Renaming and renumbering

Names and addresses #

A network’s name is only a label. It shows in juist status, and you use it to refer to the network in commands. Renaming the network changes nothing else. The same goes for a device’s name, which also gives the device its DNS name: laptop.home.juist.

Each device has an IPv4 address and an IPv6 address in the network. Renumbering moves the IPv4 addresses, either of all devices or of a single one. You need it when the network’s range clashes with a LAN you use, or with another network on the same device. IPv6 addresses never change.

Both are changes to the membership log: an admin makes them, and every device follows. If the quorum needs more than one admin, the change waits for the others (Several admins).

Renaming the network #

juist network rename office

Renaming a device #

juist rename phone tablet

You specify the device as for juist remove: by name, address or key. juist refuses a name that another device already has, regardless of upper or lower case.

A device that shares files shares them under its new name, such as tablet.pub.example.org. For such a device, juist also refuses a name that another device publishes or that is not a valid DNS label. A running juist share prints its new link.

Moving every device’s address #

$ juist network renumber 10.7.0.0/22
move "home" from 198.18.36.0/22 to 10.7.0.0/22, old addresses until Fri 9 Oct 14:00? [y/N] y
moving to 10.7.0.0/22; old addresses until Fri 9 Oct 14:00

$ juist network
home
  IPv4          10.7.0.0/22, 198.18.36.0/22 until Fri 9 Oct 14:00
  IPv6          fd77:9359:d9fb::/48

MOVING  FROM         TO        OLD UNTIL
laptop  198.18.36.1  10.7.0.1  Fri 9 Oct 14:00
nas     198.18.36.2  10.7.0.2  Fri 9 Oct 14:00

Until the deadline, devices answer at both addresses. After that, only the new ones work. Connections keep running through the move, except those to or from an old address, which end when that address does.

Moving one device’s address #

juist network renumber phone 10.7.0.9

This moves phone to 10.7.0.9, which must be in the network’s range. As above, its old address keeps working until the deadline.

Retiring old addresses early #

Once every device has heard of the move, you don’t have to wait for the deadline:

--finish warns first that devices that have not yet heard of the move lose the old address.

Ending the network #

juist create shows the network’s break-glass secret once, as the line Break-glass juist-break-glass-1.…, and does not store it anywhere. The secret ends the network for good, without any admin. It is the way out when too few admin keys are left to change the network, because they were lost or stolen.

$ pass show juist/break-glass-home | juist network disable --yes
disabled "home"; every device stops as the record reaches it

Without a pipe, juist network disable prompts for the line, without echoing it, and then asks whether to end the network. --secrets FILE reads the line from a file.

Each device passes the record on and drops its tunnels as soon as it receives it, and its juist status then says disabled. To carry on, run juist reset on each device and join them to a new network created with juist create.

Store the line separately from the admin keys: whoever gets a vault holding both can both govern the network and end it.

Good to know #

• Old IPv4 addresses keep working for 7 days by default. --for 12h or --for 14d sets a different period. Make it long enough for every device to come online at least once.
• The deadline is fixed when the change is proposed. Admins who approve it later see how much time is left.
• A device has at most one old address. Moving it again before the deadline drops the earlier old address immediately, and juist warns about this.
• Retired addresses stay reserved, so that no other device gets them, until you run juist network renumber --finish without further arguments.
• The new range must have room for every device. juist warns when it overlaps a LAN of this host, or another network the device is in.
• Configuration outside juist that names old addresses is not moved: update firewall rules, /etc/hosts entries and the like yourself.
• With several networks on the device, name the network first: juist network renumber work 10.7.0.0/24, juist network rename work office.
• A device name containing . or _ is not a valid DNS name. juist warns, and the device can then only be reached by its address. A device with the publish role cannot take such a name, since it shares under its name.
• An admin key keeps the device name it was filed under; juist admins shows it.
• Anyone holding the break-glass line can end the network. A device running a juist version older than juist network disable does not stop until it is updated. A device that is offline at the time finds no other device to reach when it comes back.
• Networks created before juist showed the line keep their secrets in the keystore, as break-glass-NETWORK.secrets. juist network disable reads that file from there; move it offline.

Troubleshooting #