Decisions

Why lnk exit works the way it does.

Why is it an exit?

It makes this computer a machine's way out to the internet, over SOCKS5: only the programs on the machine that use the proxy go through it, and the machine joins no network. That's an exit, so lnk exit is its name, and the agent's side of it is lnk agent exit --here.

Why is the exit a plugin of its own?

It's useful with no agent, since anything on a box can use the proxy, and with no box, since any machine you reach over SSH can have one. So neither the agent's plugin nor the box's owns it. lnk exit keeps one exit per machine and reaches a box through the plugin its caller names, --on (lnk box forward), because SSH to boxes stays the box plugin's and the exit is built below it. Agents on one machine share its exit by holding it: each holder, you or an agent by its ID, is written down, stop takes one away, and the exit stops with the last. No plugin counts another's users.

Why is it `start` and `stop`, not `exit home` and `off`?

An exit is something that runs, and every lnk command starts and stops what runs with start and stop, its object the one thing it acts on: the machine. home|off after the machine put a second word in a slot of its own. stop alone stops the only exit, or asks which, and --all every one, which lnk exit stop did before (the grammar).

How does the traffic get home?

Over SSH, not WireGuard. ssh -R opens a SOCKS proxy on the machine that SSH carries back to this computer, where the connections are made. This computer already reaches every box over SSH, so nothing new runs, no port opens and no administrator rights are needed. It carries TCP only, which is what web and API traffic is.

Why does a Mac stay awake while it's an exit?

An exit that sleeps is none, so the connection runs under caffeinate -i on a Mac. Closing a laptop's lid still sleeps it.

How does an agent use the exit?

lnk agent exit --here holds its box's exit and routes the agent's proxy through it. lnk agent move gives the old box's exit back and holds the new one's.

How does the exit know your network's public address?

Some routers answer their admin page on their public address, from inside, so the exit has to know that address to refuse it. NAT-PMP asks nothing of the internet, and a STUN server works behind any router, so the exit asks both; Cloudflare's STUN server needs no account. It asks again now and then, since a home's address changes with its lease (how). For IPv6 a computer sees only its own /64, not what its network was delegated, so the exit refuses the /48 around it, the most a home is delegated: at worst a few neighbors' addresses with the same provider.

Why is the exit a Unix socket on the machine?

The proxy takes no password, so only where it listens keeps others out. On a TCP port, an sshd with GatewayPorts yes opens it on every address, and a check on the host can only close it after it opened, a second or so after each reconnect. A socket in the user's home folder has no port for any setting to open, and sshd makes it the user's alone, so other users of the machine are kept out too. A password per exit would guard the port rather than remove it, and change what every program that uses it sends.