Reach a service inside your network

The gate refuses every address of your network, even when a public name resolves to it. To let one destination reach a service inside, give it an internal exception: the ip:port its name stands for.

Open the exception

1. In the destination, write the service’s address with a name of your choice, and its ip:port in internal:

   destination:
     address: https://recipes.home.arpa/api/worker
     secret: recipes
     internal: 192.168.1.30:443
   

   The keep connects to that ip:port and sends the name as the host. The name does not need to resolve. With internal, the address may be http://.

   The ip:port must be one address of the internal network: 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 100.64.0.0/10 or fc00::/7. A sealed address is refused: loopback, link-local, multicast, a translation range, or the installation’s own ranges.

2. Restart the three pieces: systemctl --user restart sandcastle.target.

3. Run sandcastle check. From now on it prints, every time:

   warn  source recipes: internal exception: the gate lets 192.168.1.30:443 through for recipes.home.arpa
   

What it opens, and the risk

The exception opens that one address for that one destination. The gate lets it through, and the gate’s network gets a route to it. The route opens the whole IP; the port is held by the keep, which only ever asks for the port in the configuration. Another destination pointed at the same address fails at the keep’s TLS check before its secret is sent.

A job still cannot reach the service: a box has no network. What reaches it is the keep’s requests for that destination: the contract’s calls, with its token.

The service itself is outside the promise. If it is compromised, sandcastle does not protect you from it. With http://, nothing encrypts the way to it either, and check says so:

warn  source recipes: http:// is outside the promise: nothing encrypts the way to 192.168.1.30:443

Use https:// when the service can. The two barriers, and why an exception opens the whole IP at the second, are in How the network is closed.

Close it

Remove internal from the destination, or the destination itself, and restart sandcastle.target.