chore: support IPv6 fallback in IP autodetection (#423)

GabriellePoncey · web-flow · commit e23b733d4b7e · 2026-07-07T06:36:02.000-07:00
diff --git a/server/internal/api/http.go b/server/internal/api/http.go
@@ -6,8 +6,10 @@ import (
 	"crypto/x509"
 	"errors"
 	"fmt"
+	"net"
 	"net/http"
 	"os"
+	"strconv"
 
 	"github.com/pgEdge/control-plane/server/internal/config"
 	"github.com/rs/zerolog"
@@ -31,7 +33,7 @@ func newHTTPServer(
 		errCh:  make(chan error, 1),
 		server: &http.Server{
 			Handler: handler,
-			Addr:    fmt.Sprintf("%s:%d", cfg.BindAddr, cfg.Port),
+			Addr:    net.JoinHostPort(cfg.BindAddr, strconv.Itoa(cfg.Port)),
 		},
 	}
 }
diff --git a/server/internal/config/config.go b/server/internal/config/config.go
@@ -161,19 +161,15 @@ func (h HTTP) validate() []error {
 		return nil
 	}
 	var errs []error
-	if h.BindAddr == "" {
-		errs = append(errs, errors.New("bind_addr cannot be empty"))
-	}
 	if h.Port == 0 {
 		errs = append(errs, errors.New("port cannot be empty"))
 	}
 	return errs
 }
 
 var httpDefault = HTTP{
-	Enabled:  true,
-	BindAddr: "0.0.0.0",
-	Port:     3000,
+	Enabled: true,
+	Port:    3000,
 }
 
 type EtcdServer struct {
@@ -443,12 +439,13 @@ func defaultAddresses() ([]string, error) {
 	return []string{ip.String()}, nil
 }
 
-// getFirstIP gets the first non-loopback IPv4 address
+// getFirstIP gets the first non-loopback IP address, preferring IPv4.
 func getFirstIP() (net.IP, error) {
 	interfaces, err := net.Interfaces()
 	if err != nil {
 		return net.IPv4zero, fmt.Errorf("failed to list interfaces: %w", err)
 	}
+	var ipv6 net.IP
 	for _, iface := range interfaces {
 		// Skip loopback and down interfaces
 		if iface.Flags&net.FlagLoopback != 0 || iface.Flags&net.FlagUp == 0 {
@@ -458,7 +455,6 @@ func getFirstIP() (net.IP, error) {
 		if err != nil {
 			continue
 		}
-
 		for _, addr := range addrs {
 			var ip net.IP
 			switch v := addr.(type) {
@@ -468,21 +464,24 @@ func getFirstIP() (net.IP, error) {
 				ip = v.IP
 			}
 
-			// Check if it is a valid IPv4 address and not a loopback address
-			if ip == nil || ip.IsLoopback() {
+			// Check if it is a valid, routable address
+			if ip == nil || ip.IsLoopback() || ip.IsLinkLocalUnicast() {
 				continue
 			}
 
 			// To4() returns nil if the IP is not an IPv4 address
-			ip = ip.To4()
-			if ip == nil {
-				continue
+			if v4 := ip.To4(); v4 != nil {
+				return v4, nil
+			}
+			// Store first IPv6 address found, keep searching for IPv4
+			if ipv6 == nil {
+				ipv6 = ip.To16()
 			}
-
-			// Return the first valid IPv4 address found
-			return ip, nil
 		}
 	}
+	if ipv6 != nil {
+		return ipv6, nil
+	}
 
 	return net.IPv4zero, fmt.Errorf("could not find a valid network interface")
 }
diff --git a/server/internal/etcd/embedded.go b/server/internal/etcd/embedded.go
@@ -669,12 +669,19 @@ func embedConfig(cfg config.Config, logger zerolog.Logger) (*embed.Config, error
 
