Compare commits
9
Commits
| Author | SHA1 | Date | |
|---|---|---|---|
 jschoubben
|
3e378170df | ||
 mesh-admin
|
8064e5da8f | ||
|
jschoubben
|
63a255c5cb | ||
|
jschoubben
|
7ad1fbd5c6 | ||
|
jschoubben
|
67f5f4cffd | ||
|
jschoubben
|
8797335fbc | ||
|
mesh-admin
|
53dc108603 | ||
|
jschoubben
|
ebf5ba2d4c | ||
|
mesh-admin
|
bbac08a7d2 |
@@ -0,0 +1,56 @@
|
||||
{
|
||||
"module": "ca-trust",
|
||||
"version": "1",
|
||||
"slug": "catrust",
|
||||
"capabilities": [
|
||||
"service-manager"
|
||||
],
|
||||
"requires": [
|
||||
"internal-acme-ca"
|
||||
],
|
||||
"seats": [
|
||||
{
|
||||
"name": "the-mesh-trust-anchor",
|
||||
"scope": "node"
|
||||
}
|
||||
],
|
||||
"claims": [
|
||||
{
|
||||
"name": "the-mesh-trust-anchor",
|
||||
"scope": "node"
|
||||
}
|
||||
],
|
||||
"resources": [
|
||||
{
|
||||
"id": "state",
|
||||
"type": "directory",
|
||||
"mode": "0700",
|
||||
"place": "."
|
||||
},
|
||||
{
|
||||
"id": "anchor",
|
||||
"type": "file",
|
||||
"path": "${dir:state}/anchor",
|
||||
"mode": "0755",
|
||||
"content": "#!/bin/sh\n# The mesh's internal certificate authority, trusted by this machine.\n#\n# Written by the mesh from the ca-trust module's manifest (novox/hq ADR 0147).\n# Editing it here lasts until the next apply.\n#\n# There is no prior trust to verify the fetch against \u2014 this is the thing that\n# establishes it \u2014 so it is made over the mesh's own private network, which is\n# what authenticates it (novox/hq ADR 0098, the same reasoning that lets the\n# route proxy fetch this root for itself). What comes back is checked here: a\n# body that is not a certificate is refused now, rather than believed and then\n# failed by whatever reads the trust store next.\nset -eu\n\nROOTS='https://${bound:internal-acme-ca:at}:${bound:internal-acme-ca:port}${bound:internal-acme-ca:roots}'\nANCHORS=/etc/ca-certificates/trust-source/anchors\nANCHOR=\"$ANCHORS/mesh-internal-ca.crt\"\n\n# Arch's layout, said out loud rather than assumed: a machine that keeps its\n# anchors elsewhere fails here, visibly, instead of writing a file nothing\n# reads. That failure is the signal that this belongs in the host, where one\n# operating system's difference lives (novox/hq ADR 0147, option 2).\n[ -d \"$ANCHORS\" ] || {\n\techo \"this machine keeps no trust anchors in $ANCHORS; ca-trust is written for that layout\" >&2\n\texit 1\n}\n\ncase \"${1:-}\" in\ninstall)\n\ttmp=$(mktemp)\n\ttrap 'rm -f \"$tmp\"' EXIT\n\t# The authority may still be starting, or this machine may have come up\n\t# before it: two minutes of asking, then an honest failure.\n\tn=0\n\twhile [ \"$n\" -lt 60 ]; do\n\t\tif curl --fail --silent --show-error --insecure --max-time 10 \\\n\t\t\t--output \"$tmp\" \"$ROOTS\" &&\n\t\t\tgrep -q 'BEGIN CERTIFICATE' \"$tmp\"; then\n\t\t\tinstall -m 0644 \"$tmp\" \"$ANCHOR\"\n\t\t\tupdate-ca-trust\n\t\t\texit 0\n\t\tfi\n\t\tn=$((n + 1))\n\t\tsleep 2\n\tdone\n\techo \"the authority at $ROOTS did not serve a certificate within two minutes\" >&2\n\texit 1\n\t;;\nremove)\n\t# What stopping the unit does, and therefore what being unassigned does.\n\trm -f \"$ANCHOR\"\n\tupdate-ca-trust\n\t;;\n*)\n\techo \"usage: $(basename \"$0\") install|remove\" >&2\n\texit 2\n\t;;\nesac\n"
|
||||
},
|
||||
{
|
||||
"id": "unit",
|
||||
"type": "file",
|
||||
"path": "/etc/systemd/system/mesh-ca-trust.service",
|
||||
"mode": "0644",
|
||||
"content": "[Unit]\nDescription=The mesh's internal certificate authority, trusted by this machine\n# novox/hq ADR 0147. Starting this unit places the mesh's root among this\n# machine's trust anchors; stopping it takes the root away again, which is what\n# the host does when the module is no longer assigned here.\nWants=network-online.target\nAfter=network-online.target\n\n[Service]\nType=oneshot\nRemainAfterExit=yes\nExecStart=${dir:state}/anchor install\nExecStop=${dir:state}/anchor remove\n\n[Install]\nWantedBy=multi-user.target\n"
|
||||
},
|
||||
{
|
||||
"id": "trust",
|
||||
"type": "service",
|
||||
"unit": "mesh-ca-trust.service",
|
||||
"state": "running",
|
||||
"boot": "enabled",
|
||||
"restart-on": [
|
||||
"anchor",
|
||||
"unit"
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
@@ -1,84 +0,0 @@
|
||||
// Dial everything the mesh claims is reachable, and say what was found (novox/hq ADR 0145).
|
||||
//
|
||||
// Runs on a cadence, from this machine, in this module's own container — the same position every other
|
||||
// module on the machine calls from. That is the whole point: a check run by the host or by the control
|
||||
// plane reaches these addresses by a path no ordinary caller uses, and would have passed throughout the
|
||||
// outage that produced this module (novox/hq 04-ISSUES/145).
|
||||
//
|
||||
// It reports and does nothing else. A checker that repaired things would be a second control plane.
|
||||
|
||||
import { readFileSync, writeFileSync, mkdirSync, renameSync } from "node:fs";
|
||||
import { dirname, join } from "node:path";
|
||||
|
||||
import { dial, tally, targetsFor, type Counts, type Result, type Roster } from "../reach.js";
|
||||
|
||||
/** Where the mesh renders this machine's view of the others, and where the counts are kept between runs. */
|
||||
const rosterFile = process.env.MESH_NETWORK_CHECKER_ROSTER ?? "/run/config/roster.json";
|
||||
const stateDir = process.env.MESH_NETWORK_CHECKER_STATE ?? "/run/state";
|
||||
const probePort = Number(process.env.MESH_NETWORK_CHECKER_PORT ?? "9876");
|
||||
const publicPort = process.env.MESH_NETWORK_CHECKER_PUBLIC_PORT
|
||||
? Number(process.env.MESH_NETWORK_CHECKER_PUBLIC_PORT)
|
||||
: undefined;
|
||||
const timeoutMs = Number(process.env.MESH_NETWORK_CHECKER_TIMEOUT_MS ?? "4000");
|
||||
const threshold = Number(process.env.MESH_NETWORK_CHECKER_THRESHOLD ?? "2");
|
||||
|
||||
/** read is a JSON file or a stated failure — never a silent default, which is how a checker comes to
|
||||
* report that everything is fine because it read nothing. */
|
||||
function read<T>(path: string, whenMissing: T | null): T {
|
||||
try {
|
||||
return JSON.parse(readFileSync(path, "utf8")) as T;
|
||||
} catch (err) {
|
||||
if (whenMissing !== null) return whenMissing;
|
||||
console.error(`network-checker: cannot read ${path}: ${(err as Error).message}`);
|
||||
process.exit(1);
|
||||
}
|
||||
}
|
||||
|
||||
function writeAtomically(path: string, body: string): void {
|
||||
mkdirSync(dirname(path), { recursive: true });
|
||||
const temp = `${path}.writing`;
|
||||
writeFileSync(temp, body);
|
||||
renameSync(temp, path);
|
||||
}
|
||||
|
||||
async function main(): Promise<void> {
|
||||
const roster = read<Roster>(rosterFile, null);
|
||||
if (!roster.machines?.length) {
|
||||
console.error("network-checker: the roster names no machines; nothing to check");
|
||||
process.exit(1);
|
||||
}
|
||||
|
||||
const targets = targetsFor(roster, probePort, publicPort);
|
||||
// In parallel, because a machine that is away should not delay the rest: a run that takes
|
||||
// machines × timeout would outlast its own cadence on a mesh of any size.
|
||||
const results: Result[] = await Promise.all(targets.map((t) => dial(t, timeoutMs)));
|
||||
|
||||
const countsFile = join(stateDir, "consecutive.json");
|
||||
const { counts, broken } = tally(results, read<Counts>(countsFile, {}), threshold);
|
||||
writeAtomically(countsFile, JSON.stringify(counts, null, 1));
|
||||
|
||||
// Written whole, every run: a reader asking "what does this machine reach" gets an answer about now
|
||||
// rather than the last time something changed.
