A website on every address steps aside for websites that name an address on the same port

The wildcard then listens on the machine's other addresses only, in the built-in proxy and in Traefik,
and follows the machine when it gains or loses an address.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

blacktip.go

@@ -114,6 +114,7 @@ type Blacktip struct {
 	logq       chan model.LogEntry
 	reportMu   sync.Mutex
 	updating   atomic.Bool
+	addrSig    string // machine addresses a wildcard website was spread across, "" when none was
 	updateMsg  string // outcome of the update Hammerhead asked for, reported back
 	updateID   string // the request that updateMsg answers
 	updStage   string // progress of the running update, reported to Hammerhead
@@ -247,6 +248,50 @@ func (b *Blacktip) fetchConfig(ctx context.Context) (*model.EdgeConfig, error) {
 	return &cfg, json.NewDecoder(resp.Body).Decode(&cfg)
 }
 
+// hostIPv4 lists every IPv4 address on this machine, loopback included: what a wildcard bind covers.
+func hostIPv4() []string {
+	var ips []string
+	addrs, _ := net.InterfaceAddrs()
+	for _, a := range addrs {
+		if ipn, ok := a.(*net.IPNet); ok && ipn.IP.To4() != nil {
+			ips = append(ips, ipn.IP.String())
+		}
+	}
+	sort.Strings(ips)
+	return ips
+}
+
+// bindIPs says which addresses a mapping listens on. Normally that is its own BindIP. A website on
+// 0.0.0.0 steps aside for websites of the same kind that name an address on the same port: it then
+// listens on the machine's other addresses only, so a wildcard never takes a port from a specific IP.
+func bindIPs(m model.Mapping, all []model.Mapping) []string {
+	if !model.Web(m.Proto) {
+		return []string{m.BindIP}
+	}
+	if ip := net.ParseIP(m.BindIP); ip == nil || !ip.IsUnspecified() {
+		return []string{m.BindIP}
+	}
+	named := map[string]bool{}
+	for _, o := range all {
+		if o.ID == m.ID || o.Proto != m.Proto || o.Port != m.Port {
+			continue
+		}
+		if ip := net.ParseIP(o.BindIP); ip != nil && !ip.IsUnspecified() {
+			named[ip.String()] = true
+		}
+	}
+	if len(named) == 0 {
+		return []string{m.BindIP}
+	}
+	var out []string
+	for _, ip := range hostIPv4() {
+		if !named[ip] {
+			out = append(out, ip)
+		}
+	}
+	return out
+}
+
 func listenKey(m model.Mapping) string {
 	n := "tcp"
 	if m.Proto == model.ProtoUDP {
@@ -311,23 +356,27 @@ func (b *Blacktip) apply(cfg *model.EdgeConfig) {
 			continue
 		}
 		// a range opens one listener per port; each shifts the target port by its offset
-		for p := m.Port; p <= m.LastPort(); p++ {
-			mm := m
-			mm.Port = p
-			k := listenKey(mm)
-			if want[k] == nil {
-				want[k] = &bindSet{off: p - m.Port}
+		for _, ip := range bindIPs(m, cfg.Mappings) {
+			for p := m.Port; p <= m.LastPort(); p++ {
+				mm := m
+				mm.BindIP, mm.Port = ip, p
+				k := listenKey(mm)
+				if want[k] == nil {
+					want[k] = &bindSet{off: p - m.Port}
+				}
+				want[k].ms = append(want[k].ms, b.maps[m.ID])
 			}
-			want[k].ms = append(want[k].ms, b.maps[m.ID])
 		}
 	}
 	// https ports can also answer on :80 with a redirect, unless something else owns that port
 	redirects := map[string][]*mapState{}
 	for _, m := range cfg.Mappings {
 		if b.tr == nil && m.Proto == model.ProtoHTTPS && m.RedirectHTTP {
-			k := "tcp|" + net.JoinHostPort(m.BindIP, "80")
-			if _, taken := want[k]; !taken {
-				redirects[k] = append(redirects[k], b.maps[m.ID])
+			for _, ip := range bindIPs(m, cfg.Mappings) {
+				k := "tcp|" + net.JoinHostPort(ip, "80")
+				if _, taken := want[k]; !taken {
+					redirects[k] = append(redirects[k], b.maps[m.ID])
+				}
 			}
 		}
 	}
@@ -340,6 +389,13 @@ func (b *Blacktip) apply(cfg *model.EdgeConfig) {
 			delete(b.listeners, k)
 		}
 	}
+	b.addrSig = ""
+	for _, m := range cfg.Mappings {
+		if ips := bindIPs(m, cfg.Mappings); len(ips) != 1 || ips[0] != m.BindIP {
+			b.addrSig = strings.Join(hostIPv4(), ",")
+			break
+		}
+	}
 	b.status = map[string]string{}
 	bring := func(k string, ms []*mapState, off int, redirect bool) {
 		if l, ok := b.listeners[k]; ok {
@@ -349,7 +405,9 @@ func (b *Blacktip) apply(cfg *model.EdgeConfig) {
 			l.close()
 			delete(b.listeners, k)
 		}
-		l, err := b.open(ms, off, redirect)
+		_, addr, _ := strings.Cut(k, "|")
+		host, _, _ := net.SplitHostPort(addr)
+		l, err := b.open(host, ms, off, redirect)
 		if err != nil {
 			log.Printf("open %s: %v", k, err)
 			if !redirect {
@@ -376,7 +434,11 @@ func (b *Blacktip) apply(cfg *model.EdgeConfig) {
 		bring(k, ms, 0, true)
 	}
 	if b.tr != nil {
-		b.tr.sync(b.ctx, webMaps, cfg.AcmeEmail, cfg.AcmeStages)
+		binds := map[string][]string{}
+		for _, ms := range webMaps {
+			binds[ms.m.ID] = bindIPs(ms.m, cfg.Mappings)
+		}
+		b.tr.sync(b.ctx, webMaps, binds, cfg.AcmeEmail, cfg.AcmeStages)
 		if e := b.tr.err(); e != "" {
 			for _, ms := range webMaps {
 				b.status[ms.m.ID] = e
@@ -585,10 +647,25 @@ func (b *Blacktip) reportLoop(ctx context.Context) {
 			return
 		case <-t.C:
 			b.report()
+			b.recheckAddresses()
 		}
 	}
 }
 
