2026 Halo-style global entry on vpshalo
SSH ControlMaster multiplexing, cross-region session stickiness, and artifact return p95 acceptance

Related reads: GeoDNS global entry matrix, MSS and BBR SSH p95, Tailscale MagicDNS multi-region. Home · Help · Pricing · Node selector.

1) Scripts open fresh TCP to every PoP; handshake p95 through a JumpHost looks like a slow node. 2) After GeoDNS weight shifts, a stale ControlPath socket still serves the old region. 3) Without Halo routing health alignment, Tokyo and Singapore flaps blur DNS stickiness and SSH master failures.

Halo path decision matrix (SSH layer)

Choose the transport before you tune multiplex timers.

ControlMaster and ControlPersist parameters

The master session pays KEX and authentication once. Child sessions ride a Unix socket and cut perceived cross-region latency on CI fan-out.

Set ControlPersist near your GeoDNS TTL window—typically eight to fifteen minutes—so a DNS drift does not pin the wrong PoP for hours.

# ~/.ssh/config (vpshalo multi-region template)
Host vpshalo-*
  ControlMaster auto
  ControlPath ~/.ssh/cm-%r@%h:%p
  ControlPersist 12m
  ServerAliveInterval 30
  ServerAliveCountMax 3
  Compression no
  IdentitiesOnly yes

Host vpshalo-tokyo
  HostName tokyo.entry.example.com
  User mac

Host vpshalo-hk
  HostName hk.entry.example.com
  User mac

Parameter map: ControlMaster auto opens the master on first connect; ControlPath must live in mode 700 and never be shared across users; ControlPersist 12m keeps the socket warm without children; disable Compression when artifacts are already compressed archives.

JumpHost chain and segmented timing

Match the SSH CA × JumpHost layout: the bastion forwards and audits only. Build the ControlMaster on the bastion or first hop—not on every downstream builder.

Host vpshalo-bastion
  HostName bastion.vpshalo.example
  ControlMaster auto
  ControlPath ~/.ssh/cm-bastion-%r@%h:%p
  ControlPersist 10m

Host vpshalo-tokyo-mac
  HostName 10.64.0.12
  ProxyJump vpshalo-bastion
  ControlMaster auto
  ControlPath ~/.ssh/cm-tky-%r@%h:%p

Validate with ssh -G vpshalo-tokyo-mac and time ssh -O check vpshalo-bastion. Log ConnectTime per hop against the global entry matrix baseline before you blame Mac hardware.

Stickiness and health checks

DNS stickiness from GeoDNS picks the PoP. SSH stickiness comes from ControlPersist plus one ControlPath string per PoP.

• Before weight changes: run ssh -O exit on old regions so sockets do not linger.
• Parallel builds: one master per PoP; never reuse the same path across regions.
• Long transfers: raise ServerAliveInterval during artifact pulls so NAT does not kill the master.

Health: probe loopback or ssh -O check per region, merge JSON by {region, 5min}, and escalate only after two red buckets—same discipline as the BBR matrix rollout windows.

Artifact return p95 testing

Sample Tokyo, Seoul, Hong Kong, Singapore, and US West in one window. Use a fixed 512MB artifact and run at least thirty scp or rsync -e ssh pulls per region.

Baseline without ControlMaster first. Repeat with the master warm. Compare handshake connect p95 and transfer completion p95. On intercontinental paths, run MSS and BBR tuning before shortening ControlPersist.

• 1 Lock ingress hostnames and GeoDNS weights; archive dig output.
• 2 Deploy ssh_config; open the master with ssh -MNf vpshalo-tokyo.
• 3 Run thirty pulls without multiplexing; record baseline p95.
• 4 Re-run with ControlMaster; compare handshake and return p95.
• 5 Simulate a weight shift; confirm sticky teardown and rebuild.
• 6 File the sign-off table; swap PoP or Jump chain if gates fail.

FAQ

Stale socket and connection refused? Remove expired ~/.ssh/cm-* files, confirm directory mode 700, then ssh -O exit after abnormal master exits.

Slow pulls after a region change? Build a fresh master on the new PoP; never reuse a ControlPath across regions. Cross-check GeoDNS weights and TTL.

Using Tailscale too? Enable ControlMaster on MagicDNS hostnames inside the tailnet—the transport changes, the multiplex rules do not. See the Tailscale article.

Choose a region after green rows: Tokyo, Seoul, Hong Kong, Singapore, US West, or the node selector.