Fallback across VPN fabric endpoint candidates

2026-05-16 10:54:11 +03:00
parent 4ebc6629e6
commit 850bd67b6a
3 changed files with 116 additions and 47 deletions
@@ -316,6 +316,9 @@ legacy peer endpoints when the control plane has not published candidates yet.
 The temporary self-signed QUIC listener advertises its SHA-256 certificate
 fingerprint in endpoint metadata, and the QUIC client can pin that fingerprint
 instead of disabling verification while the cluster CA path is being finished.
+VPN fabric-session dialing now walks all ranked endpoint candidates before
+falling back to the legacy peer endpoint, so a failed QUIC candidate does not
+block WebSocket/HTTPS compatibility transport.

 Deliverables: