feat(resources): add TCP and UDP resources #4

Merged

ryan.mcgee merged 21 commits from feat/tcp-udp into main

2026-10-15 18:06:44 +00:00

ryan.mcgee commented

2026-10-13 19:37:17 +00:00

Owner

Summary

Resources can carry raw TCP or UDP traffic (databases, DNS, game servers) in addition to HTTP, on a per-protocol listen port, rendered as Traefik tcp/udp routers and managed in the UI.
Stacked on #3 (feat/resource-access); retarget to main once #2 and #3 are merged.

Changes

Migration adds protocol and listen_port, makes domain nullable, with a partial unique index on HTTP domains and a unique (organization, protocol, port) index. SQLite rebuilds the table (foreign keys off on a pinned connection, foreign_key_check); PostgreSQL uses ALTER. down refuses while TCP/UDP resources exist.
Resource gets an immutable protocol and per-protocol validation; access settings, rules and share links are HTTP-only ({:error, :not_http}).
DynamicConfig renders tcp and udp sections on entrypoints tcp-<port> / udp-<port>. The lowest id wins a contested port; invalid ports/targets are dropped; a raw resource that carries access settings is not served (fail-closed).
UI: protocol select on create, port and optional hostname fields, protocol badge, plain host:port targets, Access page and button HTTP-only, and a node page snippet listing the entrypoints that node's Traefik must declare (live).
Fixes a latent crash when a blank name was submitted for a node, resource or target (String.trim/1 on nil), with regression tests.
Dev stack: whoamitcp/whoamiudp, extra entrypoints and published ports, idempotent seeds. README documents the entrypoint convention and limits.

Verification

493 tests pass on SQLite and on PostgreSQL; mix format --check-formatted, mix compile --warnings-as-errors, mix credo --strict clean; mix dialyzer 0 errors on both backends.
Migration up/down/up on populated SQLite and PostgreSQL databases: row counts, integrity, cascades and the down guard checked.
Compose stack against the real Traefik: the migration applied to an existing populated dev database (HTTP data intact); Traefik lists the tcp and udp routers and services; TCP and UDP echo through Traefik; creating, disabling and deleting a TCP resource in the browser adds and removes the router and the node snippet entry; an undeclared entrypoint disables only that router (others keep serving).
Observed: a TCP client that half-closes right after writing got no reply through Traefik (works with the connection held open); documented in the README.

Not included

SNI routing of several TCP services on one port, TCP TLS passthrough, IP allow-lists for raw resources.

## Summary - Resources can carry raw TCP or UDP traffic (databases, DNS, game servers) in addition to HTTP, on a per-protocol listen port, rendered as Traefik tcp/udp routers and managed in the UI. - Stacked on #3 (`feat/resource-access`); retarget to `main` once #2 and #3 are merged. ## Changes - Migration adds `protocol` and `listen_port`, makes `domain` nullable, with a partial unique index on HTTP domains and a unique `(organization, protocol, port)` index. SQLite rebuilds the table (foreign keys off on a pinned connection, `foreign_key_check`); PostgreSQL uses `ALTER`. `down` refuses while TCP/UDP resources exist. - `Resource` gets an immutable protocol and per-protocol validation; access settings, rules and share links are HTTP-only (`{:error, :not_http}`). - `DynamicConfig` renders `tcp` and `udp` sections on entrypoints `tcp-<port>` / `udp-<port>`. The lowest id wins a contested port; invalid ports/targets are dropped; a raw resource that carries access settings is not served (fail-closed). - UI: protocol select on create, port and optional hostname fields, protocol badge, plain `host:port` targets, Access page and button HTTP-only, and a node page snippet listing the entrypoints that node's Traefik must declare (live). - Fixes a latent crash when a blank name was submitted for a node, resource or target (`String.trim/1` on nil), with regression tests. - Dev stack: whoamitcp/whoamiudp, extra entrypoints and published ports, idempotent seeds. README documents the entrypoint convention and limits. ## Verification - 493 tests pass on SQLite and on PostgreSQL; `mix format --check-formatted`, `mix compile --warnings-as-errors`, `mix credo --strict` clean; `mix dialyzer` 0 errors on both backends. - Migration up/down/up on populated SQLite and PostgreSQL databases: row counts, integrity, cascades and the `down` guard checked. - Compose stack against the real Traefik: the migration applied to an existing populated dev database (HTTP data intact); Traefik lists the tcp and udp routers and services; TCP and UDP echo through Traefik; creating, disabling and deleting a TCP resource in the browser adds and removes the router and the node snippet entry; an undeclared entrypoint disables only that router (others keep serving). - Observed: a TCP client that half-closes right after writing got no reply through Traefik (works with the connection held open); documented in the README. ## Not included - SNI routing of several TCP services on one port, TCP TLS passthrough, IP allow-lists for raw resources.

