Hydra: Not accessible for clients who use IPv6 in preference to IPv4

[j-baker]

Affected service: Hydra

Describe the issue

https://hydra.nixos.org not accessible behind company proxy.

My company uses the Cloudflare WARP Zero Trust VPN. This is a fairly typical MITM corporate VPN. This VPN prefers IPv6 over v4 if both are present. As observed by me, hydra.nixos.org has an A record of 5.9.122.43 which works fine. It also has an AAAA record of 2a01:4f8:162:71eb:: which does not appear to have a webserver hosted on it on port 80 or 443. The VPN then serves an error response.

While my company's IT org has been great and hardcoded that the VPN should prefer IPv4 for this domain, it feels like a bug that hydra.nixos.org publishes an IPv6 record for a computer with no HTTP server running. To my knowledge there is no requirement that a client which supports both IPv4 and v6 should prefer to use IPv4 for any connection, though this is apparently conventional.

[delroth]

Confirmed: currently things only "work" because of the v4 fallback in most clients. See e.g. curl -vvv:

$ curl -vvv https://hydra.nixos.org -s -o /dev/null
*   Trying [2a01:4f8:162:71eb::]:443...
* connect to 2a01:4f8:162:71eb:: port 443 failed: Connection refused
*   Trying 5.9.122.43:443...
* Connected to hydra.nixos.org (5.9.122.43) port 443

[vcunat]

A recurrence of #221 ?

EDIT: except that aarch64.nixos.community seems OK.

[vcunat]

BTW, a side note. I believe it's normal to prefer IPv6 to IPv4, but in that case you try IPv4 when IPv6 fails. (Or even try both in parallel.) https://en.wikipedia.org/wiki/Happy_Eyeballs