empeira 0.1.0.pre.alpha.1

data/lib/empeira/control_plane/discovery.rb

@@ -0,0 +1,69 @@
+# frozen_string_literal: true
+
+module Empeira
+  module ControlPlane
+    class Discovery
+      def initialize(plan:, runtime:, state:)
+        @plan = plan
+        @runtime = runtime
+        @state = state
+      end
+
+      def refresh(services: nil, node_resources: nil, reload_proxy: true, force_proxy_reload: false)
+        nodes = @state.fetch('nodes', {})
+        definitions = node_definitions(nodes)
+        expected = nodes.select { |_, record| record['provider'] == 'container' }
+                        .transform_values { |record| record['id'] }
+        resources = inspect(definitions, expected, services, node_resources)
+        resources.merge!(lease_resources(nodes))
+        @plan.files.hosts(resources, @plan.network)
+        refresh_proxy(resources, nodes, reload: reload_proxy, force: force_proxy_reload)
+      end
+
+      private
+
+      def node_definitions(nodes)
+        nodes.select { |_, record| record['provider'] == 'container' }.transform_values do |record|
+          Node::Definition.new(hostname: record.fetch('hostname'), workspace: @plan.context.workspace)
+        end
+      end
+
+      def refresh_proxy(resources, nodes, reload:, force:)
+        changed = @plan.files.proxy_clients(resources, @plan.network, nodes: nodes)
+        resource = resources['proxy']
+        reload_proxy(resource, changed: changed || force) if reload && resource&.fetch('state') == 'running'
+        changed
+      end
+
+      def reload_proxy(resource, changed:)
+        checkpoint = { 'id' => resource.fetch('id'), 'fingerprint' => @plan.files.proxy_reload_digest }
+        plane = @state.fetch('control_plane')
+        return if !changed && plane['proxy_reload'] == checkpoint
+
+        @runtime.reload_service(resource)
+        plane['proxy_reload'] = checkpoint
+      end
+
+      def lease_resources(nodes)
+        nodes.filter_map do |name, record|
+          address = record.dig('peer', 'ip') || record.dig('definition', 'ip')
+          [name, { 'networks' => { @plan.network => { 'IPAddress' => address } } }] if address
+        end.to_h
+      end
+
+      def inspect_nodes(definitions, expected)
+        definitions.empty? ? {} : @runtime.inspect_services(definitions, expected_ids: expected)
+      end
+
+      def inspect(definitions, expected, services, node_resources)
+        if services
+          nodes = node_resources || inspect_nodes(definitions, expected)
+          return services.merge(nodes.compact)
+        end
+        @plan.browser_enabled = @state.dig('control_plane', 'services')&.key?('browser')
+        expected.merge!(@state.fetch('control_plane').fetch('services').transform_values { |record| record['id'] })
+        @runtime.inspect_services(@plan.definitions.merge(definitions), expected_ids: expected).compact
+      end
+    end
+  end
+end

data/lib/empeira/control_plane/environment.rb

@@ -0,0 +1,101 @@
+# frozen_string_literal: true
+
+module Empeira
+  module ControlPlane
+    # Mount destinations exist in state, while control code stays live and read-only.
+    class Environment
+      CONTROL = '/empeira-control'
+
+      def initialize(context:, hiera:)
+        @project = context.project.path
+        @root = root(context)
+        @targets = mount_targets(hiera)
+        @modules = Modules::Storage.new(context: context).root if @project.join('Puppetfile').file?
+        @targets |= ['modules'] if @modules
+        @base = context.locations.workspace(context.workspace).join('environments')
+        @directory = @base.join(Infrastructure::Definition.fingerprint([@targets, @modules&.to_s]))
+      end
+
+      def mounts
+        return [bind(@project, @root)] if @targets.empty?
+
+        [bind(@project, CONTROL), bind(@directory, @root),
+         *(@modules ? [bind(@modules, "#{@root}/modules")] : [])]
+      end
+
+      def prepare
+        return if @targets.empty?
+        raise Error, 'Managed environment directory must not be a symlink' if @directory.symlink?
+
+        FileUtils.mkdir_p(@directory, mode: 0o755)
+        project_directory('', @directory)
+      end
+
+      def cleanup
+        raise Error, 'Managed environment directory must not be a symlink' if @base.symlink?