ryan.mcgee added 5 commits

2026-10-13 19:37:17 +00:00

feat(resources): add TCP and UDP resource types 4b943be332

- resources gain a protocol (http, tcp, udp, fixed at creation) and a
  listen_port; TCP/UDP resources need a port, have an optional
  informational domain, and never use TLS
- ports are unique per organization and protocol; domains are unique
  for HTTP resources only, so an HTTP app and a TCP service can share
  a hostname
- access control stays HTTP-only: settings, rules and share links
  return :not_http for raw resources, and they have no login surface
  or auth endpoint
- the migration rebuilds the table on SQLite (which cannot drop NOT
  NULL) with foreign keys verified off first, so dependent rows are
  never cascade-deleted; up, down and up again were checked against
  populated databases on SQLite and PostgreSQL, and rolling back is
  refused while TCP/UDP resources exist
- fix: blanking a node, resource or target field on edit no longer
  crashes the changeset (update_change runs with nil)

feat(traefik): render TCP and UDP routers d66979eee2

- TCP resources become catch-all TCP routers (HostSNI(`*`)) and UDP
  resources rule-less UDP routers, each on the tcp-<port> / udp-<port>
  entrypoint, with the targets as load-balanced host:port servers
  (IPv6 bracketed, scheme ignored)
- one shared function decides which raw resources are servable, and
  both the rendered config and the new required_entrypoints/1 use it,
  so the list of entrypoints a node must declare matches what is served
- a contested port keeps the lowest resource id on that node; unusable
  ports and targets are dropped; a raw resource that somehow carries
  access settings is not served rather than served unprotected
- sections appear only when non-empty; HTTP rendering is unchanged
- the tenancy suite puts both tenants on the same raw port

feat(resources): manage TCP and UDP resources in the UI 874c30e0f8

- the new-resource form picks HTTP, TCP or UDP and shows the matching
  fields (domain and TLS, or listen port and an optional hostname);
  the type is shown but fixed when editing
- lists and detail pages label raw resources by port with a protocol
  badge; raw targets are plain host:port addresses with no scheme
- the Access page and button are HTTP-only
- the node page lists the tcp-<port> / udp-<port> entrypoints its
  Traefik must declare, from the same logic that decides what is
  rendered, and follows resource changes live

chore(dev): add TCP and UDP backends to the dev stack 8759855da3

- compose gets whoamitcp and whoamiudp, and publishes the two extra
  Traefik ports on loopback
- the dev Traefik declares the tcp-9000 and udp-9001 entrypoints
- the dev seed creates a TCP resource (9000) and a UDP resource (9001)
  routed to them, idempotently
- README: TCP/UDP resources (entrypoint convention, port uniqueness,
  catch-all routing, no access control) and the dev commands

docs: use a TCP test command that works via Traefik 23a0190dc3

- hold the client connection open while waiting for the reply;
  closing the sending side immediately got no reply through Traefik
- note this in the README

ryan.mcgee referenced this pull request

2026-10-13 19:57:31 +00:00

feat(resources): add path routing and sticky sessions #5

ryan.mcgee changed target branch from feat/resource-access to main

2026-10-15 18:06:17 +00:00

ryan.mcgee added 1 commit

2026-10-15 18:06:24 +00:00

merge main into feat/tcp-udp 74b1ab0361

ryan.mcgee merged commit 9c14b287de into main

2026-10-15 18:06:44 +00:00

ryan.mcgee referenced this pull request from a commit

2026-10-15 18:06:46 +00:00