fix(tailscale-exit-nodes): lock AWS firewall after instance is running#80
Merged
Conversation
Lightsail rejects PutInstancePublicPorts while an instance is still in the pending transition state (InvalidResourceState). The provision saga locked the firewall immediately after create, before the instance had settled. Move the lock to after the readiness poll, which already waits for the instance to reach running, so the port change targets a settled instance. Vultr is unaffected (its firewall group is applied at create time). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
The provision saga called
PutInstancePublicPortsimmediately afterCreateInstances, while the Lightsail instance was still in thependingtransition state. Lightsail rejects port changes during transition (InvalidResourceState), so the AWS firewall-lock step failed and the instance never reachedactive.Fix
Move the AWS firewall lock to after the readiness poll, which already waits for the instance to reach
running.PutInstancePublicPortsthen targets a settled instance. Vultr is unaffected (its firewall group is applied at create time).The instance still joins the tailnet during boot (via DERP) under the default firewall; the lock-down to UDP 41641 applies once it is running.
Test
The existing AWS happy-path saga test mocks the instance as
runningand does not assert call order, so it continues to pass. The suite gates the Docker build in CI.🤖 Generated with Claude Code