+
+        FileUtils.remove_entry_secure(@base) if @base.exist?
+      end
+
+      private
+
+      def mount_targets(hiera)
+        hiera.entries.select { |entry| entry['status'] == 'available' }.map do |entry|
+          entry['destination'].delete_prefix("#{@root}/")
+        end
+      end
+
+      def root(context)
+        "/etc/puppetlabs/code/environments/#{context.configuration.dig('server', 'environment')}"
+      end
+
+      def bind(source, destination)
+        "type=bind,src=#{source},dst=#{destination},readonly"
+      end
+
+      def project_directory(relative, destination)
+        child_names(relative).each do |name|
+          path = relative.empty? ? name : "#{relative}/#{name}"
+          create_entry(path, destination.join(name))
+        end
+      end
+
+      def child_names(relative)
+        source = @project.join(relative)
+        children = source.directory? ? source.children.map { |child| child.basename.to_s } : []
+        children = [] if relative == 'modules' && @modules
+        prefixes = target_prefixes(relative)
+        children | prefixes
+      end
+
+      def target_prefixes(relative)
+        @targets.filter_map do |target|
+          next unless relative.empty? || target.start_with?("#{relative}/")
+
+          target.delete_prefix(relative.empty? ? '' : "#{relative}/").split('/').first
+        end
+      end
+
+      def create_link(relative, destination)
+        File.symlink("#{CONTROL}/#{relative}", destination) unless destination.symlink? || destination.exist?
+      end
+
+      def create_entry(relative, destination)
+        if @targets.any? { |target| target == relative || target.start_with?("#{relative}/") }
+          create_target(relative, destination)
+        else
+          create_link(relative, destination)
+        end
+      end
+
+      def create_target(relative, destination)
+        raise Error, 'Managed environment destination is unsafe' if destination.symlink?
+
+        FileUtils.mkdir_p(destination, mode: 0o755)
+        return if @targets.include?(relative) && !(relative == 'modules' && @modules)
+
+        project_directory(relative, destination)
+      end
+    end
+  end
+end

data/lib/empeira/control_plane/files.rb

@@ -0,0 +1,263 @@
+# frozen_string_literal: true
+
+require 'securerandom'
+
+module Empeira
+  module ControlPlane
+    # Keep the small generated SQL and TLS configuration templates together.
+    # rubocop:disable-next Metrics/ClassLength
+    class Files
+      attr_reader :directory
+
+      def initialize(context:)
+        @context = context
+        @directory = context.locations.workspace(context.workspace).join('services')
+      end
+
+      def path(name)
+        directory.join(name).to_s
+      end
+
+      def prepare(upstreams: nil, routes: {}, bootstrap: false)
+        FileUtils.mkdir_p(directory, mode: 0o755)
+        configuration(bootstrap: bootstrap).each do |name, content|
+          next if name == 'squid.conf'
+
+          content = if name == 'Corefile'
+                      corefile_content(upstreams:, routes:, bootstrap:)
+                    else
+                      content.gsub('@HOST_UPSTREAM@', Array(upstreams).join(' '))
+                    end
+          write(name, content)
+        end
+        prepare_discovery_files
+      end
+
+      def corefile_current?(upstreams:, routes:)
+        File.file?(path('Corefile')) && File.binread(path('Corefile')) == corefile_content(upstreams:, routes:)
+      end
+
+      def activate_additional_resolver(upstreams:, routes:)
+        write('Corefile', corefile_content(upstreams:, routes:))
+      end
+
+      def configuration(bootstrap: false)
+        {
+          'Corefile' => corefile(bootstrap: bootstrap),
+          'squid.conf' => Network::ProxyPolicy.new(@context.configuration.fetch('proxy')).configuration,
+          'jetty.ini' => jetty, 'database.conf' => database, 'database-setup.sql' => database_setup,
