feat(meshd): relay 模式(去 TUN + tls_mode none + 降权部署) - #3
Merged
Conversation
引入 mode: full | relay 配置,relay 模式下 meshd 不创建 TUN、 不分配 server IP,退化为纯中继,去掉 CAP_NET_ADMIN 依赖, 适配降权/容器化/多应用共存场景。默认 full 向后兼容。 Co-Authored-By: Claude <noreply@anthropic.com>
按 TDD 拆为 4 个 task:config mode 字段、tunnel relay 分支与 routeClientPacket 提取、install.sh --mode 与 systemd 去特权、 Caddy 多应用部署文档。 Co-Authored-By: Claude <noreply@anthropic.com>
实施评审发现 relay 未解决 meshd 独占 443/80+自带 TLS(I-1), 且 install.sh 去 CAP 不彻底(M1)。扩展范围:新增 tls_mode 配置(none 时纯 HTTP)、install.sh relay 联动 tls_mode none 与 CapabilityBoundingSet 显式 deny、文档消除架构矛盾。 追加 Task 5/6/7。 Co-Authored-By: Claude <noreply@anthropic.com>
Co-Authored-By: Claude <noreply@anthropic.com>
…修正 Caddy 反代架构 Co-Authored-By: Claude <noreply@anthropic.com>
- install.sh: 新增 listen_addr_line 变量,relay 模式默认写入 127.0.0.1:8443, 避免 meshd 抢占公网 :443 导致 WS 明文暴露并阻塞 Caddy - docs/deploy/caddy-multi-app.md: 步骤 2 改为说明默认值已是本地端口 - internal/server/api/server.go: ListenAndServeTLS 文档首行覆盖三种模式 修复终审 I-F1 (Important) 与 M-F1 (Minor)。 Co-Authored-By: Claude <noreply@anthropic.com>
|
Important Review skippedNo new commits to review since the last review. ⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Plus Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
📝 WalkthroughWalkthroughThe change adds ChangesRelay mode
Estimated code review effort: 3 (Moderate) | ~25 minutes Sequence Diagram(s)sequenceDiagram
participant Client
participant Caddy
participant meshd
participant RelayClient
Client->>Caddy: HTTPS request
Caddy->>meshd: HTTP reverse proxy
meshd->>RelayClient: Relay WebSocket packet
RelayClient-->>meshd: Client response packet
meshd-->>Caddy: HTTP response
Caddy-->>Client: HTTPS response
Possibly related PRs
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (1)
install.sh (1)
149-160: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low valueSet an explicit default to prevent empty lines in the generated YAML.
When
modeis notrelay,tls_mode_lineis left empty, resulting in a blank line in the middle of the generated/etc/mesh/meshd.yaml. Setting it to explicitly use the default value (autocert) keeps the generated configuration clean and explicit.♻️ Proposed refactor
- local tls_mode_line="" + local tls_mode_line="tls_mode: \"autocert\"" local listen_addr_line="listen_addr: \":443\""🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@install.sh` around lines 149 - 160, Update the tls_mode_line initialization in the install configuration-generation flow to explicitly emit the default autocert value, while retaining the relay-specific none override. Ensure the generated /etc/mesh/meshd.yaml has a tls_mode entry rather than an empty line for non-relay modes.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@install.sh`:
- Around line 173-179: Correct the systemd capability-negation syntax in
install.sh lines 173-179 by changing the relay-mode CapabilityBoundingSet value
from !CAP_NET_ADMIN to ~CAP_NET_ADMIN while retaining CAP_NET_RAW. Update
docs/deploy/caddy-multi-app.md line 27 to use the same ~CAP_NET_ADMIN syntax.
---
Nitpick comments:
In `@install.sh`:
- Around line 149-160: Update the tls_mode_line initialization in the install
configuration-generation flow to explicitly emit the default autocert value,
while retaining the relay-specific none override. Ensure the generated
/etc/mesh/meshd.yaml has a tls_mode entry rather than an empty line for
non-relay modes.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: 375f1b58-8536-4a2b-94bb-e0fde0108293
📒 Files selected for processing (10)
docs/deploy/caddy-multi-app.mddocs/superpowers/plans/2026-07-20-meshd-relay-mode.mddocs/superpowers/specs/2026-07-20-meshd-relay-mode-design.mdinstall.shinternal/server/api/api_test.gointernal/server/api/server.gointernal/server/config/config.gointernal/server/config/config_test.gointernal/server/tunnel/server.gointernal/server/tunnel/server_test.go
Co-Authored-By: Claude <noreply@anthropic.com>
Owner
Author
|
@coderabbitai review |
✅ Action performedReview finished.
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
概述
为 meshd 新增 relay 模式,适配单机多应用部署(如 gz-ubuntu 上 meshd + aigw 共存):meshd 退化为纯中继,不创建 TUN、不分配 server IP,去掉 CAP_NET_ADMIN 依赖,可藏到 Caddy 反代之后。
改动
新配置
mode: full | relay(默认full,向后兼容)— relay 不创建 TUN、不分配 server IPtls_mode: autocert | none(默认autocert)—none时纯 HTTP,不启动 autocert、不监听 :80代码
internal/server/config/:Mode / TLSMode 字段 + 归一化校验(空值/合法/非法回退 + warning)internal/server/tunnel/server.go:NewTunnelServer按 mode 分支;提取routeClientPacket(对称于routePacket);Start/Closenil 守卫internal/server/api/server.go:提取serveMode,ListenAndServeTLS三分支(autocert / selfsigned / plain)部署
install.sh --mode relay:联动生成tls_mode: none+listen_addr: 127.0.0.1:8443+ systemd unitCapabilityBoundingSet=!CAP_NET_ADMIN CAP_NET_RAW显式 deny(即便 root 启动也不具备)docs/deploy/caddy-multi-app.md:Caddy 多应用部署指南(meshd + aigw 共存)测试
全程 TDD,
go test ./...全绿:routeClientPacketrelay 丢弃 server-bound 包/正常转发、Closenil 安全serveMode四种决策(含TLSTestMode优先于tls_mode)兼容性
mode/tls_mode字段 → 默认full+autocert,行为零变化device.Allocate、meshd init不变relay 模式限制(已知)
设计文档
docs/superpowers/specs/2026-07-20-meshd-relay-mode-design.mddocs/superpowers/plans/2026-07-20-meshd-relay-mode.md🤖 Generated with Claude Code
Summary by CodeRabbit
New Features
relaymode to run as a lightweight relay without creating a VPN interface.tls_mode(autocertornone), including plain HTTP operation for reverse-proxy setups.--mode relay, configure local-only listening in relay mode, and adjust service permissions accordingly.Documentation
relayalongside other web apps behind Caddy, including limitations and migration steps.Tests
mode/tls_modeparsing and for relay-mode packet routing and server shutdown behavior.