|
||||
writeAtomically(join(stateDir, "reach.json"), JSON.stringify({
|
||||
node: roster.node,
|
||||
at: new Date().toISOString(),
|
||||
checked: results.length,
|
||||
broken: broken.length,
|
||||
results,
|
||||
}, null, 1));
|
||||
|
||||
for (const b of broken) {
|
||||
console.error(
|
||||
`network-checker: ${roster.node} cannot reach ${b.machine} (${b.claim}) at ${b.at}:${b.port} — ` +
|
||||
`${b.failed} failed${b.detail ? `: ${b.detail}` : ""}, ${b.consecutive} run(s) running`);
|
||||
}
|
||||
if (broken.length === 0) {
|
||||
console.log(`network-checker: ${roster.node} reaches all ${results.length} checked path(s)`);
|
||||
}
|
||||
|
||||
// A broken path is not this process failing. It did its job; exiting non-zero would make the mesh
|
||||
// read the checker as the fault, and a scheduled step that fails is retried rather than believed.
|
||||
process.exit(0);
|
||||
}
|
||||
|
||||
void main();
|
||||
@@ -1,61 +0,0 @@
|
||||
{
|
||||
"module": "network-checker",
|
||||
"version": "1",
|
||||
"slug": "netcheck",
|
||||
"listens": [
|
||||
{
|
||||
"name": "probe",
|
||||
"port": 9876,
|
||||
"protocol": "tcp",
|
||||
"from": "mesh",
|
||||
"why": "what the other machines' checkers dial. Deliberately this module's own endpoint and nothing else's: it is admitted by exactly the rule that governs every internally-exposed service, so it fails when that rule is wrong. A probe on a port that is never closed — ssh, say — would have passed throughout the outage this module exists to catch (novox/hq ADR 0145)"
|
||||
}
|
||||
],
|
||||
"facts": {
|
||||
"roster": {
|
||||
"path": "/var/lib/network-checker/roster.json",
|
||||
"template": "{\n \"generated\": \"by the mesh — do not edit; replaced whenever a machine joins or leaves\",\n \"node\": \"{{.Node}}\",\n \"machines\": [{{range $i, $m := .Machines}}{{if $i}},{{end}}\n { \"name\": \"{{$m.Name}}\", \"fqdn\": \"{{$m.FQDN}}\", \"address\": \"{{$m.Address}}\" }{{end}}\n ]\n}\n"
|
||||
}
|
||||
},
|
||||
"build": {
|
||||
"artifacts": [
|
||||
{
|
||||
"name": "code",
|
||||
"kind": "bundle",
|
||||
"language": "typescript",
|
||||
"entrypoints": ["probe/index.js", "check/index.js"]
|
||||
}
|
||||
]
|
||||
},
|
||||
"resources": [
|
||||
{
|
||||
"id": "state",
|
||||
"type": "directory",
|
||||
"path": "/var/lib/network-checker",
|
||||
"mode": "0700"
|
||||
},
|
||||
{
|
||||
"id": "probe",
|
||||
"type": "container",
|
||||
"name": "mesh-network-checker-probe",
|
||||
"args": ["run", "/app/modules/network-checker/dist/probe/index.js"],
|
||||
"ports": ["9876"],
|
||||
"state": "running",
|
||||
"env": { "MESH_NETWORK_CHECKER_PORT": "9876" }
|
||||
},
|
||||
{
|
||||
"id": "check",
|
||||
"type": "container",
|
||||
"name": "mesh-network-checker-check",
|
||||
"network": "host",
|
||||
"schedule": "*/5 * * * *",
|
||||
"args": ["run", "/app/modules/network-checker/dist/check/index.js"],
|
||||
"volumes": ["/var/lib/network-checker:/run/state"],
|
||||
"env": {
|
||||
"MESH_NETWORK_CHECKER_ROSTER": "/run/state/roster.json",
|
||||
"MESH_NETWORK_CHECKER_STATE": "/run/state",
|
||||
"MESH_NETWORK_CHECKER_PORT": "${port:9876}"
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
@@ -1,8 +0,0 @@
|
||||
{
|
||||
"name": "@novox/module-network-checker",
|
||||
"version": "0.1.0",
|
||||
"description": "network-checker — dials what the mesh claims is reachable, from where the callers are, and says what it found.",
|
||||
"type": "module",
|
||||
"private": true,
|
||||
"devDependencies": { "@types/node": "^22.0.0", "typescript": "^5.6.0" }
|
||||
}
|
||||
@@ -1,31 +0,0 @@
|
||||
// The endpoint the other machines' checkers dial (novox/hq ADR 0145).
|
||||
//
|
||||
// **This module's own endpoint is the instrument.** It is declared reachable over the private network
|
||||
// like any other service, so it is admitted by exactly the rule that governs every internally-exposed
|
||||
// service and it fails when that rule is wrong. A probe on a port that is never closed — ssh, say —
|
||||
// would have passed throughout the outage this module exists to catch.
