Say when something other than Ployz answers on port 80#1682

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 4658b745-19a0-463f-8bf2-8c2dac693835

---

📥 Commits

Reviewing files that changed from the base of the PR and between cb25ff663e6135c13a57e8fe44fe9cc17ef60814 and 46d3f64adaf5f296e5eb809016f3cc98e7a20bc7.

---

⛔ Files ignored due to path filters (2)

• core/crates/ployz-sdk/generated/config-wasm.mjs is excluded by !**/generated/**
• core/crates/ployz-sdk/generated/payloads.d.ts is excluded by !**/generated/**

---

📒 Files selected for processing (16)

• core/crates/ployz-store/src/domain/mod.rs
• core/crates/ployz-store/src/domain/status.rs
• dashboard/src/modules/cluster-domain/cluster-domain.test.ts
• dashboard/src/modules/cluster-domain/cluster-domain.ts
• dashboard/src/modules/cluster-domain/ingress-probe.server.test.ts
• dashboard/src/modules/cluster-domain/ingress-probe.server.ts
• dashboard/src/modules/cluster-domain/sync.inngest.postgres.test.ts
• dashboard/src/modules/cluster-domain/sync.server.ts
• dashboard/src/modules/cluster-domain/tables.ts
• dashboard/src/modules/config-store/domain-evidence.server.ts
• dashboard/src/modules/runtime/effect-try-promise-boundary.test.ts
• dashboard/src/routes/_protected/cloud/$organizationSlug/_org/-components/ClusterDomainSection.test.tsx
• dashboard/src/routes/_protected/cloud/$organizationSlug/_org/-components/ClusterDomainSection.tsx
• docs/user/self-hosting.md
• docs/user/services/domains.md
• docs/user/troubleshooting/app-not-reachable.md

---

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 8 remain after this review.

---

Summary by CodeRabbit

• New Features
  • Domain checks now distinguish servers where another service is answering on port 80 from servers where port 80 is unreachable.
  • The domain status identifies affected servers and provides a check-again option.
• Documentation
  • Updated domain and troubleshooting guidance explains how to free port 80 and check the domain again.

Walkthrough

Ingress checks now distinguish servers where another service answers on port 80 from unreachable servers. The recorded addresses feed domain status, dashboard messaging, and updated troubleshooting guidance.

Changes

Port 80 Conflict Detection

Layer / File(s)	Summary
Classify ingress probe responses dashboard/src/modules/cluster-domain/ingress-probe.server.ts, dashboard/src/modules/cluster-domain/ingress-probe.server.test.ts, dashboard/src/modules/runtime/effect-try-promise-boundary.test.ts	The probe classifies matching verification responses as ployz, other HTTP responses as taken, and fetch failures as closed. Tests cover these outcomes.
Store taken ingress addresses dashboard/src/modules/cluster-domain/sync.server.ts, dashboard/src/modules/cluster-domain/tables.ts, dashboard/src/modules/cluster-domain/sync.inngest.postgres.test.ts	Synchronization records reachable, unreachable, and taken servers. Probed traffic stores the taken list, which is optional for older rows.
Expose port 80 conflicts in domain status core/crates/ployz-store/src/domain/mod.rs, core/crates/ployz-store/src/domain/status.rs, dashboard/src/modules/cluster-domain/cluster-domain.ts, dashboard/src/modules/cluster-domain/cluster-domain.test.ts, dashboard/src/modules/config-store/domain-evidence.server.ts	Store and dashboard status logic expose port_80_taken with affected addresses. Tests cover taken servers and mixed unreachable/taken results.
Display port conflict guidance dashboard/src/routes/_protected/cloud/$organizationSlug/_org/-components/ClusterDomainSection.tsx, dashboard/src/routes/_protected/cloud/$organizationSlug/_org/-components/ClusterDomainSection.test.tsx, docs/user/self-hosting.md, docs/user/services/domains.md, docs/user/troubleshooting/app-not-reachable.md	The dashboard identifies affected addresses and offers “Check again.” The documentation describes the port conflict and troubleshooting steps.

Priority: ⬇️ Low

Estimated code review effort: 3 (Moderate) | ~20 minutes

Change: Bug fix

Sequence Diagram(s)

mermaid

1	sequenceDiagram
2	participant ClusterDomainSync
3	participant probeIngress
4	participant IngressServer
5	participant ClusterDomainTraffic
6	ClusterDomainSync->>probeIngress: Probe origin with machine ID
7	probeIngress->>IngressServer: Request /.ployz-verify
8	IngressServer-->>probeIngress: Return HTTP response or connection failure
9	probeIngress-->>ClusterDomainSync: Classify as ployz, taken, or closed
10	ClusterDomainSync->>ClusterDomainTraffic: Store server addresses by classification

---

Merge Risk: ⚪ Minimal · up to 46d3f

The port-80 conflict behavior is consistent with the stated change. No issue identified here needs to be resolved before merging.

Security Architecture Review

Security architecture risk: 🔵 Low · up to 46d3f

The change improves port-conflict diagnostics without expanding probe destinations or allowing unverified responders into newly published DNS records. Older saved rows remain readable. Deployment-version coordination is not established, so diagnostic consistency during rollback remains uncertain.

Retained concerns No architecture-level concerns identified.

Security review details

Security Blast Radius

• inferred — A responder at a selected ingress address can influence that organization's observed port status. The PR does not broaden destination selection: requests still target ingress machines from the connected organization's runtime frame. The new taken outcome adds no DNS, certificate, or configuration authority.

Security Findings and Attack Paths

• inferred — No introduced security attack path was identified in the reviewed classification flow. An unexpected or interrupted response becomes taken, but remains excluded from reachable results. Existing HTTP probe exposure and retention of the last published DNS set are unchanged, rather than newly introduced guarantees or vulnerabilities.

Trust Boundaries and Controls

• observed — The outbound probe retains manual redirects and a five-second timeout combined with effect cancellation. Only status 200 with a trimmed body equal to the expected machine ID yields Ployz. This is the existing identity-correlation check over HTTP, not newly added cryptographic responder authentication.

---

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	Warning	Docstring coverage is 71.43% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 7 functions across 13 files. (3 skipped: …	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	Passed	The title clearly and concisely describes the main change: reporting when another service answers on port 80.
Description check	Passed	The description accurately explains the three probe outcomes, new status handling, stored traffic changes, dashboard behavior, tests, and documentation updates.
Linked Issues check	Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	Passed	Check skipped because no linked issues were found for this pull request.

---

Full details: Docstring Coverage

Explanation

Docstring coverage is 71.43% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 7 functions across 13 files. (3 skipped: 3 unsupported.)

---

📝 Generate docstrings 💡

• Commit to this branch
• Create a new PR

---

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

---

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.