From 73d0835b8b9b30feaac48d56f8bd626eecbe566c Mon Sep 17 00:00:00 2001
From: George K <george@coder.com>
Date: Wed, 16 Sep 2026 14:52:21 -0700
Subject: [PATCH] test(coderd/healthcheck/derphealth): use local STUN server
 (#29435)

Replace the public Google STUN fixture with Tailscale's in-process
test server. Use `STUNTestIP` to make intentionally unhealthy nodes fail
without DNS access or waiting for the UDP probe timeout.

Rationale: These tests validate STUN reachability and health
aggregation, not public NAT behavior. A local STUN server provides the
required protocol response without an external network dependency.

Refs:
https://linear.app/codercom/issue/PLAT-495
---
 coderd/healthcheck/derphealth/derp_test.go | 24 ++++++++++++++++------
 1 file changed, 18 insertions(+), 6 deletions(-)

diff --git a/coderd/healthcheck/derphealth/derp_test.go b/coderd/healthcheck/derphealth/derp_test.go
index b6177d3db8..084064c56c 100644
--- a/coderd/healthcheck/derphealth/derp_test.go
+++ b/coderd/healthcheck/derphealth/derp_test.go
@@ -15,6 +15,7 @@ import (
 	"tailscale.com/derp"
 	"tailscale.com/derp/derphttp"
 	"tailscale.com/ipn"
+	"tailscale.com/net/stun/stuntest"
 	"tailscale.com/tailcfg"
 	"tailscale.com/types/key"
 
@@ -366,6 +367,7 @@ func TestDERP(t *testing.T) {
 
 	t.Run("STUNOnly/WarnsNoDERP", func(t *testing.T) {
 		t.Parallel()
+		stunPort := serveSTUN(t)
 
 		var (
 			ctx    = context.Background()
@@ -378,8 +380,9 @@ func TestDERP(t *testing.T) {
 						Nodes: []*tailcfg.DERPNode{{
 							Name:             "999stun0",
 							RegionID:         999,
-							HostName:         "stun.l.google.com",
-							STUNPort:         19302,
+							IPv4:             "127.0.0.1",
+							IPv6:             "none",
+							STUNPort:         stunPort,
 							STUNOnly:         true,
 							InsecureForTests: true,
 							ForceHTTP:        true,
@@ -433,6 +436,7 @@ func TestDERP(t *testing.T) {
 
 	t.Run("STUNOnly/OneBadOneGood", func(t *testing.T) {
 		t.Parallel()
+		goodSTUNPort := serveSTUN(t)
 
 		var (
 			ctx    = context.Background()
@@ -446,7 +450,7 @@ func TestDERP(t *testing.T) {
 							Nodes: []*tailcfg.DERPNode{{
 								Name:             "badstun",
 								RegionID:         999,
-								HostName:         "badstun.example.com",
+								STUNTestIP:       "not-an-ip",
 								STUNPort:         19302,
 								STUNOnly:         true,
 								InsecureForTests: true,
@@ -454,8 +458,9 @@ func TestDERP(t *testing.T) {
 							}, {
 								Name:             "goodstun",
 								RegionID:         999,
-								HostName:         "stun.l.google.com",
-								STUNPort:         19302,
+								IPv4:             "127.0.0.1",
+								IPv6:             "none",
+								STUNPort:         goodSTUNPort,
 								STUNOnly:         true,
 								InsecureForTests: true,
 								ForceHTTP:        true,
@@ -509,7 +514,7 @@ func TestDERP(t *testing.T) {
 							Nodes: []*tailcfg.DERPNode{{
 								Name:             "badstun",
 								RegionID:         999,
-								HostName:         "badstun.example.com",
+								STUNTestIP:       "not-an-ip",
 								STUNPort:         19302,
 								STUNOnly:         true,
 								InsecureForTests: true,
@@ -539,6 +544,13 @@ func TestDERP(t *testing.T) {
 	})
 }
 
+func serveSTUN(t testing.TB) int {
+	t.Helper()
+	addr, cleanup := stuntest.Serve(t)
+	t.Cleanup(cleanup)
+	return addr.Port
+}
+
 func tsDERPMap(ctx context.Context, t testing.TB) *tailcfg.DERPMap {
 	req, err := http.NewRequestWithContext(ctx, "GET", ipn.DefaultControlURL+"/derpmap/default", nil)
 	require.NoError(t, err)