|
||||
//
|
||||
// It accepts a connection and closes it. Answering anything would make this a protocol, and then the
|
||||
// question would be whether the protocol worked rather than whether the path did.
|
||||
|
||||
import { createServer } from "node:net";
|
||||
|
||||
const port = Number(process.env.MESH_NETWORK_CHECKER_PORT ?? "9876");
|
||||
|
||||
const server = createServer((socket) => {
|
||||
// Written before closing so a person dialling it by hand sees something, and so a half-open
|
||||
// connection is not mistaken for a working path by a client that only checks the handshake.
|
||||
socket.end("mesh network-checker\n");
|
||||
});
|
||||
|
||||
server.on("error", (err: Error) => {
|
||||
// Said and fatal: a probe that cannot listen must not look like a probe that nothing dialled.
|
||||
console.error(`network-checker: cannot serve the probe on ${port}: ${err.message}`);
|
||||
process.exit(1);
|
||||
});
|
||||
|
||||
server.listen(port, () => console.log(`network-checker: probe listening on ${port}`));
|
||||
|
||||
for (const signal of ["SIGTERM", "SIGINT"] as const) {
|
||||
process.on(signal, () => server.close(() => process.exit(0)));
|
||||
}
|
||||
@@ -1,155 +0,0 @@
|
||||
// What the mesh claims is reachable, and how to find out (novox/hq ADR 0145).
|
||||
//
|
||||
// The mesh asserts three things are callable (ADR 0144): what runs on the same machine, another
|
||||
// machine's service exposed to the private network, and another machine's service exposed publicly.
|
||||
// This decides what to dial for each and reads the answers. It opens connections and nothing more —
|
||||
// the module that owns a service is the one that knows whether it is working.
|
||||
//
|
||||
// **The target is this module's own endpoint, and that is deliberate.** The obvious thing to dial is a
|
||||
// service every machine has, and the services every machine has are the ones never closed — ssh above
|
||||
// all. Dialling one of those would have passed throughout the outage this exists to catch, because what
|
||||
// broke was a service exposed to the private network and ssh is admitted unconditionally. A probe on a
|
||||
// port that cannot fail measures nothing.
|
||||
|
||||
import { connect } from "node:net";
|
||||
import { lookup } from "node:dns";
|
||||
|
||||
/** One machine as the mesh's roster describes it. */
|
||||
export interface Machine {
|
||||
name: string;
|
||||
fqdn: string;
|
||||
address: string;
|
||||
/** The name this machine is reached by from outside, where it has one. Absent for most machines, and
|
||||
* a machine with no public face has no public claim to check. */
|
||||
public?: string;
|
||||
}
|
||||
|
||||
/** The roster the mesh renders for this module: who this machine is, and who the others are. */
|
||||
export interface Roster {
|
||||
node: string;
|
||||
machines: Machine[];
|
||||
}
|
||||
|
||||
/** Which of the mesh's three claims a check is about, so a failure says which one broke. */
|
||||
export type Claim = "this machine" | "the private network" | "the public network";
|
||||
|
||||
/** One thing to dial. */
|
||||
export interface Target {
|
||||
claim: Claim;
|
||||
machine: string;
|
||||
/** What to dial — a name where the point is that names resolve, an address where it is not. */
|
||||
at: string;
|
||||
port: number;
|
||||
/** Whether `at` is a name that must resolve first, so a resolution failure is reported as one. */
|
||||
byName: boolean;
|
||||
}
|
||||
|
||||
/** What one dial found. */
|
||||
export interface Result extends Target {
|
||||
ok: boolean;
|
||||
/** Which step failed, so a reader is sent to the right place: the resolver, or the filter. */
|
||||
failed?: "resolution" | "connection";
|
||||
detail?: string;
|
||||
ms: number;
|
||||
}
|
||||
|
||||
/**
|
||||
* targetsFor is everything this machine should be able to reach, from the roster it was given.
|
||||
*
|
||||
* Its own machine first, because that is the case that distinguishes a caller on the machine from a
|
||||
* caller in one of its containers — the one that broke. Then every other machine over the private
|
||||
* network. The public claim is only checked where a public address is known for a machine, because a
|
||||
* machine with no public face has nothing to fail.
|
||||
*/
|
||||
export function targetsFor(roster: Roster, probePort: number, publicPort?: number): Target[] {
|
||||
const out: Target[] = [];
|
||||
for (const m of roster.machines) {
|
||||
const own = m.name === roster.node;
|
||||
out.push({
|
||||
claim: own ? "this machine" : "the private network",
|
||||
machine: m.name,
|
||||
at: m.address,
|
||||
port: probePort,
|
||||
byName: false,
|
||||
});
|
||||
// And by name, because a name that does not resolve and a port that does not answer are different
|
||||
// faults with different owners.
