Hold the proofs that a manifest composes, which left the judge's and route-proxy's tests

ADR 0593 §7: the composition is the node-engine's, so its tests hold what the indexer's judge tests and route-proxy's tests proved by composing: a bundle's words per machine, a Go bundle's delivery, the credential form in a handed plan, settings refusals, placeholder and vault refusals, the session's files, a field set aside composed whole, route-proxy's manifest composing for a machine, a route endpoint's machine port in six cases and the plan's route entry end to end. Two table tests, one subtest per item; route-proxy's manifest is captured beside the catalogue. Claude-Session: https://claude.ai/code/session_01NcbgfJ9Gum47zkFKWRaovL
2026-11-02 19:19:49 +01:00
parent d68e241724
commit 1ada760a64
5 changed files with 750 additions and 0 deletions
@@ -25,3 +25,6 @@ To move them, from this repository's go/ directory, with the two repositories ch

 and write the commits here. The placement guard is kept as .captured so no Go tool reads it as this
 repository's code.
+
+mesh-networking  a74f9db508687f6fbf3c8074a2a8e195824a500a  modules/route-proxy/module.json, modules/route-proxy/files/*.env
+(route-proxy's manifest, for the node-engine's proof that it composes; sdk1-host, 2026-11-02)
@@ -0,0 +1,3 @@
+ACME_DIRECTORY=https://acme-v02.api.letsencrypt.org:443/directory
+ACME_ROOTS=https://acme-v02.api.letsencrypt.org:443
+ACME_ROOTS_PATH=
@@ -0,0 +1,3 @@
+INTERNAL_ACME_DIRECTORY=https://${bound:internal-acme-ca:at}:${bound:internal-acme-ca:port}${bound:internal-acme-ca:path}
+INTERNAL_ACME_ROOTS=https://${bound:internal-acme-ca:at}:${bound:internal-acme-ca:port}${bound:internal-acme-ca:roots}
+INTERNAL_ACME_ROOTS_PATH=${bound:internal-acme-ca:roots}
@@ -0,0 +1,272 @@
+{
+  "module": "route-proxy",
+  "version": "1",
+  "slug": "rproxy",
+  "capabilities": [
+    "container-runtime"
+  ],
+  "provides": [
+    {
+      "name": "route",
+      "scope": "mesh",
+      "credential": {
+        "form": "none"
+      },
+      "identity": false,
+      "answered-by": "helper"
+    }
+  ],
+  "serves": {
+    "route": {}
+  },
+  "requires": [
+    "internal-acme-ca"
+  ],
+  "binds": {
+    "internal-acme-ca": "${dir:state}/internal-acme-ca.json"
+  },
+  "own-secrets": {
+    "broker": "${dir:mesh-state}/broker"
+  },
+  "listens": [
+    {
+      "name": "http",
+      "port": 80,
+      "protocol": "tcp",
+      "from": "anywhere",
+      "why": "public HTTP, and the ACME HTTP-01 challenge answered at the name being certified"
+    },
+    {
+      "name": "https",
+      "port": 443,
+      "protocol": "tcp",
+      "from": "anywhere",
+      "why": "public HTTPS for every name the mesh routes here"
+    }
+  ],
+  "data": {
+    "own": [
+      {
+        "id": "acme",
+        "path": "${dir:acme-cache}",
+        "class": "rebuildable",
+        "why": "issued certificates, issued again"
+      },
+      {
+        "id": "ca",
+        "path": "${dir:ca-dir}",
+        "class": "cache",
+        "why": "the authority's roots, fetched again at every start"
+      }
+    ]
+  },
+  "resources": [
+    {
+      "id": "state",
+      "type": "directory",
+      "mode": "0700",
+      "place": "."
