[dennisklein]

Requested by Dennis · project thread

Before: one nm-sshuttle VPN at a time. Every name the plugin used was fixed (nmss0, the guard table, the tunnel unit, the bus name), so a second profile could not be switched on next to the first.

After: up to 8 nm-sshuttle VPNs can be on together, each with its own toggle, reconnects, guard, DNS link and tunnel. A profile that would fight an active one (overlapping networks, both dns=all, a shared DNS domain, or a loop of jump hosts) is refused, and the journal and nm-sshuttle check name the other profile. One tunnel's ssh can run over another's, and it comes back at once after the other's gap.

It implements docs/later/multiple-tunnels.md and is stacked on #11 (tproxy), so its base is that branch. Merge #11 first.

How: the .name file sets supports-multiple-connections=true, so NM passes a bus name per activation. The shim hands it to a new D-Bus activated dispatcher. The dispatcher picks the lowest free of 8 slots, writes the name to /run/nm-sshuttle/N/bus-name and starts nm-sshuttle@N.service. That instance owns the name and sends READY=1. It serves one activation and then exits. Everything it creates carries the slot: nmssN, nm-sshuttle-guard-N, nm-sshuttle-tunnel@N.service, the spec file, the pinned ssh config /run/nm-sshuttle-ssh/ssh_config-N, and the tproxy mark, table and rule. At Connect, before it creates anything, it checks its claim against the other slots' claims under a lock. The health check counts only listeners in its own tunnel unit's cgroup. cleanup takes --slot N or --all; --all also removes the single-tunnel names after an upgrade. list marks active profiles.

Found by the VM runs and fixed here:

• Bus policy: dbus-broker denied NM's calls to the dispatcher under a send_destination_prefix rule, so the policy names the dispatcher outright. NM does pass --bus-name once multiple connections are on.
• sshuttle can outlive its ssh (fix: reconnect when sshuttle outlives its ssh): in about one MT-02 run in three, corp's gap ended the lab's ssh, but the lab's sshuttle kept listening and the plugin saw nothing wrong. The health check now wants an ssh process in the tunnel unit and reconnects without one. Unit tests cover it; the VM runs since have not hit the case, so the VM has not yet seen it fire.

Results:

• Unit and D-Bus tests: 345 pass. The editor's C tests pass.
• VM: 563 passed, 0 failed on this head, after two earlier runs of 546 passed and 0 failed. It includes MT-01 (two tunnels with their own DNS, a reconnect of one, a refused overlap, a kill, an NM restart), MT-02 (the lab over corp; back 657–783 ms after corp), MT-03 (start-up: 267 ms cold, 132 ms warm) and main's M2-29 with the per-slot ssh config. The single-tunnel scenarios follow the newest instance's slot.
• Not automated: the upgrade from a running single-tunnel version, and suspend with two tunnels.

Profile keys: none change. The GNOME editor needs nothing for this PR.

🤖 Generated with Claude Code