docs: [#407] submit UDP1 tracker to newTrackon — complete

[josecelano]

Summary

Resolves #407 — UDP1 tracker is now listed on newTrackon.

This PR documents the complete process: two newTrackon prerequisites that were missed, the
networking blockers discovered during submission, and the full investigation and fix for each.

What Was Done

Phase 1 ✅ — BEP 34 DNS TXT Records

newTrackon requires a TXT record on the tracker domain announcing its protocol and port
(BEP 34).

• Added http1.torrust-tracker-demo.com TXT "BITTORRENT TCP:443"
• Added udp1.torrust-tracker-demo.com TXT "BITTORRENT UDP:6969"
• Verified with dig TXT

Phase 2 ✅ — Provision New Floating IPs

newTrackon enforces one unique IP per tracker. The UDP1 subdomain was sharing IPs with HTTP1.

• Provisioned udp1-ipv4: 116.202.177.184
• Provisioned udp1-ipv6: 2a01:4f8:1c0c:828e::1
• Assigned both to the demo server

Phase 3 ✅ — Configure All Floating IPs via Netplan

All four floating IPs (existing HTTP1 + new UDP1) are now persistent in
/etc/netplan/60-floating-ip.yaml with valid_lft forever.

Finding: Hetzner IPv6 floating IPs use /64 prefix (not /128). Corrected in docs.

Phase 4 ✅ — Update DNS A/AAAA for UDP1

• Updated udp1 A record: 116.202.176.169 → 116.202.177.184
• Updated udp1 AAAA record: 2a01:4f8:1c0c:9aae::1 → 2a01:4f8:1c0c:828e::1
• Updated dns-setup.md to reflect the change

Phase 5 ✅ — Submission Accepted (Attempt 3)

Three submission attempts were required. Both IPv4 always worked fine; the issue was
IPv6-specific.

Attempts 1 & 2 — Rejected (UDP timeout)

newTrackon probed via IPv6 (2a01:4f8:1c0c:828e::1) and received no response.

Attempt 3 — Accepted ✅

URL:      udp://udp1.torrust-tracker-demo.com:6969/announce
IP:       2a01:4f8:1c0c:828e::1
Result:   ✅ Accepted
Response: {'interval': 300, 'leechers': 0, 'peers': [], 'seeds': 1}

Root Causes Fixed

Root Cause 1 — ufw blocking IPv6 UDP 6969 (primary)

tcpdump during a probe showed packets arriving at eth0 but no replies leaving — meaning the
container never processed them. Checking ufw revealed 6969/udp was absent from the allow list.

Docker bypasses the iptables INPUT chain for IPv4 published ports via DNAT rules — which is
why IPv4 always worked. But Docker does not manage ip6tables, so ufw's
default: deny (incoming) silently dropped all IPv6 UDP 6969 packets.

Fix:

sudo ufw allow 6969/udp

The ufw rule is persistent — stored in /etc/ufw/ and survives reboot.

Root Cause 2 — asymmetric routing (secondary)

Without policy-based routing, the kernel routes replies via the default route — packets leave
via the primary server IP, not the floating IP the probe arrived on. newTrackon discards replies
with a mismatched source.

Fix — two custom routing tables, one per floating IP:

# IPv4 (table 100)
ip route add default via 172.31.1.1 dev eth0 table 100
ip rule add from 116.202.177.184 table 100

# IPv6 (table 200) — was already present from an earlier attempt
# ip -6 route add default via fe80::1 dev eth0 table 200
# ip -6 rule add from 2a01:4f8:1c0c:828e::1 table 200

These were initially applied at runtime, then persisted via netplan (see below).

Persisting Policy Routing via Netplan

The server has two netplan files:

File	Managed by	Purpose
50-cloud-init.yaml	cloud-init (auto)	Primary interface, DHCP4, primary IPv6, default routes
60-floating-ip.yaml	manually	Floating IPs + policy routing rules

The routing-policy and per-table routes stanzas were added to 60-floating-ip.yaml:

routing-policy:
  - from: 116.202.177.184
    table: 100
  - from: 2a01:4f8:1c0c:828e::1
    table: 200
routes:
  - to: default
    via: 172.31.1.1
    table: 100
  - to: default
    via: fe80::1
    table: 200

Applied with sudo netplan apply. Rules verified active with ip rule list / ip -6 rule list.

Full investigation: ipv6-udp-tracker-issue.md

Files Changed

File	Change
docs/deployments/hetzner-demo-tracker/post-provision/ipv6-udp-tracker-issue.md	New — full investigation, tcpdump/ufw/iptables evidence, confirmed root causes, all fixes including netplan persistence with cloud-init context
docs/deployments/hetzner-demo-tracker/post-provision/newtrackon-prerequisites.md	New — full fix plan, step-by-step with actual outputs and all 3 submission attempts
docs/deployments/hetzner-demo-tracker/post-provision/dns-setup.md	Updated — udp1 A/AAAA records, Step 4 section
docs/deployments/hetzner-demo-tracker/post-provision/README.md	Updated — new entries in post-deployment table
docs/deployments/hetzner-demo-tracker/tracker-registry.md	Updated — both trackers listed, final state screenshot
docs/deployments/hetzner-demo-tracker/README.md	Updated — link to newtrackon-prerequisites.md
docs/deployments/hetzner-demo-tracker/prerequisites.md	Updated — floating IP names
docs/issues/407-submit-udp1-tracker-to-newtrackon.md	New — issue spec, all tasks complete
docs/deployments/hetzner-demo-tracker/media/newtrackon-submitted-udp1-accepted.png	New — screenshot of acceptance
docs/deployments/hetzner-demo-tracker/media/newtrackon-home-three-trackers-listed.png	New — screenshot of newTrackon homepage listing 3 trackers
project-words.txt	Added newtrackon, ulnp, UNCONN, tcpdump, flowlabel, hlim, DNAT, macaddress

Acceptance Criteria Status

• BEP 34 TXT records present and verified with dig
• Two new floating IPs provisioned and assigned
• All four floating IPs configured via netplan
• udp1.torrust-tracker-demo.com resolves to new IPs
• udp://udp1.torrust-tracker-demo.com:6969/announce listed on newTrackon
• newtrackon-prerequisites.md documents prerequisites clearly
• tracker-registry.md updated with final submission status
• Policy routing rules persisted in netplan
• Pre-commit checks pass — pending final push

[josecelano]

ACK 2fd3a23