+    },
+    {
+      "id": "mesh-state",
+      "type": "directory",
+      "mode": "0700",
+      "place": "mesh"
+    },
+    {
+      "id": "acme-cache",
+      "type": "directory",
+      "path": "/var/lib/route-proxy/acme",
+      "mode": "0700"
+    },
+    {
+      "id": "ca-dir",
+      "type": "directory",
+      "path": "/var/lib/route-proxy/ca",
+      "mode": "0755"
+    },
+    {
+      "id": "acme-env",
+      "type": "file",
+      "path": "${dir:state}/acme.env",
+      "mode": "0600",
+      "template": "files/acme.env"
+    },
+    {
+      "id": "internal-acme-env",
+      "type": "file",
+      "path": "${dir:state}/internal-acme.env",
+      "mode": "0600",
+      "template": "files/internal-acme.env"
+    },
+    {
+      "id": "trust",
+      "type": "container",
+      "name": "route-proxy-trust",
+      "artifact": "trust",
+      "run-once": true,
+      "network": "host",
+      "env-file": [
+        "${dir:state}/acme.env"
+      ],
+      "volumes": [
+        "${dir:ca-dir}:/ca"
+      ],
+      "args": [
+        "sh",
+        "-c",
+        "if [ -z \"$ACME_ROOTS_PATH\" ]; then cp /etc/ssl/certs/ca-certificates.crt /ca/root.crt; exit 0; fi; for i in $(seq 1 60); do wget -q -T 10 --no-check-certificate -O /ca/root.crt \"$ACME_ROOTS\" && grep -q 'BEGIN CERTIFICATE' /ca/root.crt && exit 0; sleep 2; done; echo \"the authority at $ACME_ROOTS did not serve its roots within two minutes\" >&2; exit 1"
+      ],
+      "restart-on": [
+        "acme-env"
+      ]
+    },
+    {
+      "id": "internal-trust",
+      "type": "container",
+      "name": "route-proxy-internal-trust",
+      "artifact": "trust",
+      "run-once": true,
+      "network": "host",
+      "env-file": [
+        "${dir:state}/internal-acme.env"
+      ],
+      "volumes": [
+        "${dir:ca-dir}:/ca"
+      ],
+      "args": [
+        "sh",
+        "-c",
+        "if [ -z \"$INTERNAL_ACME_ROOTS_PATH\" ]; then cp /etc/ssl/certs/ca-certificates.crt /ca/internal-root.crt; exit 0; fi; for i in $(seq 1 60); do wget -q -T 10 --no-check-certificate -O /ca/internal-root.crt \"$INTERNAL_ACME_ROOTS\" && grep -q 'BEGIN CERTIFICATE' /ca/internal-root.crt && exit 0; sleep 2; done; echo \"the authority at $INTERNAL_ACME_ROOTS did not serve its roots within two minutes\" >&2; exit 1"
+      ],
+      "restart-on": [
+        "internal-acme-env"
+      ]
+    },
+    {
+      "id": "program-route-proxy",
+      "type": "archive",
+      "path": "${dir:state}/route-proxy",
+      "artifact": "server",
+      "unknown": "program"
+    },
+    {
+      "id": "server",
+      "type": "container",
+      "name": "route-proxy",
+      "artifact": "trust",
+      "network": "host",
+      "env-file": [
+        "${dir:state}/acme.env",
+        "${dir:state}/internal-acme.env"
+      ],
+      "volumes": [
+        "${dir:acme-cache}:/acme",
+        "${dir:ca-dir}:/ca:ro",
+        "${dir:mesh-state}/broker:/run/secrets/broker:ro",
+        "${dir:state}/route-proxy:/opt/mesh:ro"
+      ],
+      "env": {
+        "LISTEN": ":80",
+        "TLS_LISTEN": ":443",
+        "ACME_CACHE": "/acme",
+        "ACME_CA_BUNDLE": "/ca/root.crt",
+        "INTERNAL_ACME_CA_BUNDLE": "/ca/internal-root.crt",
+        "MESH_BROKER_FILE": "/run/secrets/broker"
+      },
+      "args": [
+        "/opt/mesh/route-proxy"
+      ],
+      "restart-on": [
+        "trust",
+        "acme-env",
+        "internal-trust",
+        "internal-acme-env",
+        "program-route-proxy"
+      ],
+      "logging": "journald",
+      "health": {
+        "kind": "tcp",
+        "endpoint": "http",
+        "interval": "10s",
+        "timeout": "5s",
+        "looks": 3,
+        "grace": "60s"
+      }
+    }
+  ],
+  "build": {
+    "artifacts": [
+      {
+        "name": "server",
+        "kind": "bundle",
+        "language": "go",
+        "system": "alpine",
+        "from": "cmd/route-proxy",
+        "binary": "route-proxy"
+      },
+      {
+        "name": "trust",
+        "kind": "upstream",
+        "from": "alpine@sha256:28bd5fe8b56d1bd048e5babf5b10710ebe0bae67db86916198a6eec434943f8b"
+      },
+      {
+        "name": "provider",
+        "kind": "bundle",
+        "language": "go",
+        "system": "arch",
+        "from": "cmd/route-provider",
+        "binary": "route-provider",
+        "loads": [
+          "route-provider"
+        ]
+      },
+      {
+        "name": "files",
+        "kind": "archive",
+        "from": "files"
+      }
+    ]
+  },
+  "jails": [
+    {
+      "name": "route-proxy",
+      "failregex": "^.*TLS handshake error from <HOST>:\\d+: (?:no public route for|acme/autocert: missing server name)\n            ^.*refused: no route for .*, asked from <HOST>:\\d+$",
+      "jail": "backend = systemd\njournalmatch = CONTAINER_NAME=route-proxy\nport = http,https\nmaxretry = 10\nfindtime = 1d\nbantime = 1d"
+    }
+  ],
+  "state": [
+    "bound",
+    "routes",
+    {
+      "name": "unrouted",
+      "ttl-seconds": 604800
+    }
+  ],
+  "tools": [
+    "route_proxy_routes",
+    "route_proxy_route",
+    "route_proxy_unrouted"
+  ],
+  "emits": [
+    "route.served",
+    "route.withdrawn",
+    "route.refused"
+  ],
+  "replaces": {
+    "route_proxy_routes": [
+      "curl -I"
+    ],
+    "route_proxy_route": [
+      "openssl s_client -connect"
+    ],
+    "route_proxy_unrouted": [
+      "docker logs route-proxy"
+    ]
+  },
+  "reads": [
+    "mesh-delivery-assigner.placement",
+    "mesh-provisioner.plans",
+    "mesh-provisioner.provisions"
+  ]
+}