|
||||
out.push({
|
||||
claim: own ? "this machine" : "the private network",
|
||||
machine: m.name,
|
||||
at: m.fqdn,
|
||||
port: probePort,
|
||||
byName: true,
|
||||
});
|
||||
}
|
||||
if (publicPort !== undefined) {
|
||||
for (const m of roster.machines) {
|
||||
if (!m.public) continue;
|
||||
out.push({
|
||||
claim: "the public network",
|
||||
machine: m.name,
|
||||
at: m.public,
|
||||
port: publicPort,
|
||||
byName: true,
|
||||
});
|
||||
}
|
||||
}
|
||||
return out;
|
||||
}
|
||||
|
||||
/** dial opens a connection and closes it. Whether the port accepts is the whole of what is asked. */
|
||||
export function dial(target: Target, timeoutMs: number): Promise<Result> {
|
||||
const began = Date.now();
|
||||
const done = (ok: boolean, failed?: Result["failed"], detail?: string): Result => ({
|
||||
...target, ok, failed, detail, ms: Date.now() - began,
|
||||
});
|
||||
|
||||
return new Promise<Result>((resolve) => {
|
||||
const open = () => {
|
||||
const socket = connect({ host: target.at, port: target.port });
|
||||
const finish = (r: Result) => { socket.destroy(); resolve(r); };
|
||||
socket.setTimeout(timeoutMs);
|
||||
socket.once("connect", () => finish(done(true)));
|
||||
socket.once("timeout", () => finish(done(false, "connection", "timed out")));
|
||||
socket.once("error", (err: Error) => finish(done(false, "connection", err.message)));
|
||||
};
|
||||
|
||||
if (!target.byName) { open(); return; }
|
||||
// Resolved first and reported separately: a checker that says "unreachable" for a name the
|
||||
// resolver never answered sends a reader to the filter, which is not where the fault is.
|
||||
lookup(target.at, (err) => {
|
||||
if (err) { resolve(done(false, "resolution", err.message)); return; }
|
||||
open();
|
||||
});
|
||||
});
|
||||
}
|
||||
|
||||
/** A path's running count of consecutive failures, keyed so it survives between runs. */
|
||||
export type Counts = Record<string, number>;
|
||||
|
||||
/** keyOf names one path, stably, so a count follows it across runs. */
|
||||
export function keyOf(t: Target): string {
|
||||
return `${t.claim}|${t.machine}|${t.at}|${t.port}`;
|
||||
}
|
||||
|
||||
/**
|
||||
* tally folds this run's results into the counts carried from the last one.
|
||||
*
|
||||
* **One failure is not a fault.** A machine rebooting is ordinary, and a checker that cries at the
|
||||
* first missed dial trains a reader to ignore it — which is worse than not checking (ADR 0145). A path
|
||||
* is broken once it has failed on consecutive runs, and the count travels with the result so a reader
|
||||
* can tell "briefly away" from "never worked".
|
||||
*/
|
||||
export function tally(results: Result[], before: Counts, threshold: number): {
|
||||
counts: Counts; broken: Array<Result & { consecutive: number }>;
|
||||
} {
|
||||
const counts: Counts = {};
|
||||
const broken: Array<Result & { consecutive: number }> = [];
|
||||
for (const r of results) {
|
||||
const key = keyOf(r);
|
||||
const n = r.ok ? 0 : (before[key] ?? 0) + 1;
|
||||
if (n > 0) counts[key] = n;
|
||||
if (n >= threshold) broken.push({ ...r, consecutive: n });
|
||||
}
|
||||
return { counts, broken };
|
||||
}
|
||||
@@ -1,72 +0,0 @@
|
||||
import { strict as assert } from "node:assert";
|
||||
import test from "node:test";
|
||||
|
||||
import { keyOf, tally, targetsFor, type Result, type Roster } from "../reach.js";
|
||||
|
||||
const roster: Roster = {
|
||||
node: "here",
|
||||
machines: [
|
||||
{ name: "here", fqdn: "here.internal", address: "10.0.0.1" },
|
||||
{ name: "there", fqdn: "there.internal", address: "10.0.0.2", public: "there.example.test" },
|
||||
],
|
||||
};
|
||||
|
||||
test("its own machine is checked, which is the case that distinguishes a caller on it from one in a container", () => {
