feat(beefcake/mass): open TCP 8927 (Sendspin) for MA companion-app players #731

Merged

lytedev merged 1 commit from sendspin-8927 into main

2026-07-09 09:44:39 -05:00

lytedev commented

2026-07-09 09:36:21 -05:00

Owner

Opens TCP 8927 (Music Assistant Sendspin player WebSocket) on beefcake's LAN so the family's tablets running the MA Companion App register their native local player.

Why

The MA Companion App's native player is Sendspin, connecting directly to MA's :8927. beefcake's lan-lockdown allowlisted only :3483 (squeezelite) + :8097 (stream), so tablet players never registered — blocking the kids'-tablet half of the Hearth audio rollout. Confirmed mass listens on 8927 and it was absent from the allowlist. (The MA web player still worked via WebRTC fallback; the native app has none.)

Change (2 files)

music-assistant.nix: allowedTCPPorts [8097 3483] → [8097 3483 8927]
lan-lockdown.nix: lanMediaTcp "3483,8097" → "3483,8097,8927" (+ comment updates naming Sendspin/companion-app players)

Posture

:8927 is the same media-data-plane class as :3483/:8097 already LAN-open for this exact purpose — this completes that allowlist rather than loosening it. LAN-only (eno1), no new auth exposure. Admin/API :8095 stays off the list (Caddy TLS vhost only).

Deploy

Config-only firewall change → applies live via a no-reboot switch (#727 boot fixes only matter on next reboot, and #727 is in main). Handed off ready-to-apply by the hearth agent (w2:p1).

🤖 Generated with Claude Code

Opens **TCP 8927** (Music Assistant Sendspin player WebSocket) on beefcake's LAN so the family's tablets running the MA Companion App register their native local player. ## Why The MA Companion App's native player is **Sendspin**, connecting directly to MA's `:8927`. beefcake's lan-lockdown allowlisted only `:3483` (squeezelite) + `:8097` (stream), so tablet players never registered — blocking the kids'-tablet half of the Hearth audio rollout. Confirmed `mass` listens on 8927 and it was absent from the allowlist. (The MA *web* player still worked via WebRTC fallback; the native app has none.) ## Change (2 files) - `music-assistant.nix`: `allowedTCPPorts` `[8097 3483]` → `[8097 3483 8927]` - `lan-lockdown.nix`: `lanMediaTcp` `"3483,8097"` → `"3483,8097,8927"` (+ comment updates naming Sendspin/companion-app players) ## Posture `:8927` is the same **media-data-plane class** as `:3483/:8097` already LAN-open for this exact purpose — this *completes* that allowlist rather than loosening it. LAN-only (eno1), no new auth exposure. Admin/API `:8095` stays off the list (Caddy TLS vhost only). ## Deploy Config-only firewall change → applies live via a no-reboot switch (#727 boot fixes only matter on next reboot, and #727 is in main). Handed off ready-to-apply by the hearth agent (w2:p1). 🤖 Generated with [Claude Code](https://claude.com/claude-code)

lytedev added 1 commit

2026-07-09 09:36:22 -05:00

feat(beefcake/mass): open TCP 8927 (Sendspin) on LAN for MA companion-app players

/ check-format (push) Successful in 7s

Details

/ build (push) Has been skipped

Details

9183d1cba3

The family's tablets run the MA Companion App, whose native local player is
Sendspin, which connects directly to Music Assistant's :8927. beefcake's
lan-lockdown allowlisted only :3483 (squeezelite) and :8097 (stream), so those
players never registered in MA — blocking the kids'-tablet half of the Hearth
audio rollout. (The MA web player still worked via its WebRTC fallback; the
native app has no fallback.)

:8927 is the same media-data-plane class as :3483/:8097 already LAN-open for
exactly this purpose, so this completes that allowlist rather than loosening the
posture. LAN-only (eno1), no new auth exposure. Handed off ready-to-apply from
the hearth agent.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KWn6dEvY3b6S52jr8JoRGj

lytedev merged commit 9183d1cba3 into main

2026-07-09 09:44:39 -05:00

lytedev deleted branch sendspin-8927

2026-07-09 09:44:39 -05:00