bluebluesodaandCommandCodeBot
70eac5918f
Add net.ipv6_pin_gateway (off by default): make the HOST's upstream
link-local default gateway a permanent neighbour entry, so the kernel stops
probing it.
Why: on a host whose provider router answers neighbour solicitations
unreliably, the host's neighbour for its default nexthop drops to INCOMPLETE,
and the host then answers every forwarded packet — every container's IPv6
included — with "address unreachable" until it recovers. The container keeps
its address and can ping the bridge, but nothing off-link works,
intermittently; the host's own IPv6 drops at the same moments. Captured
on-bridge: the host (the bridge's global address) returning ICMP6
destination-unreachable for the container's packets, correlated with the
gateway neighbour going REACHABLE -> DELAY -> PROBE -> INCOMPLETE.
Applied by RewireAllIPv6, so `vps ipv6-reapply` (the boot unit) and
`vps install` re-apply it, and `vps config set net.ipv6_pin_gateway true`
applies it immediately. It only touches the host's own link-local default
gateway, and only while that gateway is resolved: the MAC is read from the
live neighbour table by the new `vps ip6 neigh-pin` root helper
(`neigh-unpin` drops the entry again when the key is turned off). Off by
default because a permanent entry is never re-resolved — a gateway that
later moves to another MAC would be missed.
Also drop the bridge-MAC pin from 02d55d2 (and lx.NetworkGet with it):
measured on a live host, Incus keeps a managed bridge's MAC stable across
two reboots even with bridge.hwaddr unset and no stored MAC, so that pin
guarded a failure that does not occur.
Co-authored-by: CommandCodeBot <noreply@commandcode.ai>
Documentation
Technical documentation for vpsmgr. All docs are in English.
| Doc | What it covers |
|---|---|
| architecture.md | System design: components, storage, network, security, traffic, users and user groups, image, install/uninstall lifecycle |
| configuration.md | Full reference for /etc/vpsmgr/config.yaml |
| ipv6.md | IPv6 pass-through design: per-account blocks, prefix support, routing, installer flow |
| ipv6-ndp-responder.md | Why prefix mode replaced ndppd with an in-tree NDP responder, design hardening, and what to test at scale |
| web-ssh.md | The browser terminal: how it reaches a container, how a session survives a dropped connection, and how to disable it |
| development.md | Building, testing, releasing, conventions |
See also AGENTS.md at the repo root — short version aimed at AI coding agents.