24 lines
1.3 KiB
YAML
24 lines
1.3 KiB
YAML
---
|
|
# Reach the VMs over Tailscale, and fall back to the LAN if the tailnet is down.
|
|
#
|
|
# ansible_host is a MagicDNS name. If tailscaled is not running on the control
|
|
# node that name does not resolve, the probe fails, and the LAN address recorded
|
|
# as lan_ip in inventory.ini takes over.
|
|
#
|
|
# Why the probe-then-connect shape rather than a plain `nc -w5 %h %p`:
|
|
# netcat-openbsd's -w is an IDLE timeout as well as a connect timeout, so a
|
|
# single `nc -w5` silently tears down the SSH session after five quiet seconds.
|
|
# That produced intermittent "Data could not be sent to remote host" failures on
|
|
# exactly the long, quiet operations (apt) where a dropped connection costs most.
|
|
# `nc -z` probes, then `exec nc` carries the session with no timeout at all.
|
|
#
|
|
# Safe against the LAN addresses drifting again (which is how fulcrum/mempool
|
|
# came to be transposed): known_hosts is keyed to the MagicDNS NAME, so if
|
|
# lan_ip ever points at a different machine the host key will not match and ssh
|
|
# aborts. Verified by pointing fulcrum-box at mempool-box's address:
|
|
# "Host key verification failed."
|
|
#
|
|
# lan_ip is a convenience, not an identity. If it goes stale the fallback stops
|
|
# working; it will never connect you to the wrong box.
|
|
ansible_ssh_common_args: >-
|
|
-o ProxyCommand="sh -c 'nc -z -w5 %h %p 2>/dev/null && exec nc %h %p || exec nc {{ lan_ip }} %p'"
|