+          'puppetdb.conf' => "puppetdb: {}\n",
+          'server-puppetdb.conf' => <<~CONFIG
+            [main]
+            server_urls = https://puppetdb.empeira.internal:8081
+            verify_client_certificate = false
+          CONFIG
+        }
+      end
+
+      def prepare_discovery_files
+        write('proxy-rules.conf', '') unless File.exist?(path('proxy-rules.conf'))
+        write('proxy-clients', "127.0.0.1/32\n") unless File.exist?(path('proxy-clients'))
+        write('hosts', '') unless File.exist?(path('hosts'))
+      end
+
+      def bind_dns(address)
+        IPAddr.new(address)
+        write('squid.conf', configuration.fetch('squid.conf').gsub('@EMPEIRA_DNS@', address))
+      rescue IPAddr::InvalidAddressError
+        raise Error, 'Cannot bind proxy DNS to an invalid CoreDNS address'
+      end
+
+      def cleanup
+        FileUtils.rm_f(secret_path)
+      end
+
+      def credentials(existing:)
+        return if File.file?(secret_path)
+
+        if existing
+          raise Error,
+                'Database credentials are missing for retained storage; restore the workspace credentials'
+        end
+
+        content = %w[POSTGRES_PASSWORD EMPEIRA_DB_PASSWORD EMPEIRA_READ_PASSWORD].map do |key|
+          "#{key}=#{SecureRandom.hex(32)}\n"
+        end.join
+        File.write(secret_path, content, mode: 'wx', perm: 0o600)
+      end
+
+      def secret_path
+        @context.locations.workspace(@context.workspace).join('database.env').to_s
+      end
+
+      # rubocop:disable-next Naming/PredicateMethod -- This atomic write returns whether content changed.
+      def write(name, content, mode: 0o644)
+        return false if File.file?(path(name)) && File.binread(path(name)) == content
+
+        Tempfile.create('configuration-', directory) do |file|
+          file.chmod(mode)
+          file.write(content)
+          file.flush
+          File.rename(file.path, path(name))
+        end
+        true
+      end
+
+      def hosts(resources, network)
+        naming = Network::Naming.new
+        entries = resources.sort.filter_map do |key, resource|
+          address = resource.dig('networks', network, 'IPAddress')
+          "#{address} #{naming.aliases(key).join(' ')}" if address && !address.empty?
+        end
+        write('hosts', "#{entries.join("\n")}\n")
+      end
+
+      def proxy_clients(resources, network, nodes: {})
+        bindings = Network::ProxyBindings.new(context: @context, resources: resources, network: network, nodes: nodes)
+        # The workspace parent is private; Squid's mapped service user must read the bind mount.
+        rules_changed = write('proxy-rules.conf', bindings.configuration)
+        allowed = proxy_allowed(nodes)
+        addresses = resources.slice(*allowed).values.filter_map do |resource|
+          resource&.dig('networks', network, 'IPAddress')
+        end
+        clients_changed = write('proxy-clients', "#{(['127.0.0.1/32'] + addresses.reject(&:empty?).sort).join("\n")}\n")
+        rules_changed || clients_changed
+      end
+
+      def proxy_reload_digest
+        content = %w[squid.conf proxy-rules.conf proxy-clients].to_h do |name|
+          [name, File.binread(path(name))]
+        end
+        Infrastructure::Definition.fingerprint(content)
+      end
+
+      def proxy_allowed(nodes)
+        ['server', *nodes.keys]
+      end
+
+      private
+
+      def corefile_content(upstreams:, routes:, bootstrap: false)
+        corefile(bootstrap: bootstrap).gsub('@HOST_UPSTREAM@', Array(upstreams).join(' ')) +
+          resolver_routes(routes, bootstrap: bootstrap) + rewrite_zones(upstreams: upstreams, routes: routes,
+                                                                        bootstrap: bootstrap)
+      end
+
+      # Reloadable DNS policy is deliberately outside the container definition fingerprint.
+      # Exact rewrites use authoritative discovery; unmatched descendants keep normal forwarding.
