refactor(firecracker): single-source the network-pool defaults #350

2026-07-12T17:33:45-04:00

didericis-claude commented

2026-07-12 17:33:45 -04:00

The pool params (size / IP base / iface prefix / nft table) were triplicated across netpool.py, scripts/firecracker-netpool.sh, and nix/firecracker-netpool.nix, plus the IP math (3×) and the nft ruleset (2×) — coupled only by hand + "must match" comments. Changing the base off CGNAT (ce3fad9) forced a coordinated three-file edit; a missed one would silently provision a range the launcher doesn't expect.

One source of truth: bot_bottle/backend/firecracker/netpool.defaults.env (plain KEY=VALUE: bash-sourceable, systemd EnvironmentFile-compatible, Python/Nix-parseable).

netpool.py reads it for defaults (missing file → hard error).
the shell script falls back to it (no literal :-8/10.243.0.0); up is now non-destructive/idempotent so re-running never cuts a live VM.
the Nix module readFile-parses it for option defaults and delegates bring-up to the same shell script — dropping its duplicate IP math, nft ruleset, and TAP loop, passing every value as Environment=.

Net: defaults 3×→1×, nft ruleset 2×→1×, TAP loop 2×→1×. Tests now guard the invariant (Python reads the shared file; script/module hold no literals) instead of pinning duplicated strings. Nix parse-checked; unit tests green (the /bin/sleep test_sidecar_init errors are pre-existing NixOS-local noise).

🤖 Generated with Claude Code

The pool params (size / IP base / iface prefix / nft table) were triplicated across `netpool.py`, `scripts/firecracker-netpool.sh`, and `nix/firecracker-netpool.nix`, plus the IP math (3×) and the nft ruleset (2×) — coupled only by hand + "must match" comments. Changing the base off CGNAT (`ce3fad9`) forced a coordinated three-file edit; a missed one would silently provision a range the launcher doesn't expect. **One source of truth:** `bot_bottle/backend/firecracker/netpool.defaults.env` (plain `KEY=VALUE`: bash-sourceable, systemd `EnvironmentFile`-compatible, Python/Nix-parseable). - `netpool.py` reads it for defaults (missing file → hard error). - the shell script falls back to it (no literal `:-8`/`10.243.0.0`); `up` is now non-destructive/idempotent so re-running never cuts a live VM. - the Nix module `readFile`-parses it for option defaults and **delegates bring-up to the same shell script** — dropping its duplicate IP math, nft ruleset, and TAP loop, passing every value as `Environment=`. Net: defaults 3×→1×, nft ruleset 2×→1×, TAP loop 2×→1×. Tests now guard the invariant (Python reads the shared file; script/module hold no literals) instead of pinning duplicated strings. Nix parse-checked; unit tests green (the `/bin/sleep` `test_sidecar_init` errors are pre-existing NixOS-local noise). 🤖 Generated with [Claude Code](https://claude.com/claude-code)

didericis approved these changes 2026-07-13 04:27:42 -04:00

didericis added 1 commit 2026-07-13 04:27:52 -04:00

refactor(firecracker): single-source the network-pool defaults

test / unit (pull_request) Successful in 54s

Details

test / integration (pull_request) Successful in 15s

Details

test / coverage (pull_request) Successful in 56s

Details

lint / lint (push) Successful in 1m59s

Details

test / unit (push) Successful in 53s

Details

test / integration (push) Successful in 20s

Details

test / coverage (push) Successful in 58s

Details

Update Quality Badges / update-badges (push) Successful in 57s

Details

2b970d1170

The pool params (size, IP base, iface prefix, nft table) were triplicated
— hardcoded in netpool.py, scripts/firecracker-netpool.sh, and
nix/firecracker-netpool.nix — plus the IP math (3x) and the nft ruleset
(2x). Nothing enforced agreement; changing the base (ce3fad9, off CGNAT)
forced a coordinated three-file edit, and a missed one would silently
provision a range the launcher doesn't expect.

Collapse to one source of truth:

  * netpool.defaults.env — a plain KEY=VALUE file (bash-sourceable,
    systemd EnvironmentFile-compatible, Python- and Nix-parseable) holding
    the four defaults. A BOT_BOTTLE_FC_* env var still overrides any key.
  * netpool.py reads it for the Python defaults (missing file = hard
    error, not confusing empty defaults).
  * the shell script falls back to it (no literal `:-8` / `10.243.0.0`),
    and its `up` is now non-destructive/idempotent (only creates a
    missing TAP), so re-running never cuts a live VM.
  * the Nix module readFile-parses it for its option defaults and
    delegates bring-up to the SAME shell script (dropping its duplicate
    IP math, nft ruleset, and TAP loop) — passing every value as
    Environment= so the store-detached script never needs the file.

Net: defaults 3x -> 1x, nft ruleset 2x -> 1x, TAP loop 2x -> 1x. The one
remaining IP-math dup (Python launch-addressing vs bash bring-up) is
justified — different runtimes. Tests now guard the invariant (Python
reads the shared file; the script/module hold no literals) instead of
pinning duplicated strings.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WBMWTEtQdJ4W5UrWuLHCck

didericis force-pushed netpool-single-source from 3cde6eb3da to 2b970d1170

2026-07-13 04:27:52 -04:00

Compare

didericis merged commit 2b970d1170 into main

2026-07-13 11:42:35 -04:00

didericis deleted branch netpool-single-source

2026-07-13 11:42:40 -04:00

Sign in to join this conversation.

2 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: didericis/bot-bottle#350