# Open issues

As of **2026-07-16** (live scan on koopa). No secrets.

---

## I-2026-07-16-01 — firewalld: Nym ports on koopa unverified

| | |
|--|--|
| **Severity** | high (for public Nym reachability) |
| **Host** | koopa |
| **Status** | open |

VeciGate DNATs **1789/tcp+udp**, **1790/tcp**, **51822/udp** → koopa.  
Without matching **firewalld** allow rules on koopa, traffic dies on the host.

Agent could not run `firewall-cmd` (**sudo password required**).

```bash
# on koopa (with sudo)
sudo firewall-cmd --permanent --add-port=1789/tcp
sudo firewall-cmd --permanent --add-port=1789/udp
sudo firewall-cmd --permanent --add-port=1790/tcp
sudo firewall-cmd --permanent --add-port=51822/udp
sudo firewall-cmd --reload
sudo firewall-cmd --list-ports
```

---

## I-2026-07-16-02 — Nym node not bonded / not in public explorers

| | |
|--|--|
| **Severity** | medium (visibility on the Nym network) |
| **Host** | koopa (`koopa-nym`) |
| **Status** | open |

Container **is running** (mixnode); API on **9080** answers.  
Without a **bond** in the Nym wallet the node typically does **not** show up in Harbour Master / network explorers (unlike Tor after ORPort publish).

See also: `configs/nym/PUBLIC-LISTING.md`.

Logs: WARN `validator.nymtech.net/api/.../refresh-described` → **404** (API path/version; node still runs mixmode).

**Identity key (public):** `55gPqeyHHj4CwpVZXLEQy9MjSvVTVXM8t2pMmNCH2MsW`

---

## I-2026-07-16-03 — `podman-restart.service` enabled, inactive this session

| | |
|--|--|
| **Severity** | low (until reboot is tested) |
| **Host** | koopa (user hernani) |
| **Status** | open / expected until reboot |

`systemctl --user is-enabled podman-restart` = **enabled**,  
`is-active` = **inactive** (oneshot; has not run this boot session).

After reboot:

```bash
systemctl --user is-active podman-restart.service
podman ps -a --filter should-start-on-boot=true --format '{{.Names}} {{.Status}}'
```

---

## I-2026-07-16-04 — Stray container `kind_taussig`

| | |
|--|--|
| **Severity** | low (hygiene) |
| **Host** | koopa |
| **Status** | open |

Container **Up** ~5 days: `kind_taussig` (`debian:bookworm-slim`), one-off wallet/DEB test script, **`restart=no`**, not a production name.

Candidate to stop/remove when logs are no longer needed:

```bash
podman stop kind_taussig
podman rm kind_taussig
```

---

## I-2026-07-16-05 — Old exited Podman containers (clutter)

| | |
|--|--|
| **Severity** | low (hygiene) |
| **Host** | koopa |
| **Status** | open |

Several **Exited** containers (months/years old), e.g. `pensive_dubinsky`,  
`hardcore_edison`, `taler-exchange-no-network`, `debian00`, …  
No autostart; only clutter `podman ps -a`.

Optional cleanup: `podman container prune` (exited only, after review).

---

## I-2026-07-16-06 — Nym HTTP API listens on `*:9080`

| | |
|--|--|
| **Severity** | low–medium (attack surface) |
| **Host** | koopa |
| **Status** | open (as configured in compose) |

`ss` shows **\*:9080** (rootlessport). **No** VeciGate DNAT for 9080.  
Usually not reachable from WAN without NAT; reachable from LAN.

Optional harden: publish only `127.0.0.1:9080:8080` in compose.

---

## Not an issue (scan)

- All production `should-start-on-boot` containers **Up**
- No failed user units
- Taler ports 9010–9015 respond (401/302 OK)
- Linger=yes, container-* units enabled