Catching Up — a VPN Rewritten From Scratch, a Real Outage, and Getting My Legal Paperwork Right
I let this slip for about a week and a half — not for lack of things happening, just the opposite. Catching up here in one post instead of trying to reconstruct ten separate days from memory.
A few small site updates
Early in the stretch I added a "Businesses I Support" section to kb9gxk.net linking out to JPPS's MSP clients, added Gardens Wedding Center to that list, and fixed a couple of small content issues (a WeatherWise typo, a missing lockfile entry that was failing CI).
Rewriting mlvpn-rs's transport around per-link WireGuard
The biggest single change of the stretch: mlvpn-rs — the multi-link VPN bonding daemon I run between my home network and my cloud BGP router — moved off its old shared-session transport onto an independent WireGuard tunnel per physical link. This was a breaking change (both ends have to upgrade together, no mixing old and new), motivated by a real, repeatedly-measured throughput gap: on the identical link, a plain WireGuard tunnel was sustaining roughly 4x what mlvpn-rs's old transport could, even with CPU sitting idle. Rather than keep chasing that gap, I rebuilt the transport on top of a proven one.
The next few days built on that foundation: added real counters so I can actually see when WireGuard itself is rejecting or swapping out packets, closing blind spots that had turned earlier loss investigations into dead ends. Then added an optional repair feature: a little extra data sent alongside the real traffic so the other end can rebuild a lost packet on its own, instead of waiting on a slow retransmission. That one came directly out of a packet capture between my two routers that found close to a third of packets getting lost in bursts on the home connection.
Peer-negotiated MTU, a real self-test tool, and a live outage I caused and fixed
Next came primary-aware, peer-negotiated tunnel MTU — instead of every host being capped by whichever configured link has the worst physical MTU regardless of whether it's actually carrying traffic, each side now tracks its actual active link and negotiates down to whatever the peer can really support. I also added a real TCP mode to the built-in throughput self-test tool, since the old raw-UDP version was reporting numbers nowhere close to what real TCP traffic (which is nearly everything that actually crosses this tunnel) was seeing.
Rolling that out to my two production routers taught me something the hard way. Right after deploying the update, the WireGuard handshake between them failed to come back up for about six minutes — a real outage, not a cosmetic bug, on infrastructure that's genuinely part of how my network reaches the internet. It recovered on its own, but I didn't stop there: I found and fixed a real display bug where a perfectly healthy, fully negotiated connection was being shown as a mismatch in my monitoring tool just because the two sides' raw link capacities differed — which is normal, not an error. Fixed that, verified the real negotiated values matched on both ends, and while I was in there, finally retired the old plain-WireGuard fallback tunnel I'd kept running as a safety net since the transport rewrite — confirmed real traffic was flowing cleanly through the new path first, with a live end-to-end ping through my own routed IP space to prove it.
Getting the legal side of the OmniBridge store right
I also spent real time hardening store.jpps.us's licensing side — the part of the business that actually has to hold up if anyone ever looks closely at it. Updated the License Agreement's wording, made sure the e-signature record-keeping actually gives a customer their own copy of what they signed (not just a database row only I can see), and — this is the one I'm glad I caught before it caused a real problem — found that a manually-entered purchase (the ones I key in by hand instead of through the automated checkout) had no signature capture at all. Closed that gap: I can now email a customer a real link to read and sign the agreement themselves, recorded the same way an automated purchase already is.
Also caught myself using "LLC" in that agreement before the LLC is actually formed — I'm in the process of getting that set up with the state now, but it's not final yet, and representing the business as an LLC before it legally exists is a real problem, not just a wording nitpick. Pulled it back out until the paperwork is actually final.