didericis
95981ea9d3
The orchestrator/gateway VM is trusted infra, not an isolated agent: it builds agent images in-VM (buildah must FROM-pull + apt/npm) and, in the Stage B cutover, forwards agent egress upstream. Give it a dedicated TAP (`bborch0`) on a /31 at the top of the IP_BASE /16 (clear of the bbfc* agent pool at the bottom), NAT'd out the host uplink — while agent VMs keep their fail-closed, gateway-only isolation table. - netpool.defaults.env / netpool.py: new BOT_BOTTLE_FC_ORCH_IFACE + `orch_slot()` (index -1 sentinel; host x.y.255.0 / guest x.y.255.1). - scripts/firecracker-netpool.sh: create + address the orchestrator TAP; `bot_bottle_fc_nat` table masquerades its /31 out the uplink and accepts its forward path. Because bootstrap still runs Docker (whose FORWARD policy is DROP), a best-effort, guarded, idempotent DOCKER-USER ACCEPT is added too (skipped once Docker is gone). down/status updated. - nix/firecracker-netpool.nix: mirror the option, pass it via the unit Environment= (the store-copied script can't read the defaults file), and add iptables to the unit path for the DOCKER-USER step. Agent isolation is unchanged: the new rules only ever accept/masquerade the orchestrator link and never drop, so they can't weaken the bbfc* drops. Applied by re-running `sudo ./scripts/firecracker-netpool.sh up`. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01WBMWTEtQdJ4W5UrWuLHCck
26 lines
1.3 KiB
Bash
26 lines
1.3 KiB
Bash
# Firecracker network-pool defaults — the SINGLE source of these values.
|
|
#
|
|
# Read by every consumer so they can't drift:
|
|
# * netpool.py — parses this for the Python defaults (below).
|
|
# * scripts/firecracker-netpool.sh — falls back to these when the
|
|
# matching BOT_BOTTLE_FC_* env var is unset.
|
|
# * nix/firecracker-netpool.nix — readFile-parses this for its option
|
|
# defaults, then passes the resolved values back as Environment=.
|
|
#
|
|
# Plain KEY=VALUE (no quoting, no inline comments, no spaces around `=`)
|
|
# so it is bash-sourceable, systemd EnvironmentFile-compatible, and
|
|
# trivially parseable from Python and Nix. A real BOT_BOTTLE_FC_* env
|
|
# var of the same name always overrides the value here.
|
|
BOT_BOTTLE_FC_POOL_SIZE=8
|
|
BOT_BOTTLE_FC_IP_BASE=10.243.0.0
|
|
BOT_BOTTLE_FC_IFACE_PREFIX=bbfc
|
|
BOT_BOTTLE_FC_NFT_TABLE=bot_bottle_fc
|
|
# The orchestrator/gateway VM's own TAP — a dedicated link OUTSIDE the
|
|
# bbfc* agent pool. Unlike agent VMs (which reach only their gateway),
|
|
# the orchestrator is trusted infra that needs real NAT'd internet
|
|
# egress: to FROM-pull + apt/npm during in-VM agent-image builds
|
|
# (buildah) and to forward agent egress upstream (Stage B gateway). Its
|
|
# /31 is the top of the IP_BASE /16 (host x.y.255.0, guest x.y.255.1),
|
|
# clear of the pool near the bottom of the block.
|
|
BOT_BOTTLE_FC_ORCH_IFACE=bborch0
|