []string
+	addrs, _ := net.InterfaceAddrs()
+	for _, a := range addrs {
+		if ipn, ok := a.(*net.IPNet); ok && ipn.IP.To4() != nil {
+			ips = append(ips, ipn.IP.String())
+		}
+	}
+	sort.Strings(ips)
+	return ips
+}
+
+// bindIPs says which addresses a mapping listens on. Normally that is its own BindIP. A website on
+// 0.0.0.0 steps aside for websites of the same kind that name an address on the same port: it then
+// listens on the machine's other addresses only, so a wildcard never takes a port from a specific IP.
+func bindIPs(m model.Mapping, all []model.Mapping) []string {
+	if !model.Web(m.Proto) {
+		return []string{m.BindIP}
+	}
+	if ip := net.ParseIP(m.BindIP); ip == nil || !ip.IsUnspecified() {
+		return []string{m.BindIP}
+	}
+	named := map[string]bool{}
+	for _, o := range all {
+		if o.ID == m.ID || o.Proto != m.Proto || o.Port != m.Port {
+			continue
+		}
+		if ip := net.ParseIP(o.BindIP); ip != nil && !ip.IsUnspecified() {
+			named[ip.String()] = true
+		}
+	}
+	if len(named) == 0 {
+		return []string{m.BindIP}
+	}
+	var out []string
+	for _, ip := range hostIPv4() {
+		if !named[ip] {
+			out = append(out, ip)
+		}
+	}
+	return out
+}
+
 func listenKey(m model.Mapping) string {
 	n := "tcp"
 	if m.Proto == model.ProtoUDP {
@@ -252,6 +311,9 @@ func (b *Blacktip) apply(cfg *model.EdgeConfig) {
 	if b.dashboard == "" {
 		b.dashboard = b.cfg.Hammerhead
 	}
+	if cfg.UpdateID != "" {
+		b.requestUpdate(cfg.UpdateID)
+	}
 	b.local = map[string]bool{}
 	for _, id := range cfg.Local {
 		b.local[id] = true
@@ -294,9 +356,10 @@ func (b *Blacktip) apply(cfg *model.EdgeConfig) {
 			continue
 		}
 		// a range opens one listener per port; each shifts the target port by its offset
+		for _, ip := range bindIPs(m, cfg.Mappings) {
 			for p := m.Port; p <= m.LastPort(); p++ {
 				mm := m
-			mm.Port = p
+				mm.BindIP, mm.Port = ip, p
 				k := listenKey(mm)
 				if want[k] == nil {
 					want[k] = &bindSet{off: p - m.Port}
@@ -304,16 +367,19 @@ func (b *Blacktip) apply(cfg *model.EdgeConfig) {
 				want[k].ms = append(want[k].ms, b.maps[m.ID])
 			}
 		}
+	}
 	// https ports can also answer on :80 with a redirect, unless something else owns that port
 	redirects := map[string][]*mapState{}
 	for _, m := range cfg.Mappings {
 		if b.tr == nil && m.Proto == model.ProtoHTTPS && m.RedirectHTTP {
-			k := "tcp|" + net.JoinHostPort(m.BindIP, "80")
+			for _, ip := range bindIPs(m, cfg.Mappings) {
+				k := "tcp|" + net.JoinHostPort(ip, "80")
 				if _, taken := want[k]; !taken {
 					redirects[k] = append(redirects[k], b.maps[m.ID])
 				}
 			}
 		}
+	}
 