+// recheckAddresses re-applies the config when this machine gains or loses an address that a wildcard
+// website is spread across, so the listeners follow the machine.
+func (b *Blacktip) recheckAddresses() {
+	b.mu.Lock()
+	last, sig := b.last, b.addrSig
+	b.mu.Unlock()
+	if last == nil || sig == "" {
+		return
+	}
+	if strings.Join(hostIPv4(), ",") != sig {
+		b.apply(last)
+	}
+}
+
 // ---------- access logs ----------
 
 func (b *Blacktip) logAccess(e model.LogEntry) {

listener.go

@@ -35,12 +35,12 @@ type listener struct {
 	sessions map[string]*udpSession
 }
 
-func (b *Blacktip) open(ms []*mapState, off int, redirect bool) (*listener, error) {
+func (b *Blacktip) open(ip string, ms []*mapState, off int, redirect bool) (*listener, error) {
 	m := ms[0].m
-	addr := net.JoinHostPort(m.BindIP, strconv.Itoa(m.Port+off))
+	addr := net.JoinHostPort(ip, strconv.Itoa(m.Port+off))
 	l := &listener{b: b, kind: m.Proto, redirect: redirect, maps: ms, off: off, done: make(chan struct{}), sessions: map[string]*udpSession{}}
 	if redirect {
-		addr = net.JoinHostPort(m.BindIP, "80")
+		addr = net.JoinHostPort(ip, "80")
 		l.kind = model.ProtoHTTP
 	}
 	if m.Proto == model.ProtoUDP {

traefik.go

@@ -49,7 +49,8 @@ type traefikMgr struct {
 	stop      context.CancelFunc // stops the current traefik process
 	lastErr   string
 	maps      map[string]*mapState
-	ports     map[string]int // mapping ID -> relay port, kept stable across edits so Traefik's backend URL never changes
+	binds     map[string][]string // mapping ID -> the addresses it listens on (a wildcard steps aside for named ones)
+	ports     map[string]int      // mapping ID -> relay port, kept stable across edits so Traefik's backend URL never changes
 	dynBytes  []byte
 }
 