+      # rubocop:disable-next Metrics/MethodLength
+      def rewrite_zones(upstreams:, routes:, bootstrap:)
+        Configuration::DNSRewrites.entries(@context.configuration).map do |entry|
+          source, target = entry.values_at('from', 'to')
+          route = routes.keys.select { |zone| source == zone || source.end_with?(".#{zone}") }.max_by(&:size)
+          servers = route ? routes.fetch(route) : upstreams
+          <<~CONFIG
+            #{source}:53 {
+              rewrite stop name exact #{source} #{target}
+              template IN AAAA . {
+                rcode NOERROR
+              }
+              hosts /empeira/hosts empeira.internal {
+                ttl 1
+                reload 1s
+              }
+              #{forwarders(Array(servers).join(' '), bootstrap: bootstrap, authoritative: true)}
+              loop
+              reload
+            }
+          CONFIG
+        end.join
+      end
+
+      def resolver_routes(routes, bootstrap: false)
+        sources = Configuration::DNSRewrites.entries(@context.configuration).map { |entry| entry.fetch('from') }
+        routes.except(*sources).map do |zone, addresses|
+          forwarding = forwarders(addresses.join(' '), bootstrap: bootstrap)
+          "#{zone}:53 {\n  template IN AAAA {\n    rcode NOERROR\n  }\n  #{forwarding}\n  loop\n  reload\n}\n"
+        end.join
+      end
+
+      def forwarders(servers, bootstrap: false, authoritative: false)
+        additional = @context.configuration.dig('dns', 'additional_resolver') unless bootstrap
+        exclusion = authoritative ? "    except empeira.internal\n" : ''
+        fallback = authoritative ? "forward . #{servers} {\n#{exclusion}  }" : "forward . #{servers}"
+        return fallback unless additional
+
+        "forward . #{additional} {\n#{exclusion}    next NXDOMAIN\n    next_on_nodata\n  }\n  #{fallback}"
+      end
+
+      # One readable CoreDNS document defines both authoritative and forwarding zones.
+      # rubocop:disable-next Metrics/MethodLength
+      def corefile(bootstrap: false)
+        upstream = @context.configuration.dig('dns', 'upstream')
+        servers = upstream['mode'] == 'host' ? '@HOST_UPSTREAM@' : upstream.fetch('servers').join(' ')
+        <<~CONFIG
+          empeira.internal:53 {
+            template IN AAAA {
+              rcode NOERROR
+            }
+            hosts /empeira/hosts {
+              ttl 1
+              reload 1s
+            }
+            reload
+          }
+          .:53 {
+            template IN AAAA {
+              rcode NOERROR
+            }
+            hosts /empeira/hosts {
+              ttl 1
+              reload 1s
+              fallthrough
+            }
+            #{forwarders(servers, bootstrap: bootstrap)}
+            loop
+            reload
+            health :8080
+          }
+        CONFIG
+      end
+
+      def database_setup
+        <<~'SQL'
+          \getenv writer_password EMPEIRA_DB_PASSWORD
+          \getenv reader_password EMPEIRA_READ_PASSWORD
+          SELECT format('CREATE ROLE puppetdb LOGIN PASSWORD %L', :'writer_password')
+            WHERE NOT EXISTS (SELECT FROM pg_roles WHERE rolname = 'puppetdb') \gexec
+          SELECT format('CREATE ROLE puppetdb_read LOGIN PASSWORD %L', :'reader_password')
+            WHERE NOT EXISTS (SELECT FROM pg_roles WHERE rolname = 'puppetdb_read') \gexec
+          ALTER DATABASE puppetdb OWNER TO puppetdb;
+          CREATE EXTENSION IF NOT EXISTS pg_trgm;
+          GRANT ALL ON SCHEMA public TO puppetdb;
+          GRANT USAGE ON SCHEMA public TO puppetdb_read;
+          GRANT SELECT ON ALL TABLES IN SCHEMA public TO puppetdb_read;
+          ALTER DEFAULT PRIVILEGES FOR ROLE puppetdb IN SCHEMA public GRANT SELECT ON TABLES TO puppetdb_read;
+        SQL
+      end
+
+      def jetty
+        <<~CONFIG
+          [jetty]
+          host = 0.0.0.0
+          port = 8080
+        CONFIG
+      end
+
+      def database
+        <<~CONFIG
+          database: {
+            subname: "//postgres.empeira.internal:5432/puppetdb"
+            username: puppetdb
+            password: ${EMPEIRA_DB_PASSWORD}
+          }
+          read-database: {
+            subname: "//postgres.empeira.internal:5432/puppetdb"
+            username: puppetdb_read
+            password: ${EMPEIRA_READ_PASSWORD}
+          }
+        CONFIG
+      end
+    end
+  end
+end

data/lib/empeira/control_plane/health.rb

@@ -0,0 +1,104 @@
+# frozen_string_literal: true
+
+module Empeira
+  module ControlPlane
+    class Health
+      RUBY = '/opt/puppetlabs/puppet/bin/ruby'
+
+      def initialize(runtime:, plan:)
+        @runtime = runtime
+        @plan = plan
+      end
+
+      def wait(key, resources)
+        deadline = Process.clock_gettime(Process::CLOCK_MONOTONIC) + @plan.config.dig('server', 'timeout')
+        loop do
+          return if ready?(key, resources)
+          if Process.clock_gettime(Process::CLOCK_MONOTONIC) >= deadline
+            raise Error,
+                  "#{key} did not become ready within server.timeout; inspect empeira status and owned service logs\n" \
+                  "#{@failure}"
+          end
+
+          sleep 2
+        end
+      end
+
+      # rubocop:disable-next Metrics/CyclomaticComplexity -- Each service has its own concrete readiness probe.