 	for k, l := range b.listeners {
 		_, w := want[k]
@@ -323,6 +389,13 @@ func (b *Blacktip) apply(cfg *model.EdgeConfig) {
 			delete(b.listeners, k)
 		}
 	}
+	b.addrSig = ""
+	for _, m := range cfg.Mappings {
+		if ips := bindIPs(m, cfg.Mappings); len(ips) != 1 || ips[0] != m.BindIP {
+			b.addrSig = strings.Join(hostIPv4(), ",")
+			break
+		}
+	}
 	b.status = map[string]string{}
 	bring := func(k string, ms []*mapState, off int, redirect bool) {
 		if l, ok := b.listeners[k]; ok {
@@ -332,7 +405,9 @@ func (b *Blacktip) apply(cfg *model.EdgeConfig) {
 			l.close()
 			delete(b.listeners, k)
 		}
-		l, err := b.open(ms, off, redirect)
+		_, addr, _ := strings.Cut(k, "|")
+		host, _, _ := net.SplitHostPort(addr)
+		l, err := b.open(host, ms, off, redirect)
 		if err != nil {
 			log.Printf("open %s: %v", k, err)
 			if !redirect {
@@ -359,7 +434,11 @@ func (b *Blacktip) apply(cfg *model.EdgeConfig) {
 		bring(k, ms, 0, true)
 	}
 	if b.tr != nil {
-		b.tr.sync(b.ctx, webMaps, cfg.AcmeEmail, cfg.AcmeStages)
+		binds := map[string][]string{}
+		for _, ms := range webMaps {
+			binds[ms.m.ID] = bindIPs(ms.m, cfg.Mappings)
+		}
+		b.tr.sync(b.ctx, webMaps, binds, cfg.AcmeEmail, cfg.AcmeStages)
 		if e := b.tr.err(); e != "" {
 			for _, ms := range webMaps {
 				b.status[ms.m.ID] = e
@@ -517,8 +596,11 @@ func (b *Blacktip) report() {
 		IPs: localIPs(), PublicKey: b.wgPub,
 		Status: map[string]model.MappingStatus{}, Stats: map[string]model.Stat{},
 		Containers: b.containers(), MailChecks: map[string]model.MailCheck{},
+		Version: b.cfg.Version, AutoUpdate: b.cfg.AutoUpdate,
 	}
 	b.mu.Lock()
+	rep.UpdateMsg, rep.UpdateID = b.updateMsg, b.updateID
+	rep.UpdateStage, rep.UpdatePct, rep.UpdateLog = b.updStage, b.updPct, append([]string(nil), b.updLog...)
 	for id, chk := range b.mailChecks {
 		rep.MailChecks[id] = chk
 	}
@@ -565,10 +647,25 @@ func (b *Blacktip) reportLoop(ctx context.Context) {
 			return
 		case <-t.C:
 			b.report()
+			b.recheckAddresses()
 		}
 	}
 }
 
+// recheckAddresses re-applies the config when this machine gains or loses an address that a wildcard
+// website is spread across, so the listeners follow the machine.
+func (b *Blacktip) recheckAddresses() {
+	b.mu.Lock()
+	last, sig := b.last, b.addrSig
+	b.mu.Unlock()
+	if last == nil || sig == "" {
+		return
+	}
+	if strings.Join(hostIPv4(), ",") != sig {
+		b.apply(last)
+	}
+}
+
 // ---------- access logs ----------
 
 func (b *Blacktip) logAccess(e model.LogEntry) {
@@ -736,3 +833,73 @@ func (ms *mapState) dialOff(proto string, prefer, off int) (net.Conn, bool, erro
 	}
 	return nil, false, last
 }
+
+// requestUpdate acts on "update now" from Hammerhead (id identifies the request). It only ever installs
+// what this machine's own auto-update would (the newest release from its configured server), and only
+// when auto-update is on. Caller holds b.mu.
+func (b *Blacktip) requestUpdate(id string) {
+	if id == b.updateID {
+		return // already handled, or in progress
+	}
+	b.updateID, b.updateMsg = id, ""
+	b.updStage, b.updPct, b.updLog = "starting", 0, nil
+	b.updNote("Update requested from the dashboard")
+	if !b.cfg.AutoUpdate || b.cfg.UpdateNow == nil {
+		b.updateMsg = "auto-update is off on this machine (set BLACKTIP_AUTO_UPDATE=1 and restart it)"
+		b.updStage = "failed"
+		b.updNote("Refused: " + b.updateMsg)
+		go b.report()
+		return
+	}
+	if !b.updating.CompareAndSwap(false, true) {
+		b.updateMsg = "another update is already running"
+		b.updStage = "failed"
+		b.updNote("Refused: " + b.updateMsg)
+		go b.report()
+		return
+	}
+	go func() {
+		defer b.updating.Store(false)
+		tag, err := b.cfg.UpdateNow(b.ctx, b.updProgress) // on success this restarts the process and does not return
+		b.mu.Lock()
+		switch {
+		case err != nil:
+			b.updateMsg = "update failed: " + err.Error()
+		case tag == "":
+			b.updateMsg = "already on the newest release"
+		default:
+			b.updateMsg = "updated to " + tag + ", restarting"
+		}
+		b.mu.Unlock()
+		b.report()
+	}()
+}
+
+// updNote adds a timestamped line to the update log. Caller holds b.mu.
+func (b *Blacktip) updNote(line string) {
+	b.updLog = append(b.updLog, time.Now().Format("15:04:05")+" "+line)
+	if len(b.updLog) > 200 {
+		b.updLog = b.updLog[len(b.updLog)-200:]
+	}
+}
+
+// updProgress is called by the updater as it works; Hammerhead gets a fresh report at most once a
+// second (and straight away for every new log line), so its progress bar follows along.
+func (b *Blacktip) updProgress(stage string, pct int, line string) {
+	b.mu.Lock()
+	b.updStage = stage
+	if pct >= 0 {
+		b.updPct = pct
+	}
+	if line != "" {
+		b.updNote(line)
+	}
+	send := line != "" || time.Since(b.updSent) > time.Second
+	if send {
+		b.updSent = time.Now()
+	}
+	b.mu.Unlock()
+	if send {
+		go b.report()
+	}
+}

