jschoubben
a270cd5b02
A gateway is the one implicit machine in a declaration — a scenario says a segment sits behind one and never names the thing that serves it. This materialises it. A router is a container, not a virtual machine, because it is scenery rather than something under test (hq ADR 0033). Verified before building that a plain unprivileged container can do all of it: ip_forward and ipv6 forwarding settable, nftables masquerade accepted, and the conntrack timeouts mapping_ttl depends on both writable. No privileged mode. Verified by running, on a machine behind a household gateway reached from one on a routable address: home-server -> anchor 0% loss, through masquerade anchor -> 192.168.1.135 (private, direct) unreachable anchor -> 192.0.2.50:8080 (the GATEWAY) HTTP 200 The last line is the published-but-behind-NAT case research 004 says only exists in production. It is now a 32-second scenario on a workstation. Segments sharing a gateway declaration share ONE router — that is what a VLAN-capable router is, and two routers sharing an external address would not work anyway. mapping_ttl is read back after setting rather than assumed. Those sysctls are not on every kernel, and a scenario that declared an expiring mapping and silently got a permanent one would be exactly the fault being built against. Four bugs found by running it, three of them the same fault — a failure made invisible. The router had no route to a package repository, by design, so installing nftables at raise time could not work. The image is now built once with temporary connectivity and cached; every scenario after that needs no network. That failure was hidden behind `|| true`, which is why it took a raise to find. The builder then failed on DNS: exec works before a container has an address, and I had treated usable as ready. It now waits for the thing actually needed. The stock Alpine image ships `auto eth0 / inet dhcp` and its boot-time networking service flushed the static address the scenario set — on eth0 only, so the outside interface came up bare while inside ones were fine. The image build now neutralises it: a router reconfiguring itself from an image default is the lab overriding the declaration. `ip addr add … || true` had hidden this too, and is now `ip addr replace` with no swallow. And routers were orphaned by destroy, holding their networks open so destroy reported removing zero segments. They now carry the same machine tag as everything else, so one query finds an instance's resources.
54 lines
2.1 KiB
TypeScript
54 lines
2.1 KiB
TypeScript
/**
|
|
* What this lab can actually materialise, and a refusal for everything else.
|
|
*
|
|
* A declaration the runtime silently ignores is the worst thing this project could ship.
|
|
* The mesh already has that fault catalogued: a firewall key declared in five manifests
|
|
* and read by no code, so a manifest appears to restrict a port and restricts nothing
|
|
* (novox/hq 04-ISSUES/003). A scenario that declares a gateway and raises without one
|
|
* would be the same fault, in the tool built to catch it.
|
|
*
|
|
* So unimplemented parts of the model are refused loudly at raise time rather than
|
|
* ignored. The declaration schema deliberately runs ahead of the runtime — it is the
|
|
* design's shape, and validating against it is useful before any of it can be raised —
|
|
* but the gap between the two has to be visible.
|
|
*/
|
|
|
|
import type { Scenario } from "../declaration/types.ts";
|
|
|
|
export class UnsupportedError extends Error {
|
|
readonly missing: string[];
|
|
|
|
constructor(missing: string[]) {
|
|
super(
|
|
`this scenario declares things the lab cannot yet materialise:\n - ${missing.join("\n - ")}\n\n` +
|
|
`Raising it would produce a mesh that silently lacks them, which is the exact fault ` +
|
|
`this lab exists to catch. Validation accepts them because the declaration model is ` +
|
|
`complete; the runtime is not.`,
|
|
);
|
|
this.name = "UnsupportedError";
|
|
this.missing = missing;
|
|
}
|
|
}
|
|
|
|
export function assertSupported(scenario: Scenario): void {
|
|
const missing: string[] = [];
|
|
|
|
const inbound = Object.entries(scenario.machines)
|
|
.filter(([, machine]) => machine.inbound === "deny")
|
|
.map(([name]) => name);
|
|
if (inbound.length > 0) {
|
|
missing.push(
|
|
`inbound: deny (machines: ${inbound.join(", ")}) — no host firewall is configured, so ` +
|
|
`these machines would accept traffic the scenario says they refuse`,
|
|
);
|
|
}
|
|
|
|
if (scenario.place && Object.keys(scenario.place).length > 0) {
|
|
missing.push(
|
|
"place — nothing is placed inside the machines yet; they are raised bare",
|
|
);
|
|
}
|
|
|
|
if (missing.length > 0) throw new UnsupportedError(missing);
|
|
}
|