3 Commits

Author	SHA1	Message	Date
didericis	18d9b81add	feat(firecracker): split orchestrator and gateway into separate VMs (PRD 0070) ... Now that #469 got the DB off the data plane, the Firecracker infra runs as two microVMs instead of one — mirroring the docker/macos plane split: * orchestrator VM (ORCH_IFACE) — control plane + buildah image builds; sole DB opener; host-seeded signing key. No gateway daemons. * gateway VM (new GW_IFACE) — egress / git-http / supervise data plane; mitmproxy CA + a host-minted `gateway` JWT (never the key). Reaches the orchestrator only over the one nft forward rule its link allows. Both boot the SAME shared infra rootfs; a `bb_role=` kernel-cmdline arg selects which plane a VM's PID-1 init starts, so there is still one published artifact. The gateway learns the orchestrator's address via `bb_orch=` on the cmdline (no IP baked into the artifact). Isolation is nearly free: agents were already nft-dropped except the DNAT'd gateway ports, so re-pointing that single DNAT rule at the gateway VM (`dnat to gw_guest`) severs every agent's L3 route to the control plane. The only added nft is the second infra link's mirror block (masquerade egress + forward accept, which subsumes gateway->orchestrator) in the shared shell script and the NixOS module. netpool gains GW_IFACE + gw_slot() (the /31 above the orch link); firecracker_vm.boot gains extra_boot_args for the role cmdline; infra_vm ensure_running() boots + adopts the pair (orchestrator first, then the gateway that resolves policy against it) and returns an InfraEndpoint mirroring the docker/macos shape. Builds stay in the orchestrator (PRD 0070 v1); the gateway is the slim unit. Unit-tested (test_firecracker_infra_vm rewritten for two VMs; gw_slot helper test added); the KVM boot / L3-isolation checks are validated on a Firecracker host. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-07-25 03:44:15 -04:00
didericis	81a2f15046	feat(firecracker): NAT'd egress link for the orchestrator/builder VM ... The orchestrator/gateway VM is trusted infra, not an isolated agent: it builds agent images in-VM (buildah must FROM-pull + apt/npm) and, in the Stage B cutover, forwards agent egress upstream. Give it a dedicated TAP (`bborch0`) on a /31 at the top of the IP_BASE /16 (clear of the bbfc* agent pool at the bottom), NAT'd out the host uplink — while agent VMs keep their fail-closed, gateway-only isolation table. - netpool.defaults.env / netpool.py: new BOT_BOTTLE_FC_ORCH_IFACE + `orch_slot()` (index -1 sentinel; host x.y.255.0 / guest x.y.255.1). - scripts/firecracker-netpool.sh: create + address the orchestrator TAP; `bot_bottle_fc_nat` table masquerades its /31 out the uplink and accepts its forward path. Because bootstrap still runs Docker (whose FORWARD policy is DROP), a best-effort, guarded, idempotent DOCKER-USER ACCEPT is added too (skipped once Docker is gone). down/status updated. - nix/firecracker-netpool.nix: mirror the option, pass it via the unit Environment= (the store-copied script can't read the defaults file), and add iptables to the unit path for the DOCKER-USER step. Agent isolation is unchanged: the new rules only ever accept/masquerade the orchestrator link and never drop, so they can't weaken the bbfc* drops. Applied by re-running `sudo ./scripts/firecracker-netpool.sh up`. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01WBMWTEtQdJ4W5UrWuLHCck	2026-07-16 14:36:54 -04:00
didericis	2b970d1170	refactor(firecracker): single-source the network-pool defaults ... The pool params (size, IP base, iface prefix, nft table) were triplicated — hardcoded in netpool.py, scripts/firecracker-netpool.sh, and nix/firecracker-netpool.nix — plus the IP math (3x) and the nft ruleset (2x). Nothing enforced agreement; changing the base (ce3fad9, off CGNAT) forced a coordinated three-file edit, and a missed one would silently provision a range the launcher doesn't expect. Collapse to one source of truth: * netpool.defaults.env — a plain KEY=VALUE file (bash-sourceable, systemd EnvironmentFile-compatible, Python- and Nix-parseable) holding the four defaults. A BOT_BOTTLE_FC_* env var still overrides any key. * netpool.py reads it for the Python defaults (missing file = hard error, not confusing empty defaults). * the shell script falls back to it (no literal `:-8` / `10.243.0.0`), and its `up` is now non-destructive/idempotent (only creates a missing TAP), so re-running never cuts a live VM. * the Nix module readFile-parses it for its option defaults and delegates bring-up to the SAME shell script (dropping its duplicate IP math, nft ruleset, and TAP loop) — passing every value as Environment= so the store-detached script never needs the file. Net: defaults 3x -> 1x, nft ruleset 2x -> 1x, TAP loop 2x -> 1x. The one remaining IP-math dup (Python launch-addressing vs bash bring-up) is justified — different runtimes. Tests now guard the invariant (Python reads the shared file; the script/module hold no literals) instead of pinning duplicated strings. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01WBMWTEtQdJ4W5UrWuLHCck	2026-07-13 04:27:48 -04:00