@@ -217,20 +218,23 @@ func hostRule(host string) (string, bool) {
 
 // sync rewrites Traefik's configuration for the given web mappings and
 // (re)starts the process if its static part changed. Called with b.mu held.
-func (t *traefikMgr) sync(ctx context.Context, maps []*mapState, acmeEmail string, staging bool) {
+func (t *traefikMgr) sync(ctx context.Context, maps []*mapState, binds map[string][]string, acmeEmail string, staging bool) {
 	t.mu.Lock()
 	defer t.mu.Unlock()
+	t.binds = binds
 	t.maps = map[string]*mapState{}
 	eps := map[string]string{} // name -> address
 	needACME := false
 	for _, ms := range maps {
 		t.maps[ms.m.ID] = ms
-		eps[epName(ms.m.BindIP, ms.m.Port)] = net.JoinHostPort(ms.m.BindIP, strconv.Itoa(ms.m.Port))
+		for _, ip := range t.bindsOf(ms.m) {
+			eps[epName(ip, ms.m.Port)] = net.JoinHostPort(ip, strconv.Itoa(ms.m.Port))
+			if ms.m.Proto == model.ProtoHTTPS && ms.m.RedirectHTTP {
+				eps[epName(ip, 80)] = net.JoinHostPort(ip, "80")
+			}
+		}
 		if ms.m.Proto == model.ProtoHTTPS {
 			needACME = true
-			if ms.m.RedirectHTTP {
-				eps[epName(ms.m.BindIP, 80)] = net.JoinHostPort(ms.m.BindIP, "80")
-			}
 		}
 	}
 	routers := map[string]any{}
@@ -244,7 +248,11 @@ func (t *traefikMgr) sync(ctx context.Context, maps []*mapState, acmeEmail strin
 			continue
 		}
 		rule, wildcard := hostRule(m.Hostname)
-		ep := epName(m.BindIP, m.Port)
+		var mainEPs, redirEPs []string
+		for _, ip := range t.bindsOf(m) {
+			mainEPs = append(mainEPs, epName(ip, m.Port))
+			redirEPs = append(redirEPs, epName(ip, 80))
+		}
 		prio := 5000
 		if wildcard {
 			prio = 2000
@@ -274,7 +282,7 @@ func (t *traefikMgr) sync(ctx context.Context, maps []*mapState, acmeEmail strin
 			mws["host-"+m.ID] = map[string]any{"headers": map[string]any{"customRequestHeaders": map[string]string{"Host": m.RewriteHost}}}
 			chain = append(chain, "host-"+m.ID)
 		}
-		router := map[string]any{"rule": rule, "entryPoints": []string{ep}, "service": "s-" + m.ID, "middlewares": chain, "priority": prio}
+		router := map[string]any{"rule": rule, "entryPoints": mainEPs, "service": "s-" + m.ID, "middlewares": chain, "priority": prio}
 		var tlsCfg map[string]any
 		if m.Proto == model.ProtoHTTPS {
 			tlsCfg = map[string]any{}
@@ -292,7 +300,7 @@ func (t *traefikMgr) sync(ctx context.Context, maps []*mapState, acmeEmail strin
 			services["g-"+m.ID] = map[string]any{"loadBalancer": map[string]any{
 				"servers": []map[string]string{{"url": fmt.Sprintf("http://127.0.0.1:%d", t.gatePort)}}, "passHostHeader": true}}
 			mws["gate-"+m.ID] = map[string]any{"headers": map[string]any{"customRequestHeaders": map[string]string{"X-Hammerhead-Mapping": m.ID}}}
-			g := map[string]any{"rule": rule + " && PathPrefix(`/.hammerhead/`)", "entryPoints": []string{ep}, "service": "g-" + m.ID,
+			g := map[string]any{"rule": rule + " && PathPrefix(`/.hammerhead/`)", "entryPoints": mainEPs, "service": "g-" + m.ID,
 				"middlewares": []string{"gate-" + m.ID}, "priority": prio + 1000}
 			if tlsCfg != nil {
 				g["tls"] = tlsCfg
@@ -305,7 +313,7 @@ func (t *traefikMgr) sync(ctx context.Context, maps []*mapState, acmeEmail strin
 				redirPort = strconv.Itoa(m.Port)
 			}
 			mws["redir-"+m.ID] = map[string]any{"redirectScheme": map[string]any{"scheme": "https", "port": redirPort, "permanent": true}}
-			routers["r-"+m.ID] = map[string]any{"rule": rule, "entryPoints": []string{epName(m.BindIP, 80)}, "service": "noop@internal",
+			routers["r-"+m.ID] = map[string]any{"rule": rule, "entryPoints": redirEPs, "service": "noop@internal",
 				"middlewares": []string{"redir-" + m.ID}, "priority": prio}
 		}
 	}
@@ -545,10 +553,7 @@ func (t *traefikMgr) probeCerts(ctx context.Context) {
 		t.mu.Unlock()
 		changed := false
 		for _, ms := range targets {
-			ip := ms.m.BindIP
-			if pip := net.ParseIP(ip); pip != nil && pip.IsUnspecified() {
-				ip = "127.0.0.1"
-			}
+			ip := t.probeAddr(ms.m)
 			status := t.probeOne(net.JoinHostPort(ip, strconv.Itoa(ms.m.Port)), ms.m.Hostname)
 			t.b.mu.Lock()
 			if t.b.acme.certs == nil {
@@ -598,3 +603,27 @@ func containsStr(list []string, s string) bool {
 	}
 	return false
 }
+
+// bindsOf is the addresses a web mapping listens on; t.mu is held, or the caller does not race sync.
+func (t *traefikMgr) bindsOf(m model.Mapping) []string {
+	if ips := t.binds[m.ID]; len(ips) > 0 {
+		return ips
+	}
+	return []string{m.BindIP}
+}
+
+// probeAddr picks an address on this machine to test a mapping's certificate through.
+func (t *traefikMgr) probeAddr(m model.Mapping) string {
+	t.mu.Lock()
+	ips := t.bindsOf(m)
+	t.mu.Unlock()
+	for _, ip := range ips {
+		if ip == "127.0.0.1" {
+			return ip
+		}
+	}
+	if p := net.ParseIP(ips[0]); p != nil && p.IsUnspecified() {
+		return "127.0.0.1"
+	}
+	return ips[0]
+}