+      def ready?(key, resources)
+        resource = resources[key]
+        return false unless resources.dig(key, 'state') == 'running'
+
+        case key
+        when 'server' then check(resource, [*tls_curl, 'https://server.empeira.internal:8140/status/v1/simple'],
+                                 'running')
+        when 'postgres' then check(resource, ['psql', '-U', 'postgres', '-d', 'puppetdb', '-Atc', 'SELECT 1'], '1')
+        when 'puppetdb-backend'
+          check(resources['server'], [*http_curl, 'http://puppetdb-backend.empeira.internal:8080/pdb/query/v4/nodes'])
+        when 'puppetdb' then puppetdb_ready?(resources['server'])
+        when 'dns' then dns_ready?(resources)
+        when 'proxy' then proxy_ready?(resources)
+        else false
+        end
+      end
+
+      def http_curl
+        Server::HTTP.arguments
+      end
+
+      def tls_curl
+        Server::HTTP.tls_arguments
+      end
+
+      private
+
+      def puppetdb_ready?(server)
+        path = '/pdb/query/v4/nodes'
+        check(server, [*http_curl, "http://puppetdb.empeira.internal:8080#{path}"]) &&
+          check(server, [*http_curl, '--cacert', '/etc/puppetlabs/puppet/ssl/certs/ca.pem',
+                         "https://puppetdb.empeira.internal:8081#{path}"])
+      end
+
+      def check(resource, arguments, expected = nil)
+        return false unless resource
+        return check_http?(resource, arguments, expected) if http_probe?(arguments)
+
+        result = @runtime.service_exec(resource, arguments)
+        return true if result.success? && (expected.nil? || result.stdout.strip == expected)
+
+        @failure = Execution::Diagnostics.native(result, operation: 'Probe control-plane readiness',
+                                                         tool: arguments.first)
+        false
+      rescue Empeira::ExecutionError
+        false
+      end
+
+      def http_probe?(arguments)
+        arguments.first == 'curl' && !arguments.include?('--write-out')
+      end
+
+      def check_http?(resource, arguments, expected)
+        result = @runtime.service_exec(resource, [*arguments[0...-1], '--include', arguments.last])
+        body = Server::HTTP.response(result)[:body]
+        return true if result.success? && (expected.nil? || body.strip == expected)
+
+        @failure = Server::HTTP.failure(result, url: arguments.last, operation: 'Probe control-plane readiness')
+        false
+      end
+
+      def proxy_ready?(resources)
+        arguments = %w[curl --silent --max-time 5 --noproxy localhost --proxy
+                       http://proxy.empeira.internal:3128 --output /dev/null --write-out]
+        # Squid's denial must be observable, even when no destination is allowed.
+        arguments.push('%{http_code}', 'http://empeira-denied.invalid/') # rubocop:disable Style/FormatStringToken
+        check(resources['server'], arguments, '403')
+      end
+
+      def dns_ready?(resources)
+        names = resources.keys.map { |key| @plan.naming.hostname(key) }
+        code = 'require "resolv"; ARGV.each { |name| Resolv.getaddress(name) }'
+        check(resources['server'], [RUBY, '-e', code, *names])
+      end
+    end
+  end
+end