feat(cli): route server through server set

`--bind` becomes repeatable, so one process can serve several addresses:
an explicit IPv4 and IPv6 pair on one port, or two interface addresses
that must stay distinct.

The applet now builds a `ServerSet` for every invocation, including a
single bind. There is deliberately no bind-count branch and no direct
path from the CLI to `Server`: one orchestration path means startup
errors, shutdown and listener-failure handling are identical whatever was
configured, and the single-listener case — the common one — keeps that
path exercised in normal use rather than only in tests.

The configuration stays one `ServerConfig`; addresses never enter it, and
`ServerSet` clones it into each listener. Bounds in it are therefore per
listener, which `--max-sessions` help now says. Listener lines are
printed only once the whole set is up, so a set whose second bind fails
no longer announces the first as listening.

The shutdown flag, its polling future and the current-thread runtime are
unchanged: exactly one shutdown future is created and the set fans it out
internally.

crates/irtt-cli/src/cmd/server/args.rs

@@ -10,16 +10,17 @@ use irtt_server::{ServerConfig, TimestampAllowance};
 #[command(
     name = "irtt-server",
     about = "Minimal IRTT-compatible UDP server",
-    after_help = "Policy options left unset keep the irtt-server library defaults.\nOne process serves exactly one listener; run a second process for a second address."
+    after_help = "Policy options left unset keep the irtt-server library defaults.\nRepeat --bind to serve multiple addresses in one process. All listeners use the same policy but keep independent session namespaces."
 )]
 pub struct ServerArgs {
-    /// Local UDP address to bind, as ADDR:PORT.
+    /// Local UDP address to bind, as ADDR:PORT. Repeatable.
     #[arg(
         long,
+        required = true,
         value_name = "ADDR",
-        long_help = "Local UDP address to bind, as ADDR:PORT, for example 127.0.0.1:2112 or [::1]:2112. Host names are not resolved.\n\nA wildcard bind such as 0.0.0.0:2112 answers each request from the address it was sent to, using per-packet destination metadata. That is supported on Linux, macOS and FreeBSD; on other systems a wildcard bind is refused and an explicit interface address is required."
+        long_help = "Local UDP address to bind, as ADDR:PORT, for example 127.0.0.1:2112 or [::1]:2112. Host names are not resolved.\n\nRepeat the option to serve several addresses from one process, in the order given. Every listener applies the same policy options, but each keeps its own sessions and tokens, so a session belongs to the address it was opened on. Binding is all or nothing: if any address cannot be bound, none are served.\n\nA wildcard bind such as 0.0.0.0:2112 answers each request from the address it was sent to, using per-packet destination metadata. That is supported on Linux, macOS and FreeBSD; on other systems a wildcard bind is refused and an explicit interface address is required.\n\nA port of 0 selects an unused port per listener, so two such binds get two different ports."
     )]
-    pub bind: SocketAddr,
+    pub bind: Vec<SocketAddr>,
 
     /// HMAC key; every request must then carry a valid MAC.
     #[arg(
@@ -29,11 +30,11 @@ pub struct ServerArgs {
     )]
     pub hmac: Option<String>,
 
-    /// Maximum number of simultaneously live sessions.
+    /// Maximum simultaneously live sessions per listener.
     #[arg(
         long,
         value_name = "COUNT",
-        long_help = "Maximum number of simultaneously live sessions. Once the table is full, a session-creating open is dropped silently; nothing is evicted. Zero refuses every session-creating open."
+        long_help = "Maximum number of simultaneously live sessions per listener. Once a listener's table is full, a session-creating open to it is dropped silently; nothing is evicted. Zero refuses every session-creating open.\n\nThis is a per-listener bound, not a process-wide one: with two --bind options, each listener admits up to this many sessions."
     )]
     pub max_sessions: Option<usize>,
 
@@ -226,16 +227,67 @@ mod tests {
 
     #[test]
     fn bind_is_required_and_parses_both_families() {
-        assert!(parse(&[]).is_err());
+        assert!(
+            parse(&[]).is_err(),
+            "a server with no address serves nothing"
+        );
 
         let ipv4 = parse(&["--bind", "127.0.0.1:2112"]).unwrap();
-        assert_eq!(ipv4.bind, SocketAddr::from((Ipv4Addr::LOCALHOST, 2112)));
+        assert_eq!(ipv4.bind, [SocketAddr::from((Ipv4Addr::LOCALHOST, 2112))]);
 
         let ipv6 = parse(&["--bind", "[::1]:2112"]).unwrap();
-        assert_eq!(ipv6.bind, SocketAddr::from((Ipv6Addr::LOCALHOST, 2112)));
+        assert_eq!(ipv6.bind, [SocketAddr::from((Ipv6Addr::LOCALHOST, 2112))]);
 