|
||||
const own = targetsFor(roster, 9876).filter((t) => t.claim === "this machine");
|
||||
assert.equal(own.length, 2, "its own machine by address and by name");
|
||||
assert.ok(own.some((t) => t.at === "10.0.0.1" && !t.byName));
|
||||
assert.ok(own.some((t) => t.at === "here.internal" && t.byName));
|
||||
});
|
||||
|
||||
test("every other machine is checked over the private network", () => {
|
||||
const other = targetsFor(roster, 9876).filter((t) => t.claim === "the private network");
|
||||
assert.deepEqual(other.map((t) => t.machine), ["there", "there"]);
|
||||
});
|
||||
|
||||
test("the public claim is only checked where a machine has a public name", () => {
|
||||
const pub = targetsFor(roster, 9876, 443).filter((t) => t.claim === "the public network");
|
||||
assert.equal(pub.length, 1, "only the machine with a public name");
|
||||
assert.equal(pub[0]!.at, "there.example.test");
|
||||
assert.equal(pub[0]!.port, 443);
|
||||
});
|
||||
|
||||
test("no public claim is made when no public port was given", () => {
|
||||
assert.equal(targetsFor(roster, 9876).filter((t) => t.claim === "the public network").length, 0);
|
||||
});
|
||||
|
||||
const failed = (at: string): Result => ({
|
||||
claim: "this machine", machine: "here", at, port: 9876, byName: false,
|
||||
ok: false, failed: "connection", ms: 1,
|
||||
});
|
||||
const passed = (at: string): Result => ({
|
||||
claim: "this machine", machine: "here", at, port: 9876, byName: false, ok: true, ms: 1,
|
||||
});
|
||||
|
||||
test("one failure is not a fault — a machine rebooting is ordinary", () => {
|
||||
const { counts, broken } = tally([failed("10.0.0.1")], {}, 2);
|
||||
assert.equal(broken.length, 0, "one missed dial says nothing");
|
||||
assert.equal(counts[keyOf(failed("10.0.0.1"))], 1, "and is remembered");
|
||||
});
|
||||
|
||||
test("a path that keeps failing is broken, and the count travels with it", () => {
|
||||
const first = tally([failed("10.0.0.1")], {}, 2);
|
||||
const second = tally([failed("10.0.0.1")], first.counts, 2);
|
||||
assert.equal(second.broken.length, 1);
|
||||
assert.equal(second.broken[0]!.consecutive, 2, "so a reader can tell briefly away from never worked");
|
||||
});
|
||||
|
||||
test("a path that recovers stops being counted", () => {
|
||||
const first = tally([failed("10.0.0.1")], {}, 2);
|
||||
const second = tally([passed("10.0.0.1")], first.counts, 2);
|
||||
assert.equal(second.broken.length, 0);
|
||||
assert.deepEqual(second.counts, {}, "nothing carried forward for a path that works");
|
||||
});
|
||||
|
||||
test("a count follows one path and not another", () => {
|
||||
const a = failed("10.0.0.1");
|
||||
const b = failed("10.0.0.2");
|
||||
const first = tally([a, b], {}, 2);
|
||||
const second = tally([a], first.counts, 2);
|
||||
assert.equal(second.broken.length, 1, "only the path dialled this run is judged");
|
||||
assert.equal(second.broken[0]!.at, "10.0.0.1");
|
||||
});
|
||||
@@ -1,12 +0,0 @@
|
||||
{
|
||||
"compilerOptions": {
|
||||
"target": "ES2022",
|
||||
"module": "NodeNext",
|
||||
"moduleResolution": "NodeNext",
|
||||
"strict": true,
|
||||
"esModuleInterop": true,
|
||||
"skipLibCheck": true,
|
||||
"noEmit": true
|
||||
},
|
||||
"include": ["reach.ts", "probe/index.ts", "check/index.ts", "test/*.ts"]
|
||||
}
|
||||
+21
-20
@@ -5,7 +5,7 @@
|
||||
"container-runtime"
|
||||
],
|
||||
"own-secrets": {
|
||||
"secret": "/var/lib/searxng-module/secret.secret",
|
||||
"secret": "/var/lib/mesh/searxng/secret",
|
||||
"broker": "/var/lib/mesh/searxng/broker"
|
||||
},
|
||||
"listens": [
|
||||
@@ -27,22 +27,14 @@
|
||||
{
|
||||
"id": "state",
|
||||
"type": "directory",
|
||||
"path": "/var/lib/searxng-module",
|
||||
"mode": "0700"
|
||||
"mode": "0700",
|
||||
"place": "."
