didericis
f77023db1d
test / integration-docker (pull_request) Successful in 11s
test / unit (pull_request) Successful in 43s
lint / lint (push) Successful in 56s
test / integration-firecracker (pull_request) Successful in 3m19s
test / coverage (pull_request) Successful in 19s
test / publish-infra (pull_request) Has been skipped
tracker-policy-pr / check-pr (pull_request) Successful in 7s
Separate the gateway (data plane) from the orchestrator (control plane) at the
module level. The gateway runtime files move out of the package root — and the
backend-neutral Gateway lifecycle ABC + GATEWAY_* constants move out of
orchestrator/ — into a new bot_bottle/gateway/ package:
gateway/__init__.py (was orchestrator/gateway.py: Gateway ABC + consts
+ rotate_gateway_ca)
gateway/gateway_init.py (the PID-1 daemon supervisor)
gateway/egress_addon.py, egress_addon_core.py, egress_dlp_config.py,
dlp_detectors.py (the egress mitmproxy daemon)
gateway/git_http_backend.py (the git-http daemon)
gateway/git_gate_render.py (the git-gate pre-receive rendering)
gateway/supervise_server.py (the supervise MCP daemon)
gateway/policy_resolver.py (the data-plane control-plane RPC client)
orchestrator/ now holds only control-plane files. The shared plan/types/auth
layer (egress.py=EgressPlan, git_gate.py=GitGatePlan, supervise.py,
supervise_types.py, control_auth.py) and the launch-time git-gate provisioning
helpers stay at root, so orchestrator/ and backend/ still own them.
Because these daemons are invoked as `python3 -m bot_bottle.<name>`, loaded flat
by mitmproxy, and referenced in Dockerfile.gateway, the move updates more than
Python imports: the `-m` invocations (firecracker/macOS infra scripts), the
Dockerfile.gateway addon shim + ENTRYPOINT, gateway_init's _DAEMONS module
paths, and the git-gate CGI heredocs all now point at bot_bottle.gateway.*.
No behavior change; full unit suite green (2251).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
47 lines
1.6 KiB
Python
47 lines
1.6 KiB
Python
"""Shared network/image constants for the macOS consolidated infra container.
|
|
|
|
The gateway data plane no longer runs as its own Apple container — it shares a
|
|
single per-host **infra container** with the control plane (see `infra`),
|
|
because two Apple-Container guests writing one `bot-bottle.db` over virtiofs
|
|
would race incoherent `fcntl` locks. This module holds the pieces both the
|
|
infra service and the launch/provision glue need: the network names, the
|
|
gateway image, and the network-creation helper.
|
|
"""
|
|
|
|
from __future__ import annotations
|
|
|
|
import os
|
|
|
|
from ...gateway import GatewayError
|
|
from . import util as container_mod
|
|
|
|
# The shared host-only network the infra container and every agent bottle sit
|
|
# on. The agent's address here is the attribution key. Distinct from the docker
|
|
# names so both backends can coexist on one host.
|
|
GATEWAY_NETWORK = "bot-bottle-mac-gateway"
|
|
# The NAT network that gives the infra container (and only it) a route out.
|
|
GATEWAY_EGRESS_NETWORK = "bot-bottle-mac-egress"
|
|
|
|
GATEWAY_IMAGE = os.environ.get("BOT_BOTTLE_GATEWAY_IMAGE", "bot-bottle-gateway:latest")
|
|
|
|
DEFAULT_CA_TIMEOUT_SECONDS = 30.0
|
|
|
|
|
|
def ensure_networks(
|
|
network: str = GATEWAY_NETWORK, egress_network: str = GATEWAY_EGRESS_NETWORK,
|
|
) -> None:
|
|
"""Create the shared host-only network + the NAT egress network. Idempotent
|
|
— `create_network` tolerates 'already exists'."""
|
|
container_mod.create_network(egress_network)
|
|
container_mod.create_network(network, internal=True)
|
|
|
|
|
|
__all__ = [
|
|
"GATEWAY_NETWORK",
|
|
"GATEWAY_EGRESS_NETWORK",
|
|
"GATEWAY_IMAGE",
|
|
"GatewayError",
|
|
"DEFAULT_CA_TIMEOUT_SECONDS",
|
|
"ensure_networks",
|
|
]
|