         assert!(parse(&["--bind", "127.0.0.1"]).is_err());
         assert!(parse(&["--bind", "localhost:2112"]).is_err());
+        // Still one address per option: comma-separated syntax is not a thing
+        // here, and accepting it silently would be worse than rejecting it.
+        assert!(parse(&["--bind", "127.0.0.1:2112,[::1]:2112"]).is_err());
+    }
+
+    #[test]
+    fn bind_is_repeatable_and_keeps_the_requested_order() {
+        let args = parse(&[
+            "--bind",
+            "[::1]:2112",
+            "--bind",
+            "127.0.0.1:2112",
+            "--bind",
+            "127.0.0.1:2113",
+        ])
+        .unwrap();
+
+        assert_eq!(
+            args.bind,
+            [
+                SocketAddr::from((Ipv6Addr::LOCALHOST, 2112)),
+                SocketAddr::from((Ipv4Addr::LOCALHOST, 2112)),
+                SocketAddr::from((Ipv4Addr::LOCALHOST, 2113)),
+            ],
+            "listeners are served in the order they were requested"
+        );
+    }
+
+    #[test]
+    fn the_configuration_is_one_policy_however_many_listeners_there_are() {
+        // Addresses never enter the server configuration: every listener is
+        // built from a clone of this one value.
+        let one = parse(&["--bind", "127.0.0.1:2112", "--max-sessions", "4"])
+            .unwrap()
+            .server_config();
+        let several = parse(&[
+            "--bind",
+            "127.0.0.1:2112",
+            "--bind",
+            "[::1]:2112",
+            "--max-sessions",
+            "4",
+        ])
+        .unwrap()
+        .server_config();
+
+        assert_eq!(one, several);
+        assert_eq!(several.max_sessions(), 4, "and it is a per-listener bound");
     }
 
     #[test]

crates/irtt-cli/src/cmd/server/run.rs

@@ -3,21 +3,24 @@ use std::{
     time::Duration,
 };
 
-use irtt_server::Server;
+use irtt_server::ServerSet;
 
 use super::args::ServerArgs;
 
 /// How often the shutdown future samples the process-wide signal flag.
 ///
 /// The flag a signal handler sets has no async wake mechanism, so the future
-/// polls it on a timer rather than spinning. `Server::run` owns everything after
-/// that future becomes ready.
+/// polls it on a timer rather than spinning. `ServerSet::run` owns everything
+/// after that future becomes ready, including fanning it out to the listeners.
 const SHUTDOWN_POLL_INTERVAL: Duration = Duration::from_millis(50);
 
-/// Runs one listener until the process is asked to shut down.
+/// Runs the configured listeners until the process is asked to shut down.
 ///
-/// The applet owns exactly one current-thread Tokio runtime, one bound socket
-/// and one reusable [`Server`]; the server's own loop is the event loop.
+/// The applet owns exactly one current-thread Tokio runtime and one
+/// [`ServerSet`], whatever number of addresses was requested. A single `--bind`
+/// is an ordinary set of one and takes the same path as a set of several: one
+/// construction, one shutdown future, one supervision rule. Listener
+/// concurrency is async I/O concurrency and needs no worker threads.
 pub fn run_server(
     args: ServerArgs,
     shutdown_requested: &AtomicBool,
@@ -32,9 +35,14 @@ async fn serve(
     args: ServerArgs,
     shutdown_requested: &AtomicBool,
 ) -> Result<(), Box<dyn std::error::Error>> {
-    let mut server = Server::bind(args.bind, args.server_config()).await?;
-    eprintln!("irtt-server: listening on {}", server.local_addr()?);
-    server.run(shutdown_signal(shutdown_requested)).await?;
+    let config = args.server_config();
+    let set = ServerSet::bind(args.bind, config).await?;
+    // Only once every listener is up. Announcing one address and then failing
+    // to bind the next would report a service that never started.
+    for addr in set.local_addrs() {
+        eprintln!("irtt-server: listening on {addr}");
+    }
+    set.run(shutdown_signal(shutdown_requested)).await?;
     Ok(())
 }
 
@@ -50,11 +58,28 @@ mod tests {
 
     use super::*;
 
+    /// The ordinary invocation, and the one that keeps the single-listener case
+    /// on the same orchestration path as every other.
     #[test]
-    fn an_already_requested_shutdown_binds_and_returns() {
+    fn an_already_requested_shutdown_binds_one_listener_and_returns() {
         let args = ServerArgs::try_parse_from(["irtt-server", "--bind", "127.0.0.1:0"]).unwrap();
         let shutdown_requested = AtomicBool::new(true);
 
         run_server(args, &shutdown_requested).unwrap();
     }
+
+    #[test]
+    fn an_already_requested_shutdown_binds_every_listener_and_returns() {
+        let args = ServerArgs::try_parse_from([
+            "irtt-server",
+            "--bind",
+            "127.0.0.1:0",
+            "--bind",
+            "127.0.0.1:0",
+        ])
+        .unwrap();
+        let shutdown_requested = AtomicBool::new(true);
+
+        run_server(args, &shutdown_requested).unwrap();
+    }
 }