|
||||
},
|
||||
{
|
||||
"id": "valkey-data",
|
||||
"type": "directory",
|
||||
"path": "/var/lib/searxng-module/valkey-data",
|
||||
"mode": "0700"
|
||||
},
|
||||
{
|
||||
"id": "server-env",
|
||||
"type": "file",
|
||||
"path": "/var/lib/searxng-module/server.env",
|
||||
"mode": "0600",
|
||||
"content": "SEARXNG_SECRET=${secret:secret}\nSEARXNG_VALKEY_URL=valkey://valkey:6379/0\n"
|
||||
},
|
||||
{
|
||||
"id": "net",
|
||||
"type": "network",
|
||||
@@ -63,30 +55,39 @@
|
||||
"warning"
|
||||
],
|
||||
"volumes": [
|
||||
"/var/lib/searxng-module/valkey-data:/data"
|
||||
"${dir:valkey-data}:/data"
|
||||
]
|
||||
},
|
||||
{
|
||||
"id": "settings",
|
||||
"type": "file",
|
||||
"path": "${dir:state}/settings.yml",
|
||||
"mode": "0600",
|
||||
"merge": "json",
|
||||
"content": "{\n \"use_default_settings\": true,\n \"server\": {\n \"secret_key\": \"${secret:secret}\",\n \"base_url\": false,\n \"limiter\": false,\n \"image_proxy\": false,\n \"public_instance\": false\n },\n \"search\": {\n \"formats\": [\"html\", \"json\"]\n },\n \"valkey\": {\n \"url\": \"valkey://valkey:6379/0\"\n }\n}\n"
|
||||
},
|
||||
{
|
||||
"id": "server",
|
||||
"type": "container",
|
||||
"name": "searxng",
|
||||
"image": "searxng/searxng@sha256:c7cc75852051bf6254afda6ed1b920dd1677d8efe4ab141bf558f02e582f4371",
|
||||
"image": "searxng/searxng@sha256:cd8812607ab73730a0b1a0dc4990223fe1b9e383f6f35947114d0bef7f8bb441",
|
||||
"network": "searxng",
|
||||
"env-file": [
|
||||
"/var/lib/searxng-module/server.env"
|
||||
],
|
||||
"ports": [
|
||||
"8080"
|
||||
],
|
||||
"secrets-in-environment": "SEARXNG_SECRET is env-only, but settings.yml carries server.secret_key; convertible by mounting a generated settings.yml, not yet done"
|
||||
"volumes": [
|
||||
"${dir:state}/settings.yml:/etc/searxng/settings.yml:ro"
|
||||
],
|
||||
"restart-on": [
|
||||
"settings"
|
||||
]
|
||||
},
|
||||
{
|
||||
"id": "runtime-config",
|
||||
"type": "file",
|
||||
"path": "/var/lib/mesh/searxng/config.json",
|
||||
"mode": "0600",
|
||||
"content": "{}\n",
|
||||
"merge": "json"
|
||||
"content": "{}\n"
|
||||
},
|
||||
{
|
||||
"id": "runtime",
|
||||
@@ -118,7 +119,7 @@
|
||||
}
|
||||
},
|
||||
"binds": {
|
||||
"route": "/var/lib/searxng-module/route.json"
|
||||
"route": "${dir:state}/route.json"
|
||||
},
|
||||
"build": {
|
||||
"on": [
|
||||
|
||||
@@ -41,6 +41,32 @@ function meshConfig(file?: string): Record<string, string> {
|
||||
catch { return {}; }
|
||||
}
|
||||
|
||||
/**
|
||||
* The API key Tautulli minted for itself, read from its own config.ini (mounted read-only).
|
||||
*
|
||||
* Tautulli owns this key: it writes it on first run and every client of its API — this runtime
|
||||
* included — must present the same one. So the mesh does not mint or hold it; the one place it
|
||||
* lives is the file Tautulli keeps, and a key regenerated in Tautulli's settings is simply read
|
||||
* again on the next start. Undefined when there is no file or no key yet (a fresh install whose
|
||||
* setup wizard has not run).
|
||||
*/
|
||||
function keyOfTautulli(dir?: string): string | undefined {
|
||||
if (!dir) return undefined;
|
||||
let ini: string;
|
||||
try { ini = readFileSync(`${dir.replace(/\/$/, "")}/config.ini`, "utf8"); }
|
||||
catch { return undefined; }
|
||||
let section = "";
|
||||
for (const raw of ini.split(/\r?\n/)) {
|
||||
const line = raw.trim();
|
||||
const header = /^\[(.+)\]$/.exec(line);
|
||||
if (header) { section = header[1]; continue; }
|
||||
if (section !== "General") continue;
|
||||
const kv = /^api_key\s*=\s*"?([^"]*)"?$/.exec(line);
|
||||
if (kv && kv[1]) return kv[1];
|
||||
}
|
||||
return undefined;
|
||||
}
|
||||
|
||||
export class TautulliClient {
|
||||
readonly baseUrl: string;
|
||||
|
||||
@@ -52,15 +78,16 @@ export class TautulliClient {
|
||||
}
|
||||
|
||||
/**
|
||||
* Build from the module's resolved environment. The API key is read from MESH_TAUTULLI_APIKEY
|
||||
* (Tautulli mints it in Settings → Web Interface); the base URL defaults to the local container.
