feat(flow-export): path-mtu sizes datagrams for a tunnel to the collectors

[lunarthegrey]

Why

flow-export's datagrams are a fixed 1,400 bytes. That fits a 1500-byte path, but not the tunnel the production collectors will most likely sit behind: Tailscale's MTU is 1280.

• Every full datagram would leave fragmented.
• Losing either fragment loses the whole datagram: a batch of sFlow samples, or IPFIX records the flow cache has already exported.

What changes

• New directive path-mtu <bytes> in module flow-export.
  • Hot, range 576–9000.
  • Each datagram becomes that MTU less 48 (IPv6 and UDP headers, so either family fits). path-mtu 1280 sends 1,232-byte datagrams.
  • Unset, nothing changes: 1,400 bytes.
• One value per section, not per collector.
  • The sFlow exporter encodes each datagram once for every sFlow collector, under one agent sequence. IPFIX encodes once per privacy profile.
  • A router's collectors share a path anyway.
  • A per-collector size would need an encode and a sequence stream per size.
• Floor of 576.
  • It still holds a sample of the most header-bytes allows (256) in sFlow's expanded encoding with an IPv6 agent.
  • It also holds the IPFIX announcement with its records.
  • Tests cover both.
• The exporters take the size per call instead of sflow_out::MAX_DATAGRAM, so a reload applies from the next tick.
• Docs:
  • The runbook's Collectors section gains a "set path-mtu over a tunnel" note.
  • It also covers what Tailscale needs: collector and source-address on Tailscale addresses, tailnet ACLs for the UDP ports, and Docker's default port publishing so the exporter's address survives.
  • example.conf and the CHANGELOG are updated.

Testing

• Config: path-mtu parses; values outside 576–9000 and duplicates are refused. path-mtu 1280 becomes 1,232-byte datagrams, unset 1,400.
• sFlow: at the smallest size, every sample of the largest header still goes (expanded encoding, IPv6 agent), with no datagram larger than the size.
• IPFIX: at the smallest size, the announcement comes first, all 500 records go, none are unencodable, and the messages are more and smaller.
• Worker: a reload from 1,400 to 528 applies on the next tick. The same 20 samples arrive in more datagrams, none over 528.
• Checks run: cargo fmt; clippy on the host and both Linux targets (--workspace --all-targets --all-features -D warnings); host cargo test --workspace.
• Not run locally: the root end-to-end suite in Docker (Docker Desktop wasn't running). CI's qemu jobs run it.

🤖 Generated with Claude Code

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-11T03:08:44.844667Z	ddaf967	PR opened
🔒 Security Review	✅ Completed 2026-10-11T03:07:59.769890Z	ddaf967	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: ddaf967e34

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".