didericis
c4ccd74f9b
Extract the Apple-Container gateway data plane out of `MacosInfraService` into `MacosGateway`, the macOS implementation of the shared `Gateway` service. `connect_to_orchestrator(url, gateway_token)` runs the triple-homed gateway container (egress + agent + control networks) carrying the mitmproxy CA and the pre-minted `gateway` token; `address()` / `ca_cert_pem()` / `provisioning_transport()` round out the contract. The infra service now composes the gateway: `ensure_running` mints the role-scoped `gateway` JWT (it holds the signing key; the gateway never does — #469) and hands it to `gateway().connect_to_orchestrator(...)`, and `ca_cert_pem` delegates to the service. The inlined `_ensure_gateway_container` + CA-read are gone. `AppleGatewayTransport` + the gateway container name/label now live with the gateway module, breaking the old infra→provision coupling. Splits the gateway-run + CA tests out of test_macos_infra into a dedicated test_macos_gateway; the infra tests mock `svc.gateway`. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
45 lines
1.6 KiB
Python
45 lines
1.6 KiB
Python
"""`GatewayTransport` for the Apple infra container (PRD 0070).
|
|
|
|
The provisioning *logic* (per-bottle creds dirs, namespaced repo init) is
|
|
backend-neutral and lives in `backend.docker.gateway_provision`; this is only
|
|
the transport — how files and commands reach the running gateway. Docker uses
|
|
`docker exec`/`docker cp` and Firecracker uses SSH; Apple uses the `container`
|
|
CLI's equivalents against the infra container that hosts the gateway daemons.
|
|
"""
|
|
|
|
from __future__ import annotations
|
|
|
|
from ...gateway import GatewayProvisionError
|
|
from . import util as container_mod
|
|
from .gateway import GATEWAY_NAME
|
|
|
|
|
|
class AppleGatewayTransport:
|
|
"""`GatewayTransport` for the gateway daemons in the Apple infra container."""
|
|
|
|
def __init__(self, gateway: str = GATEWAY_NAME) -> None:
|
|
self.gateway = gateway
|
|
|
|
def exec(self, argv: list[str]) -> None:
|
|
result = container_mod.run_container_argv(
|
|
["container", "exec", self.gateway, *argv]
|
|
)
|
|
if result.returncode != 0:
|
|
raise GatewayProvisionError(
|
|
f"gateway exec {argv!r} failed: "
|
|
f"{(result.stderr or '').strip() or '<no stderr>'}"
|
|
)
|
|
|
|
def cp_into(self, src: str, dest: str) -> None:
|
|
result = container_mod.run_container_argv(
|
|
["container", "cp", src, f"{self.gateway}:{dest}"]
|
|
)
|
|
if result.returncode != 0:
|
|
raise GatewayProvisionError(
|
|
f"gateway cp {src} -> {dest} failed: "
|
|
f"{(result.stderr or '').strip() or '<no stderr>'}"
|
|
)
|
|
|
|
|
|
__all__ = ["AppleGatewayTransport", "GatewayProvisionError"]
|