cmd/blacktip/main.go

@@ -50,9 +50,16 @@ func main() {
 		flag.Usage()
 		os.Exit(2)
 	}
+	upd := selfupdate.Config{Server: "https://git.veillax.com", Repo: "Veillax/blacktip", App: "blacktip", Current: version, Logf: log.Printf}
 	b, err := blacktip.New(blacktip.Config{
 		Hammerhead: strings.TrimRight(*hh, "/"), Token: *token, TunnelAddr: *tun, DataDir: *data, Docker: *dockerOn,
 		Traefik: blacktip.TraefikConfig{Path: *traefikPath, ACMEDNS: *acmeDNS, NoACME: *noACME},
+		Version: version, AutoUpdate: *autoUpdate,
+		UpdateNow: func(ctx context.Context, progress func(string, int, string)) (string, error) {
+			c := upd
+			c.Progress = func(e selfupdate.Event) { progress(e.Stage, e.Pct, e.Line) }
+			return selfupdate.CheckOnce(ctx, c)
+		},
 	})
 	if err != nil {
 		log.Fatal(err)
@@ -61,7 +68,7 @@ func main() {
 	ctx, stop := signal.NotifyContext(context.Background(), os.Interrupt)
 	defer stop()
 	if *autoUpdate {
-		go selfupdate.Run(ctx, selfupdate.Config{Server: "https://git.veillax.com", Repo: "Veillax/blacktip", App: "blacktip", Current: version, Logf: log.Printf})
+		go selfupdate.Run(ctx, upd)
 	}
 	if err := b.Run(ctx); err != nil {
 		log.Fatal(err)

deploy/build.sh

@@ -8,12 +8,13 @@
 #   dist/blacktip_<version>_<os>_<arch>.tar.gz or .zip
 #   dist/SHA256SUMS
 #
-# Set TARGETS="linux/amd64 linux/arm64" to build fewer platforms.
+# Releases are published for linux/amd64 and windows/amd64 only. Set TARGETS="linux/arm64 darwin/arm64"
+# (any GOOS/GOARCH pair Go supports) to build something else by hand.
 set -eu
 NAME=blacktip
 cd "$(dirname "$0")/.."
 VERSION=${1:-$(git describe --tags --always 2>/dev/null || echo dev)}
-TARGETS=${TARGETS:-"linux/amd64 linux/arm64 linux/arm windows/amd64 darwin/amd64 darwin/arm64"}
+TARGETS=${TARGETS:-"linux/amd64 windows/amd64"}
 
 rm -rf dist
 mkdir -p dist/bin dist/stage

deploy/publish-release.sh

@@ -42,19 +42,30 @@ else
 	echo "release $TAG already exists (id $id): replacing its files"
 fi
 
-existing=$(curl -fsS -H "$AUTH" "$API/releases/$id/assets" | json 'import sys, json
+# the ids of the release's assets with a given name (a failed upload can leave a partial one behind)
+asset_ids() {
+	curl -fsS -H "$AUTH" "$API/releases/$id/assets" | "$PY" -c 'import sys, json
 for a in json.load(sys.stdin):
-    print(a["id"], a["name"])')
+    if a["name"] == sys.argv[1]:
+        print(a["id"])' "$1"
+}
 