 	clientPort := cfg.EtcdServer.ClientPort
 	peerPort := cfg.EtcdServer.PeerPort
+
+	wildcard, err := utils.GetBindAddr()
+	if err != nil {
+		return nil, fmt.Errorf("failed to detect bind address: %w", err)
+	}
+
 	c.ListenClientUrls = []url.URL{
-		{Scheme: "https", Host: fmt.Sprintf("0.0.0.0:%d", clientPort)},
+		{Scheme: "https", Host: net.JoinHostPort(wildcard, strconv.Itoa(clientPort))},
 	}
 	c.ListenPeerUrls = []url.URL{
-		{Scheme: "https", Host: fmt.Sprintf("0.0.0.0:%d", peerPort)},
+		{Scheme: "https", Host: net.JoinHostPort(wildcard, strconv.Itoa(peerPort))},
 	}
+
 	clientURLs := make([]url.URL, len(cfg.PeerAddresses))
 	peerURLs := make([]url.URL, len(cfg.PeerAddresses))
 	for i, address := range cfg.PeerAddresses {
@@ -714,22 +721,25 @@ func initializationConfig(cfg config.Config, logger zerolog.Logger) (*embed.Conf
 	// Only bind/advertise localhost for initialization
 	clientPort := cfg.EtcdServer.ClientPort
 	peerPort := cfg.EtcdServer.PeerPort
+	loopback := "127.0.0.1"
+
 	c.ListenClientUrls = []url.URL{
-		{Scheme: "http", Host: fmt.Sprintf("127.0.0.1:%d", clientPort)},
+		{Scheme: "http", Host: net.JoinHostPort(loopback, strconv.Itoa(clientPort))},
 	}
 	c.AdvertiseClientUrls = []url.URL{
-		{Scheme: "http", Host: fmt.Sprintf("127.0.0.1:%d", clientPort)},
+		{Scheme: "http", Host: net.JoinHostPort(loopback, strconv.Itoa(clientPort))},
 	}
+
 	c.ListenPeerUrls = []url.URL{
-		{Scheme: "http", Host: fmt.Sprintf("127.0.0.1:%d", peerPort)},
+		{Scheme: "http", Host: net.JoinHostPort(loopback, strconv.Itoa(peerPort))},
 	}
 	c.AdvertisePeerUrls = []url.URL{
-		{Scheme: "http", Host: fmt.Sprintf("127.0.0.1:%d", peerPort)},
+		{Scheme: "http", Host: net.JoinHostPort(loopback, strconv.Itoa(peerPort))},
 	}
 	c.InitialCluster = fmt.Sprintf(
-		"%s=http://127.0.0.1:%d",
+		"%s=http://%s",
 		cfg.HostID,
-		cfg.EtcdServer.PeerPort,
+		net.JoinHostPort(loopback, strconv.Itoa(cfg.EtcdServer.PeerPort)),
 	)
 	c.QuotaBackendBytes = quotaBackendBytes
 
diff --git a/server/internal/etcd/rbac.go b/server/internal/etcd/rbac.go
@@ -365,7 +365,7 @@ func addEtcdServerCredentials(
 ) error {
 	// Ensure that localhost is included in the addresses
 	combined := ds.NewSet(addresses...)
-	combined.Add("127.0.0.1", "localhost")
+	combined.Add("127.0.0.1", "localhost", "::1")
 
