[TakGN]

Part of ipni/infra#163.

What

Adds 4317-4318 and 9812 to net.ipv4.ip_local_reserved_ports in group_vars/ipfs_nodes/main.yml (9812 joins the metrics proxy's 9810-9811), with a line in the comment that lists the ports.

ipni/infra is adding a trace collector, alloy-traces (kubernetes/platform/alloy-traces, deployed by Argo CD to sing-1, lith-1 and chic-1). It runs on the host network so the services can send it traces on the box's loopback, and binds to 127.0.0.1 only:

Port	What
4317	OTLP/gRPC from the services
4318	OTLP/HTTP from the services
9812	the collector's own HTTP server (UI, readiness, reload)

With ip_local_port_range at 1024 65535, an outbound socket could be handed one of these as its source port, and the collector would fail to re-bind after a restart. Same convention as every other host-network port.

Not changed

No firewall rule: everything binds to 127.0.0.1, and nothing outside the box needs to reach it.

Merge order

Merge and apply this before ipni/infra's tracing PR, so the ports are reserved before the collector first binds them. Turning traces on in needle and route-origin's Envoy is a separate, later PR here, since it restarts needle.

Rollout

group_vars/ changes, so CI dry-runs site.yml (and platform.yml) on this PR. After merge, the apply waits for a required reviewer to approve the production run. It only changes a sysctl and restarts nothing.

Before merging, it's worth confirming nothing already listens on these ports on any box (expect no output):

for h in 5.199.165.77 46.166.169.131 84.32.48.211; do ssh ipni@$h "ss -ltnH '( sport = :4317 or sport = :4318 or sport = :9812 )'"; done

Checked

• ansible-playbook --syntax-check site.yml.
• ansible-inventory --host sing-1: the reserved list includes 4317-4318 and 9810-9812, in order.

🤖 Generated with Claude Code