 for f in dist/*.tar.gz dist/*.zip dist/SHA256SUMS; do
 	[ -f "$f" ] || continue
 	name=$(basename "$f")
-	echo "$existing" | while read -r aid aname; do
+	n=1
-		if [ "$aname" = "$name" ]; then
+	while :; do
+		for aid in $(asset_ids "$name"); do
 			curl -fsS -X DELETE -H "$AUTH" "$API/releases/$id/assets/$aid" > /dev/null
-		fi
 		done
-	echo "uploading $name"
+		echo "uploading $name (attempt $n)"
-	curl -fsS -X POST -H "$AUTH" -F "attachment=@$f" "$API/releases/$id/assets?name=$name" > /dev/null
+		if curl -fsS --max-time 1200 -X POST -H "$AUTH" -F "attachment=@$f" "$API/releases/$id/assets?name=$name" > /dev/null; then
+			break
+		fi
+		# large uploads can hit a proxy timeout (HTTP 502); try again
+		[ "$n" -lt 5 ] || { echo "giving up on $name after $n attempts" >&2; exit 1; }
+		n=$((n + 1))
+		sleep $((n * 10))
+	done
 done
 echo "published $SERVER/$REPO/releases/tag/$TAG"

go.mod

@@ -3,7 +3,7 @@ module git.veillax.com/Veillax/blacktip
 go 1.27.3
 
 require (
-	git.veillax.com/Veillax/reef v0.1.3
+	git.veillax.com/Veillax/reef v0.1.7
 	github.com/emersion/go-msgauth v0.7.0
 	golang.org/x/crypto v0.58.0
 )

go.sum

@@ -2,6 +2,12 @@ git.veillax.com/Veillax/reef v0.1.0 h1:O0OhEKFx2CsvACJ20sfzJNjGsngomtfDdKdxu4ROp
 git.veillax.com/Veillax/reef v0.1.0/go.mod h1:ZBUd/BARO5kkpUNTP81TTY1aQXLHFR6bKDhCxckjHso=
 git.veillax.com/Veillax/reef v0.1.3 h1:RxSq2xwaup1+MieAkhlvOTZnYwPf19thFHEAe/7VxsI=
 git.veillax.com/Veillax/reef v0.1.3/go.mod h1:ZBUd/BARO5kkpUNTP81TTY1aQXLHFR6bKDhCxckjHso=
+git.veillax.com/Veillax/reef v0.1.5 h1:BydjLJsfGgU4zEIqUsePJRjPi9NgbFdmvq0M8dvJCgM=
+git.veillax.com/Veillax/reef v0.1.5/go.mod h1:ZBUd/BARO5kkpUNTP81TTY1aQXLHFR6bKDhCxckjHso=
+git.veillax.com/Veillax/reef v0.1.6 h1:NgZ4u2Z3hJ+BYD/zX9lov8fox4s2i8txtYNOpIsikVo=
+git.veillax.com/Veillax/reef v0.1.6/go.mod h1:ZBUd/BARO5kkpUNTP81TTY1aQXLHFR6bKDhCxckjHso=
+git.veillax.com/Veillax/reef v0.1.7 h1:5C2udonlJac2xvDOE5e+zDxej+AbZ9ttrNSE4owmwuU=
+git.veillax.com/Veillax/reef v0.1.7/go.mod h1:ZBUd/BARO5kkpUNTP81TTY1aQXLHFR6bKDhCxckjHso=
 github.com/Microsoft/go-winio v0.6.4 h1:kJF2pamtYCWXf0xAT8sAkwKC0pMl2HYBrRPHAqyUc+g=
 github.com/Microsoft/go-winio v0.6.4/go.mod h1:1xl5JXG4ze/m74GH6Dc4Mwxfc3VL5siRVQjIAlHH07U=
 github.com/emersion/go-msgauth v0.7.0 h1:vj2hMn6KhFtW41kshIBTXvp6KgYSqpA/ZN9Pv4g1INc=

listener.go

@@ -35,12 +35,12 @@ type listener struct {
 	sessions map[string]*udpSession
 }
 
-func (b *Blacktip) open(ms []*mapState, off int, redirect bool) (*listener, error) {
+func (b *Blacktip) open(ip string, ms []*mapState, off int, redirect bool) (*listener, error) {
 	m := ms[0].m
-	addr := net.JoinHostPort(m.BindIP, strconv.Itoa(m.Port+off))
+	addr := net.JoinHostPort(ip, strconv.Itoa(m.Port+off))
 	l := &listener{b: b, kind: m.Proto, redirect: redirect, maps: ms, off: off, done: make(chan struct{}), sessions: map[string]*udpSession{}}
 	if redirect {
-		addr = net.JoinHostPort(m.BindIP, "80")
+		addr = net.JoinHostPort(ip, "80")
 		l.kind = model.ProtoHTTP
 	}
 	if m.Proto == model.ProtoUDP {

traefik.go

@@ -49,6 +49,7 @@ type traefikMgr struct {
 	stop      context.CancelFunc // stops the current traefik process
 	lastErr   string
 	maps      map[string]*mapState
+	binds     map[string][]string // mapping ID -> the addresses it listens on (a wildcard steps aside for named ones)
 	ports     map[string]int      // mapping ID -> relay port, kept stable across edits so Traefik's backend URL never changes
 	dynBytes  []byte
 }
@@ -217,20 +218,23 @@ func hostRule(host string) (string, bool) {
 
