send agent traffic through squid once its hive announces it
This commit is contained in:
atlas
parent
86e9f49fe6
commit
b551eb02ff
1 changed files with 885 additions and 27 deletions
|
|
@ -3,7 +3,9 @@
|
|||
# not executes").
|
||||
#
|
||||
# The agent side of the swarm-minted forge token: ../agent-modules/forge-token.nix
|
||||
# fetches it, and ../agent-modules/forge.nix's readers find it.
|
||||
# fetches it, and ../agent-modules/forge.nix's readers find it. The same fixtures
|
||||
# cover ../agent-modules/egress-proxy.nix, the agent's proxy credential and the
|
||||
# environment built from it.
|
||||
{
|
||||
pkgs,
|
||||
lib,
|
||||
|
|
@ -31,6 +33,8 @@ let
|
|||
agentForgeBao = agentWith {
|
||||
services.hyperhive.agent.bao.addr = baoAddr;
|
||||
services.hyperhive.agent.forge.url = forgeUrl;
|
||||
# A second `EnvironmentFile=` on the harness, which the proxy file must join.
|
||||
services.hyperhive.agent.backendEnvironmentFile = "/var/lib/t/backend.env";
|
||||
services.hyperhive.agent.icon = pkgs.emptyFile;
|
||||
};
|
||||
|
||||
|
|
@ -42,8 +46,22 @@ let
|
|||
};
|
||||
|
||||
fetchUnit = machine: machine.systemd.services.hive-agent-forge-token;
|
||||
proxyUnit = machine: machine.systemd.services.hive-agent-proxy-credential;
|
||||
accountsUnit = machine: machine.systemd.services.hive-agent-forge-accounts;
|
||||
tokenFile = machine: machine.services.hyperhive.agent.forge.tokenFile;
|
||||
|
||||
proxyEnvEntry = "-/run/hive-agent-proxy-credential/proxy.env";
|
||||
# The units that make outbound calls and so load the proxy file. This fixture
|
||||
# has an icon, a forge and GitHub on, and no matrix accounts.
|
||||
proxyConsumers = [
|
||||
"hive-agent"
|
||||
"hive-bash-daemon"
|
||||
"hive-subagent-daemon"
|
||||
"hive-mcp-http"
|
||||
"hive-forge-notify"
|
||||
"hive-github-notify"
|
||||
"forge-avatar-sync"
|
||||
];
|
||||
in
|
||||
let
|
||||
cases = [
|
||||
|
|
@ -238,6 +256,137 @@ let
|
|||
name = "the account fetch re-runs every two minutes";
|
||||
ok = agentForgeBao.systemd.timers.hive-agent-forge-accounts.timerConfig.OnUnitInactiveSec == "2min";
|
||||
}
|
||||
{
|
||||
# ../agent-modules/egress-proxy.nix. Presence arm: the unit and its timer
|
||||
# exist, and the agent is told nothing until a credential is fetched.
|
||||
name = "an agent with a store address fetches its egress-proxy credential, and one without does not";
|
||||
ok =
|
||||
agentForgeBao.systemd.services ? hive-agent-proxy-credential
|
||||
&& agentForgeBao.systemd.timers ? hive-agent-proxy-credential
|
||||
&& !(agentForgeNoBao.systemd.services ? hive-agent-proxy-credential)
|
||||
&& !(agentForgeNoBao.systemd.timers ? hive-agent-proxy-credential);
|
||||
}
|
||||
{
|
||||
# The nix half of `swarm_secret_client::proxy::agent_credential_path`
|
||||
# plus the mount.
|
||||
name = "the proxy fetch reads the agent's own proxy-credential path, by redirect, and never echoes it";
|
||||
ok =
|
||||
let
|
||||
name = agentForgeBao.services.hyperhive.agent.user.name;
|
||||
s = (proxyUnit agentForgeBao).script;
|
||||
in
|
||||
lib.hasInfix "secret/swarm/agents/${name}/proxy-credential" s
|
||||
&& lib.hasInfix "-field=value" s
|
||||
&& lib.hasInfix "> ${lib.escapeShellArg "/run/hive-agent-proxy-credential/secret.new"}" s
|
||||
&& !(lib.hasInfix "echo \"$(bao" s)
|
||||
&& !(lib.hasInfix "echo $(bao" s)
|
||||
&& !(lib.hasInfix "echo \"$secret" s)
|
||||
&& !(lib.hasInfix "printf '%s\\n' \"$secret" s);
|
||||
}
|
||||
{
|
||||
name = "the proxy fetch runs as the agent with its own store identity and keeps its file between runs";
|
||||
ok =
|
||||
let
|
||||
u = proxyUnit agentForgeBao;
|
||||
c = u.serviceConfig;
|
||||
in
|
||||
c.User == agentForgeBao.services.hyperhive.agent.user.name
|
||||
&& c.UMask == "0177"
|
||||
&& !c.RemainAfterExit
|
||||
&& c.RuntimeDirectory == "hive-agent-proxy-credential"
|
||||
&& c.RuntimeDirectoryMode == "0700"
|
||||
&& c.RuntimeDirectoryPreserve == "yes"
|
||||
&& u.environment.BAO_ADDR == baoAddr
|
||||
&& u.environment.BAO_CLIENT_CERT == "/run/hive-agent-bao-identity/current/cert";