|
||||
* Build from the module's resolved environment. The API key is the one Tautulli minted for
|
||||
* itself (Settings → Web Interface), read from its config.ini under MESH_TAUTULLI_CONFIG_DIR;
|
||||
* MESH_TAUTULLI_APIKEY still wins where it is set. The base URL defaults to the local container.
|
||||
* Throws when no key is configured — the module then contributes nothing rather than failing.
|
||||
*/
|
||||
static fromEnv(env: NodeJS.ProcessEnv = process.env): TautulliClient {
|
||||
const cfg = meshConfig(env.MESH_TAUTULLI_CONFIG_FILE);
|
||||
const url = cfg.url ?? (env.MESH_TAUTULLI_URL ?? `http://127.0.0.1:${env.TAUTULLI_PORT ?? "8181"}`);
|
||||
const apiKey = cfg.apiKey ?? env.MESH_TAUTULLI_APIKEY;
|
||||
if (!apiKey) throw new Error("no Tautulli API key — set MESH_TAUTULLI_APIKEY");
|
||||
const apiKey = cfg.apiKey ?? env.MESH_TAUTULLI_APIKEY ?? keyOfTautulli(env.MESH_TAUTULLI_CONFIG_DIR);
|
||||
if (!apiKey) throw new Error("no Tautulli API key — Tautulli's config.ini has none yet (finish its setup and enable the API)");
|
||||
return new TautulliClient(url, apiKey);
|
||||
}
|
||||
|
||||
|
||||
@@ -16,7 +16,7 @@
|
||||
"port": 8181,
|
||||
"protocol": "tcp",
|
||||
"from": "mesh",
|
||||
"why": "watch statistics"
|
||||
"why": "the watch statistics pages and API"
|
||||
}
|
||||
],
|
||||
"resources": [
|
||||
@@ -26,10 +26,15 @@
|
||||
"path": "/var/lib/mesh/tautulli",
|
||||
"mode": "0700"
|
||||
},
|
||||
{
|
||||
"id": "state",
|
||||
"type": "directory",
|
||||
"mode": "0700",
|
||||
"place": "."
|
||||
},
|
||||
{
|
||||
"id": "config",
|
||||
"type": "directory",
|
||||
"path": "/services/tautulli/config",
|
||||
"mode": "0700",
|
||||
"owner": "1000:1000"
|
||||
},
|
||||
@@ -37,7 +42,7 @@
|
||||
"id": "server",
|
||||
"type": "container",
|
||||
"name": "tautulli",
|
||||
"image": "lscr.io/linuxserver/tautulli@sha256:13f03ecfc61a7af89d492677389771ac29682a72153ce08a5cd4faffbc0197e8",
|
||||
"image": "lscr.io/linuxserver/tautulli@sha256:e35570d636471f8aabfac7044057712679f954844a763ba735baa9659ea142b5",
|
||||
"env": {
|
||||
"PUID": "1000",
|
||||
"PGID": "1000",
|
||||
@@ -47,7 +52,7 @@
|
||||
"8181"
|
||||
],
|
||||
"volumes": [
|
||||
"/services/tautulli/config:/config"
|
||||
"${dir:config}:/config"
|
||||
]
|
||||
},
|
||||
{
|
||||
@@ -66,11 +71,11 @@
|
||||
"volumes": [
|
||||
"/var/lib/mesh/tautulli/broker:/run/secrets/broker:ro",
|
||||
"/var/lib/mesh/tautulli/config.json:/run/config/config.json:ro",
|
||||
"/services/tautulli/config:/var/lib/tautulli/config:ro"
|
||||
"${dir:config}:/var/lib/tautulli/config:ro"
|
||||
],
|
||||
"env": {
|
||||
"MESH_BROKER_FILE": "/run/secrets/broker",
|
||||
"MESH_TAUTULLI_URL": "http://127.0.0.1:8181",
|
||||
"MESH_TAUTULLI_URL": "http://127.0.0.1:${port:8181}",
|
||||
"MESH_TAUTULLI_CONFIG_FILE": "/run/config/config.json",
|
||||
"MESH_TAUTULLI_CONFIG_DIR": "/var/lib/tautulli/config"
|
||||
},
|
||||
@@ -90,7 +95,7 @@
|
||||
}
|
||||
},
|
||||
"binds": {
|
||||
"route": "/var/lib/mesh/tautulli/route.json"
|
||||
"route": "${dir:state}/route.json"
|
||||
},
|
||||
"build": {
|
||||
"on": [
|
||||
|
||||
Reference in New Issue
Block a user