 	// Create a cert for the peer server
 	serverPrincipal, err := certSvc.EtcdServer(ctx,
diff --git a/server/internal/orchestrator/common/golden_test/TestPatroniConfigGenerator/enable_fast_basebackup.yaml b/server/internal/orchestrator/common/golden_test/TestPatroniConfigGenerator/enable_fast_basebackup.yaml
@@ -115,7 +115,7 @@ postgresql:
   - checkpoint: fast
 restapi:
   connect_address: storefront-n1-689qacsi.storefront-database:8888
-  listen: 0.0.0.0:8888
+  listen: :8888
   allowlist:
   - 10.10.0.2
   - 10.10.0.3
diff --git a/server/internal/orchestrator/common/golden_test/TestPatroniConfigGenerator/in-place_restore.yaml b/server/internal/orchestrator/common/golden_test/TestPatroniConfigGenerator/in-place_restore.yaml
@@ -118,7 +118,7 @@ postgresql:
   remove_data_directory_on_diverged_timelines: true
 restapi:
   connect_address: storefront-n1-689qacsi.storefront-database:8888
-  listen: 0.0.0.0:8888
+  listen: :8888
   allowlist:
   - 172.17.0.1/32
   - 10.128.165.128/26
diff --git a/server/internal/orchestrator/common/golden_test/TestPatroniConfigGenerator/minimal_swarm.yaml b/server/internal/orchestrator/common/golden_test/TestPatroniConfigGenerator/minimal_swarm.yaml
@@ -113,7 +113,7 @@ postgresql:
   remove_data_directory_on_diverged_timelines: true
 restapi:
   connect_address: storefront-n1-689qacsi.storefront-database:8888
-  listen: 0.0.0.0:8888
+  listen: :8888
   allowlist:
   - 172.17.0.1/32
   - 10.128.165.128/26
diff --git a/server/internal/orchestrator/common/golden_test/TestPatroniConfigGenerator/minimal_systemd.yaml b/server/internal/orchestrator/common/golden_test/TestPatroniConfigGenerator/minimal_systemd.yaml
@@ -113,7 +113,7 @@ postgresql:
   remove_data_directory_on_diverged_timelines: true
 restapi:
   connect_address: storefront-n1-689qacsi.storefront-database:8888
-  listen: 0.0.0.0:8888
+  listen: :8888
   allowlist:
   - 10.10.0.2
   - 10.10.0.3
diff --git a/server/internal/orchestrator/common/golden_test/TestPatroniConfigGenerator/user_pg_hba_pg_ident_and_scram.yaml b/server/internal/orchestrator/common/golden_test/TestPatroniConfigGenerator/user_pg_hba_pg_ident_and_scram.yaml
@@ -115,7 +115,7 @@ postgresql:
   remove_data_directory_on_diverged_timelines: true
 restapi:
   connect_address: pghba-n1-689qacsi.pghba-database:8888
-  listen: 0.0.0.0:8888
+  listen: :8888
   allowlist:
   - 172.17.0.1/32
   - 10.128.165.128/26
diff --git a/server/internal/orchestrator/common/golden_test/TestPatroniConfigGenerator/with_backup_config.yaml b/server/internal/orchestrator/common/golden_test/TestPatroniConfigGenerator/with_backup_config.yaml
@@ -113,7 +113,7 @@ postgresql:
   remove_data_directory_on_diverged_timelines: true
 restapi:
   connect_address: storefront-n1-689qacsi.storefront-database:8888
-  listen: 0.0.0.0:8888
+  listen: :8888
   allowlist:
   - 172.17.0.1/32
   - 10.128.165.128/26
diff --git a/server/internal/orchestrator/common/golden_test/TestPatroniConfigGenerator/with_restore_config.yaml b/server/internal/orchestrator/common/golden_test/TestPatroniConfigGenerator/with_restore_config.yaml
@@ -118,7 +118,7 @@ postgresql:
   remove_data_directory_on_diverged_timelines: true
 restapi:
   connect_address: storefront-n1-689qacsi.storefront-database:8888
-  listen: 0.0.0.0:8888
+  listen: :8888
   allowlist:
   - 172.17.0.1/32
   - 10.128.165.128/26
diff --git a/server/internal/orchestrator/common/patroni_config_generator.go b/server/internal/orchestrator/common/patroni_config_generator.go
@@ -306,7 +306,7 @@ func (p *PatroniConfigGenerator) restAPI(systemAddresses []string) *patroni.Rest
 
 	return &patroni.RestAPI{
 		ConnectAddress: utils.PointerTo(net.JoinHostPort(p.FQDN, strconv.Itoa(p.PatroniPort))),
-		Listen:         utils.PointerTo(fmt.Sprintf("0.0.0.0:%d", p.PatroniPort)),
+		Listen:         utils.PointerTo(fmt.Sprintf(":%d", p.PatroniPort)),
 		Allowlist:      combined,
 	}
 }
diff --git a/server/internal/utils/utils.go b/server/internal/utils/utils.go
@@ -7,6 +7,7 @@ import (
 	"errors"
 	"fmt"
 	"maps"
+	"net"
 	"path"
 	"regexp"
 	"slices"
@@ -155,6 +156,43 @@ func BuildOptionArgs(options map[string]string) []string {
 	return res
 }
 
+// GetBindAddr returns the wildcard address to bind listeners on this host.
+// Returns "::" when a routable IPv6 address is present otherwise "0.0.0.0".
+func GetBindAddr() (string, error) {
+	ifaces, err := net.Interfaces()
+	if err != nil {
+		return "", fmt.Errorf("failed to list interfaces: %w", err)
+	}
+
+	for _, iface := range ifaces {
+		if iface.Flags&net.FlagLoopback != 0 || iface.Flags&net.FlagUp == 0 {
+			continue
+		}
+
+		addrs, err := iface.Addrs()
+		if err != nil {
+			continue
+		}
+
+		for _, addr := range addrs {
+			var ip net.IP
+			switch v := addr.(type) {
+			case *net.IPNet:
+				ip = v.IP
+			case *net.IPAddr:
+				ip = v.IP
+			}
+			if ip == nil || ip.IsLoopback() || ip.IsLinkLocalUnicast() {
+				continue
+			}
+			if ip.To4() == nil && ip.To16() != nil {
+				return "::", nil
+			}
+		}
+	}
+	return "0.0.0.0", nil
+}
+
 var idPattern = regexp.MustCompile(`^[a-z0-9](?:[a-z0-9-]{0,34}[a-z0-9])?$`)
 var ErrInvalidIdentifier = errors.New(`valid IDs must be 1-36 characters long, contain only lowercase letters, digits, and hyphens, start and end with a letter or digit, and not contain two consecutive hyphens`)
 