yield_test.go

@@ -0,0 +1,37 @@
+package blacktip
+
+import (
+	"testing"
+
+	"git.veillax.com/Veillax/reef/model"
+)
+
+func TestWildcardWebsitesStepAsideForNamedAddresses(t *testing.T) {
+	all := []model.Mapping{
+		{ID: "a", Proto: model.ProtoHTTPS, BindIP: "0.0.0.0", Port: 443, Hostname: "a.test"},
+		{ID: "b", Proto: model.ProtoHTTPS, BindIP: "127.0.0.1", Port: 443, Hostname: "b.test"},
+		{ID: "c", Proto: model.ProtoHTTPS, BindIP: "0.0.0.0", Port: 8443, Hostname: "c.test"},
+		{ID: "d", Proto: model.ProtoTCP, BindIP: "0.0.0.0", Port: 443},
+	}
+	// the wildcard on 443 gives up the address that "b" names
+	for _, ip := range bindIPs(all[0], all) {
+		if ip == "127.0.0.1" {
+			t.Fatalf("wildcard still listens on 127.0.0.1: %v", bindIPs(all[0], all))
+		}
+	}
+	// the named address keeps its own listener
+	if got := bindIPs(all[1], all); len(got) != 1 || got[0] != "127.0.0.1" {
+		t.Fatalf("named mapping: %v", got)
+	}
+	// a different port, or a raw TCP port, is not affected
+	if got := bindIPs(all[2], all); len(got) != 1 || got[0] != "0.0.0.0" {
+		t.Fatalf("other port: %v", got)
+	}
+	if got := bindIPs(all[3], all); len(got) != 1 || got[0] != "0.0.0.0" {
+		t.Fatalf("raw tcp: %v", got)
+	}
+	// with nothing named on that port the wildcard stays a single wildcard listener
+	if got := bindIPs(all[0], all[:1]); len(got) != 1 || got[0] != "0.0.0.0" {
+		t.Fatalf("alone: %v", got)
+	}
+}