|
||||
}
|
||||
{
|
||||
# Presence: every outbound unit loads the file, and the harness keeps the
|
||||
# entry it already had. Absence: an agent with no store loads none.
|
||||
name = "every outbound unit loads the proxy file optionally, beside its other environment files";
|
||||
ok =
|
||||
let
|
||||
svc = agentForgeBao.systemd.services;
|
||||
files = c: svc.${c}.serviceConfig.EnvironmentFile or [ ];
|
||||
in
|
||||
lib.all (
|
||||
c:
|
||||
lib.elem proxyEnvEntry (files c)
|
||||
&& lib.elem "hive-agent-proxy-credential.service" svc.${c}.after
|
||||
&& lib.elem "hive-agent-proxy-credential.service" svc.${c}.wants
|
||||
&& !(lib.elem "hive-agent-proxy-credential.service" (svc.${c}.requires or [ ]))
|
||||
) proxyConsumers
|
||||
&& lib.elem "-/var/lib/t/backend.env" (files "hive-agent")
|
||||
&& !(lib.any
|
||||
(
|
||||
c:
|
||||
lib.elem proxyEnvEntry (agentForgeNoBao.systemd.services.${c}.serviceConfig.EnvironmentFile or [ ])
|
||||
)
|
||||
[
|
||||
"hive-agent"
|
||||
"hive-bash-daemon"
|
||||
"hive-forge-notify"
|
||||
]
|
||||
);
|
||||
}
|
||||
{
|
||||
# The credential is in a file only the fetch writes. Nothing static (a
|
||||
# unit environment, the global one, the login shells) carries a proxy
|
||||
# variable, so an agent without a fetched credential goes direct.
|
||||
name = "no proxy variable is set where the credential is not";
|
||||
ok =
|
||||
let
|
||||
names = [
|
||||
"HTTPS_PROXY"
|
||||
"HTTP_PROXY"
|
||||
"https_proxy"
|
||||
"http_proxy"
|
||||
"NO_PROXY"
|
||||
"no_proxy"
|
||||
"NODE_USE_ENV_PROXY"
|
||||
];
|
||||
anywhere =
|
||||
m: n:
|
||||
m.systemd.globalEnvironment ? ${n}
|
||||
|| m.environment.variables ? ${n}
|
||||
|| lib.any (s: s.environment ? ${n}) (lib.attrValues m.systemd.services);
|
||||
in
|
||||
!(lib.any (anywhere agentForgeBao) names) && !(lib.any (anywhere agentForgeNoBao) names);
|
||||
}
|
||||
{
|
||||
# The hive's facts are the only source of the proxy address and of the
|
||||
# hosts that skip it, and they are read before the store is asked: a hive
|
||||
# without them gets no login and no file. The loopback names stay local.
|
||||
name = "the proxy file takes the proxy and the direct hosts from the hive's facts, before it asks the store";
|
||||
ok =
|
||||
let
|
||||
s = (proxyUnit agentForgeBao).script;
|
||||
at = needle: lib.stringLength (lib.head (lib.splitString needle s));
|
||||
in
|
||||
lib.hasInfix "HIVE_SQUID_PROXY) proxy=$value" s
|
||||
&& lib.hasInfix "HIVE_EGRESS_NO_PROXY) direct=$value" s
|
||||
&& lib.hasInfix "no_proxy=localhost,127.0.0.1,::1,$direct" s
|
||||
&& lib.hasInfix "/etc/hyperhive-hive-facts" s
|
||||
&& at "HIVE_SQUID_PROXY)" < at "bao login"
|
||||
&& !(lib.hasInfix "hyperhive-bridge-dns" s);
|
||||
}
|
||||
{
|
||||
name = "the proxy file names every variable the clients read, and the credential only in the URL's userinfo";
|
||||
ok =
|
||||
let
|
||||
s = (proxyUnit agentForgeBao).script;
|
||||
name = agentForgeBao.services.hyperhive.agent.user.name;
|
||||
in
|
||||
lib.all (v: lib.hasInfix "printf '${v}=%s\\n'" s) [
|
||||
"HTTPS_PROXY"
|
||||
"HTTP_PROXY"
|
||||
"https_proxy"
|
||||
"http_proxy"
|
||||
"NO_PROXY"
|
||||
"no_proxy"
|
||||
]
|
||||
&& lib.hasInfix "NODE_USE_ENV_PROXY=1" s
|
||||
&& lib.hasInfix "url=\"http://${name}:$secret@$proxy\"" s;
|
||||
}
|
||||
];
|
||||
in
|
||||
runGroup "agent-forge-bao" cases
|
||||
|
|
|
|||
Loading…
Reference in a new issue