 // sync rewrites Traefik's configuration for the given web mappings and
 // (re)starts the process if its static part changed. Called with b.mu held.
-func (t *traefikMgr) sync(ctx context.Context, maps []*mapState, acmeEmail string, staging bool) {
+func (t *traefikMgr) sync(ctx context.Context, maps []*mapState, binds map[string][]string, acmeEmail string, staging bool) {
 	t.mu.Lock()
 	defer t.mu.Unlock()
+	t.binds = binds
 	t.maps = map[string]*mapState{}
 	eps := map[string]string{} // name -> address
 	needACME := false
 	for _, ms := range maps {
 		t.maps[ms.m.ID] = ms
-		eps[epName(ms.m.BindIP, ms.m.Port)] = net.JoinHostPort(ms.m.BindIP, strconv.Itoa(ms.m.Port))
+		for _, ip := range t.bindsOf(ms.m) {
+			eps[epName(ip, ms.m.Port)] = net.JoinHostPort(ip, strconv.Itoa(ms.m.Port))
+			if ms.m.Proto == model.ProtoHTTPS && ms.m.RedirectHTTP {
+				eps[epName(ip, 80)] = net.JoinHostPort(ip, "80")
+			}
+		}
 		if ms.m.Proto == model.ProtoHTTPS {
 			needACME = true
-			if ms.m.RedirectHTTP {
-				eps[epName(ms.m.BindIP, 80)] = net.JoinHostPort(ms.m.BindIP, "80")
-			}
 		}
 	}
 	routers := map[string]any{}
@@ -244,7 +248,11 @@ func (t *traefikMgr) sync(ctx context.Context, maps []*mapState, acmeEmail strin
 			continue
 		}
 		rule, wildcard := hostRule(m.Hostname)
-		ep := epName(m.BindIP, m.Port)
+		var mainEPs, redirEPs []string
+		for _, ip := range t.bindsOf(m) {
+			mainEPs = append(mainEPs, epName(ip, m.Port))
+			redirEPs = append(redirEPs, epName(ip, 80))
+		}
 		prio := 5000
 		if wildcard {
 			prio = 2000
@@ -274,7 +282,7 @@ func (t *traefikMgr) sync(ctx context.Context, maps []*mapState, acmeEmail strin
 			mws["host-"+m.ID] = map[string]any{"headers": map[string]any{"customRequestHeaders": map[string]string{"Host": m.RewriteHost}}}
 			chain = append(chain, "host-"+m.ID)
 		}
-		router := map[string]any{"rule": rule, "entryPoints": []string{ep}, "service": "s-" + m.ID, "middlewares": chain, "priority": prio}
+		router := map[string]any{"rule": rule, "entryPoints": mainEPs, "service": "s-" + m.ID, "middlewares": chain, "priority": prio}
 		var tlsCfg map[string]any
 		if m.Proto == model.ProtoHTTPS {
 			tlsCfg = map[string]any{}
@@ -292,7 +300,7 @@ func (t *traefikMgr) sync(ctx context.Context, maps []*mapState, acmeEmail strin
 			services["g-"+m.ID] = map[string]any{"loadBalancer": map[string]any{
 				"servers": []map[string]string{{"url": fmt.Sprintf("http://127.0.0.1:%d", t.gatePort)}}, "passHostHeader": true}}
 			mws["gate-"+m.ID] = map[string]any{"headers": map[string]any{"customRequestHeaders": map[string]string{"X-Hammerhead-Mapping": m.ID}}}
-			g := map[string]any{"rule": rule + " && PathPrefix(`/.hammerhead/`)", "entryPoints": []string{ep}, "service": "g-" + m.ID,
+			g := map[string]any{"rule": rule + " && PathPrefix(`/.hammerhead/`)", "entryPoints": mainEPs, "service": "g-" + m.ID,
 				"middlewares": []string{"gate-" + m.ID}, "priority": prio + 1000}
 			if tlsCfg != nil {
 				g["tls"] = tlsCfg
@@ -305,7 +313,7 @@ func (t *traefikMgr) sync(ctx context.Context, maps []*mapState, acmeEmail strin
 				redirPort = strconv.Itoa(m.Port)
 			}
 			mws["redir-"+m.ID] = map[string]any{"redirectScheme": map[string]any{"scheme": "https", "port": redirPort, "permanent": true}}
-			routers["r-"+m.ID] = map[string]any{"rule": rule, "entryPoints": []string{epName(m.BindIP, 80)}, "service": "noop@internal",
+			routers["r-"+m.ID] = map[string]any{"rule": rule, "entryPoints": redirEPs, "service": "noop@internal",
 				"middlewares": []string{"redir-" + m.ID}, "priority": prio}
 		}
 	}
@@ -545,10 +553,7 @@ func (t *traefikMgr) probeCerts(ctx context.Context) {
 		t.mu.Unlock()
 		changed := false
 		for _, ms := range targets {
-			ip := ms.m.BindIP
+			ip := t.probeAddr(ms.m)
-			if pip := net.ParseIP(ip); pip != nil && pip.IsUnspecified() {
-				ip = "127.0.0.1"
-			}
 			status := t.probeOne(net.JoinHostPort(ip, strconv.Itoa(ms.m.Port)), ms.m.Hostname)
 			t.b.mu.Lock()
 			if t.b.acme.certs == nil {
@@ -598,3 +603,27 @@ func containsStr(list []string, s string) bool {
 	}
 	return false
 }
+
+// bindsOf is the addresses a web mapping listens on; t.mu is held, or the caller does not race sync.
+func (t *traefikMgr) bindsOf(m model.Mapping) []string {
+	if ips := t.binds[m.ID]; len(ips) > 0 {
+		return ips
+	}
+	return []string{m.BindIP}
+}
+
+// probeAddr picks an address on this machine to test a mapping's certificate through.
+func (t *traefikMgr) probeAddr(m model.Mapping) string {
+	t.mu.Lock()
+	ips := t.bindsOf(m)
+	t.mu.Unlock()
+	for _, ip := range ips {
+		if ip == "127.0.0.1" {
+			return ip
+		}
+	}
+	if p := net.ParseIP(ips[0]); p != nil && p.IsUnspecified() {
+		return "127.0.0.1"
+	}
+	return ips[0]
+}

