Self hosted charm issue with ssh tcp

[jaythedeveloper]

I’m trying to run a self hosted charm instance and running into an issue with connecting to the instance over ssh.

I’ve got the following configuration that seems to work for the http side of things but with tcp and ssh i get the following error when trying to use charm cli app.

kex_exchange_identification: read: Connection reset by peer

and

Error: ssh: handshake failed: read tcp 172.23.135.145:35748->66.241.125.123:35353: read: connection reset by peer

I know I can reach the fly machine when i try just a http connection because i see this in my logs

yd [error] could not proxy TCP data to/from instance: failed to copy (direction=server->client, error=Connection reset by peer (os error 104))

My fly.toml

# fly.toml app configuration file generated for <app-name> on 2024-03-29T16:14:12+13:00
#
# See https://fly.io/docs/reference/configuration/ for information about how to use this file.
#

app = '<app-name>'
primary_region = 'syd'

[build]
  image = 'charmcli/charm:latest'

[env]
  CHARM_SERVER_HOST='<app-name>.fly.dev'
  CHARM_SERVER_PUBLIC_URL='https://<app-name>.fly.dev:35354'

[[mounts]]
  source = 'vol_vault'
  destination = '/data'
  initial_size = '1gb'

[[services]]
  protocol = 'tcp'
  internal_port = 35354
  processes = ['app']

[[services.ports]]
    start_port = 35354
    end_port = 35354
    handlers = ['tls', 'http']

[[services]]
  protocol = 'tcp'
  internal_port = 35353
  processes = ['app']

[[services.ports]]
    start_port = 35353
    end_port = 35353

[[vm]]
  size = 'shared-cpu-1x'
  memory = '256mb'

[rubys]

Just a guess, but are you using a shared IPv4? It is the default:

Public Network Services

You likely need a dedicated ipv4 address.

[jaythedeveloper]

@rubys that appears to be the problem yeah. Just changed to dedicated and worked first time.

Is there some different network handling of public shared IPv4 compared to dedicated that makes it work?

[rubys]

My understanding (and this is outside my area of expertise) is that we have a HTTP proxy server that will route requests to the correct host based on the HTTP Host header. This, of course, only works for HTTP requests. With a private IPv4 addressed, the request will route to the nearest machine in the application that owns the IP address.