Original file line number	Diff line number	Diff line change
`@@ -161,19 +161,15 @@ func (h HTTP) validate() []error {`
`161`	`161`	`return nil`
`162`	`162`	`}`
`163`	`163`	`var errs []error`
`164`		`- if h.BindAddr == "" {`
`165`		`- errs = append(errs, errors.New("bind_addr cannot be empty"))`
`166`		`- }`
`167`	`164`	`if h.Port == 0 {`
`168`	`165`	`errs = append(errs, errors.New("port cannot be empty"))`
`169`	`166`	`}`
`170`	`167`	`return errs`
`171`	`168`	`}`
`172`	`169`
`173`	`170`	`var httpDefault = HTTP{`
`174`		`- Enabled: true,`
`175`		`- BindAddr: "0.0.0.0",`
`176`		`- Port: 3000,`
	`171`	`+ Enabled: true,`
	`172`	`+ Port: 3000,`
`177`	`173`	`}`
`178`	`174`
`179`	`175`	`type EtcdServer struct {`
`@@ -443,12 +439,13 @@ func defaultAddresses() ([]string, error) {`
`443`	`439`	`return []string{ip.String()}, nil`
`444`	`440`	`}`
`445`	`441`
`446`		`-// getFirstIP gets the first non-loopback IPv4 address`
	`442`	`+// getFirstIP gets the first non-loopback IP address, preferring IPv4.`
`447`	`443`	`func getFirstIP() (net.IP, error) {`
`448`	`444`	`interfaces, err := net.Interfaces()`
`449`	`445`	`if err != nil {`
`450`	`446`	`return net.IPv4zero, fmt.Errorf("failed to list interfaces: %w", err)`
`451`	`447`	`}`
	`448`	`+ var ipv6 net.IP`
`452`	`449`	`for _, iface := range interfaces {`
`453`	`450`	`// Skip loopback and down interfaces`
`454`	`451`	`if iface.Flags&net.FlagLoopback != 0 \|\| iface.Flags&net.FlagUp == 0 {`
`@@ -458,7 +455,6 @@ func getFirstIP() (net.IP, error) {`
`458`	`455`	`if err != nil {`
`459`	`456`	`continue`
`460`	`457`	`}`
`461`		`-`
`462`	`458`	`for _, addr := range addrs {`
`463`	`459`	`var ip net.IP`
`464`	`460`	`switch v := addr.(type) {`
`@@ -468,21 +464,24 @@ func getFirstIP() (net.IP, error) {`
`468`	`464`	`ip = v.IP`
`469`	`465`	`}`
`470`	`466`
`471`		`- // Check if it is a valid IPv4 address and not a loopback address`
`472`		`- if ip == nil \|\| ip.IsLoopback() {`
	`467`	`+ // Check if it is a valid, routable address`
	`468`	`+ if ip == nil \|\| ip.IsLoopback() \|\| ip.IsLinkLocalUnicast() {`
`473`	`469`	`continue`
`474`	`470`	`}`
`475`	`471`
`476`	`472`	`// To4() returns nil if the IP is not an IPv4 address`
`477`		`- ip = ip.To4()`
`478`		`- if ip == nil {`
`479`		`- continue`
	`473`	`+ if v4 := ip.To4(); v4 != nil {`
	`474`	`+ return v4, nil`
	`475`	`+ }`
	`476`	`+ // Store first IPv6 address found, keep searching for IPv4`
	`477`	`+ if ipv6 == nil {`
	`478`	`+ ipv6 = ip.To16()`
`480`	`479`	`}`
`481`		`-`
`482`		`- // Return the first valid IPv4 address found`
`483`		`- return ip, nil`
`484`	`480`	`}`
`485`	`481`	`}`
	`482`	`+ if ipv6 != nil {`
	`483`	`+ return ipv6, nil`
	`484`	`+ }`
`486`	`485`
`487`	`486`	`return net.IPv4zero, fmt.Errorf("could not find a valid network interface")`
`488`	`487`	`}`