yield_test.go

@@ -0,0 +1,37 @@
+package blacktip
+
+import (
+	"testing"
+
+	"git.veillax.com/Veillax/reef/model"
+)
+
+func TestWildcardWebsitesStepAsideForNamedAddresses(t *testing.T) {
+	all := []model.Mapping{
+		{ID: "a", Proto: model.ProtoHTTPS, BindIP: "0.0.0.0", Port: 443, Hostname: "a.test"},
+		{ID: "b", Proto: model.ProtoHTTPS, BindIP: "127.0.0.1", Port: 443, Hostname: "b.test"},
+		{ID: "c", Proto: model.ProtoHTTPS, BindIP: "0.0.0.0", Port: 8443, Hostname: "c.test"},
+		{ID: "d", Proto: model.ProtoTCP, BindIP: "0.0.0.0", Port: 443},
+	}
+	// the wildcard on 443 gives up the address that "b" names
+	for _, ip := range bindIPs(all[0], all) {
+		if ip == "127.0.0.1" {
+			t.Fatalf("wildcard still listens on 127.0.0.1: %v", bindIPs(all[0], all))
+		}
+	}
+	// the named address keeps its own listener
+	if got := bindIPs(all[1], all); len(got) != 1 || got[0] != "127.0.0.1" {
+		t.Fatalf("named mapping: %v", got)
+	}
+	// a different port, or a raw TCP port, is not affected
+	if got := bindIPs(all[2], all); len(got) != 1 || got[0] != "0.0.0.0" {
+		t.Fatalf("other port: %v", got)
+	}
+	if got := bindIPs(all[3], all); len(got) != 1 || got[0] != "0.0.0.0" {
+		t.Fatalf("raw tcp: %v", got)
+	}
+	// with nothing named on that port the wildcard stays a single wildcard listener
+	if got := bindIPs(all[0], all[:1]); len(got) != 1 || got[0] != "0.0.0.0" {
+		t.Fatalf("alone: %v", got)
+	}
+}