Seeding nodes log in before leasing; TLS through tunnels

- seed:node logs in to NNTP before taking a range and keeps the connection
  across ranges (replaced after 2 minutes idle or a failed range). A node
  that can't reach its news server takes no range: two ranges were set
  aside as failed while an office node's tunnel was being set up
  (ECONNREFUSED 127.0.0.1:1563, five leases each). After an IP-address
  limit refusal it waits 5 minutes.
- NNTP_TLS_SERVERNAME: the hostname the TLS certificate is checked
  against when NNTP_HOST is a tunnel ("Hostname/IP does not match
  certificate's altnames: Host: localhost").
- seed-node/README: the IP-address limit and tunnelling.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

seed-node/README.md

@@ -16,8 +16,14 @@ database or Redis.
   gzip-compressed); a few hundred MB of RAM per node. Disk: about 1.5 GB for
   the image.
 - An NNTP account. Every connection a node opens counts against that
-  account's connection limit, next to the ~40 the indexer itself uses if it's
-  the same account. Too many gives `481`/`502` errors at login.
+  account's connection limit, next to the ~20 the indexer itself uses if it's
+  the same account. Too many gives `481`/`502` errors at login. Some
+  providers also limit the number of IP addresses at once (Eweka: 2, as
+  `502 (max number of simultaneous IP addresses reached: 2)`): a node behind
+  the same public IP as the indexer doesn't count extra, others do. A node
+  can share an IP by tunnelling its NNTP traffic (e.g. SSH
+  `-L 1563:news.eweka.nl:563` to the indexer's machine); then set
+  `NNTP_HOST` to the tunnel and `NNTP_TLS_SERVERNAME=news.eweka.nl`.
 
 ## 1. On the indexer (homelab): a token for the node
 
@@ -44,6 +50,7 @@ for the same name replaces the token; `--disable` revokes it.
 | `SEED_CONNECTIONS` | ranges worked on at once, one NNTP connection each. Start with 2–4. |
 | `NNTP_HOST`, `NNTP_PORT`, `NNTP_SECURE` | the news server; over the internet use TLS: port `563`, `NNTP_SECURE=true` (for Eweka: `news.eweka.nl`) |
 | `NNTP_USER`, `NNTP_PASSWORD` | the NNTP account |
+| `NNTP_TLS_SERVERNAME` | only through a tunnel: the news server's real hostname, for the TLS certificate check |
 
 Leave the block below "Required by the app's configuration, but unused" as
 it is: the app checks these settings at startup, but a node never uses them.
@@ -90,6 +97,7 @@ articles reached, and per node its leases and headers.
 |---|---|
 | `The seed API rejected this node token` | wrong or revoked `SEED_TOKEN`; the node stops |
 | `Seed API …: 404 …; retrying` | the seed API is restarting (a deploy on homelab); the node retries |
-| `NNTP: unexpected reply "481 …"` or `"502 …"` | NNTP login refused: wrong account, or too many connections on it; lower `SEED_CONNECTIONS` |
+| `NNTP login failed: …` | the node didn't take a range and tries again in a minute (5 minutes for the IP-address limit); `481`/`502`: wrong account, too many connections (lower `SEED_CONNECTIONS`) or too many IP addresses |
+| `Hostname/IP does not match certificate's altnames: Host: localhost` | TLS through a tunnel: set `NNTP_TLS_SERVERNAME` to the news server's hostname |
 | `Range … failed: …` | the range is given back and retried later, possibly by another node |
 | `Range … passed to another node; dropping it.` | this node was too slow to report (15 minutes); harmless |