empeira 0.1.0.pre.alpha.1

data/resources/nodes/runtime_proxy.rb

@@ -0,0 +1,244 @@
+# frozen_string_literal: true
+
+require 'json'
+require 'pathname'
+require 'tempfile'
+require 'fileutils'
+require 'strscan'
+require 'shellwords'
+
+module Empeira
+  # Executed with the installed agent Ruby in the owned guest, never on the host.
+  # rubocop:disable-next Metrics/ClassLength -- Standalone guest helper contains both native package-manager adapters.
+  class RuntimeProxyGuest
+    APT_PATH = '/etc/apt/apt.conf.d/90-empeira-proxy'
+    DNF_PATH = '/etc/dnf/dnf.conf'
+    PROFILE_PATH = '/etc/profile.d/90-empeira-proxy.sh'
+    BEGIN_MARKER = "# BEGIN EMPEIRA RUNTIME PROXY\n"
+    END_MARKER = "# END EMPEIRA RUNTIME PROXY\n"
+
+    def initialize(request, root: Pathname('/'))
+      @desired = request.fetch('desired')
+      @accepted = request.fetch('accepted')
+      @root = Pathname(root)
+    end
+
+    def reconcile
+      changed = reconcile_apt if path('/etc/apt').directory?
+      changed = reconcile_dnf || changed if path('/etc/dnf').directory?
+      reconcile_profile || !!changed
+    end
+
+    private
+
+    def profile_content(definition)
+      variables = %w[HTTP_PROXY HTTPS_PROXY http_proxy https_proxy].to_h { |key| [key, definition&.fetch('url') || ''] }
+      variables.merge!(%w[NO_PROXY no_proxy].to_h { |key| [key, definition&.fetch('no_proxy') || ''] })
+      variables.merge!('ALL_PROXY' => '', 'all_proxy' => '')
+      exports = variables.map do |key, value|
+        "export #{key}=#{Shellwords.escape(value)}\n"
+      end.join
+      "# Managed by Empeira: normal runtime proxy environment.\n#{exports}"
+    end
+
+    # rubocop:disable-next Naming/PredicateMethod -- Clear stale container image environment when disabled.
+    def reconcile_profile
+      target = path(PROFILE_PATH)
+      current = read(target)
+      content = profile_content(@desired)
+      if current && ![@desired, *@accepted, nil].map { |entry| profile_content(entry) }.include?(current)
+        raise 'Foreign or modified /etc/profile.d/90-empeira-proxy.sh; refusing to replace it'
+      end
+      return false if content == current
+
+      write(target, content)
+      true
+    end
+
+    def path(value)
+      @root.join(value.delete_prefix('/'))
+    end
+
+    def read(target)
+      target.parent.ascend do |parent|
+        raise "Unsafe proxy configuration parent: #{parent}" if parent.symlink?
+      end
+      stat = target.lstat
+      unless stat.file? && stat.nlink == 1 && stat.uid == Process.euid
+        raise "Unsafe or unowned proxy configuration: #{target}"
+      end
+
+      target.binread
+    rescue Errno::ENOENT
+      nil
+    end
+
+    def write(target, content, mode: 0o644)
+      FileUtils.mkdir_p(target.parent, mode: 0o755)
+      Tempfile.create('.empeira-proxy-', target.parent) do |file|
+        file.chmod(mode)
+        file.write(content)
+        file.flush
+        file.fsync
+        File.rename(file.path, target)
+      end
+    end
+
+    def apt_content(definition, foreign = {})
+      return unless definition
+
+      url = definition.fetch('url')
+      globals = "// Managed by Empeira: normal proxy, no bootstrap credentials.\n" \
+                "Acquire::http::Proxy \"#{url}\";\nAcquire::https::Proxy \"#{url}\";\n"
+      globals + direct_lines(definition).reject { |line| foreign.key?(line.split.first.downcase) }.join
+    end
+
+    def direct_lines(definition)
+      definition.fetch('direct').flat_map do |host|
+        %w[http https].map { |protocol| "Acquire::#{protocol}::Proxy::#{host} \"DIRECT\";\n" }
+      end
+    end
+
+    def owned_apt?(current, definition)
+      globals = apt_content(definition.merge('direct' => []))
+      return false unless current.start_with?(globals)
+
+      lines = current.delete_prefix(globals).lines
+      lines.uniq == lines && (lines - direct_lines(definition)).empty?
+    end
+
+    # rubocop:disable-next Naming/PredicateMethod -- Reconciliation mutates the APT fragment.
+    def reconcile_apt
+      target = path(APT_PATH)
+      current = read(target)
+      verify_apt_file(current)
+
+      foreign = @desired ? foreign_apt_settings(target) : {}
+      verify_apt_globals(foreign) if @desired
+      content = apt_content(@desired, foreign)
+      return false if content == current
+
+      content ? write(target, content) : target.unlink
+      true
+    end
+
+    def verify_apt_file(current)
+      return unless current
+      return if @accepted.any? { |entry| owned_apt?(current, entry) }
+
+      raise 'Foreign or modified /etc/apt/apt.conf.d/90-empeira-proxy; refusing to replace or remove it'
+    end
+
+    def foreign_apt_settings(target)
+      files = path('/etc/apt/apt.conf.d').glob('*') + [path('/etc/apt/apt.conf')]
+      files.each_with_object({}) do |file, settings|
+        next if file == target || !file.exist? || file.directory?
+
+        settings.merge!(apt_settings(read(file)).transform_keys(&:downcase))
+      end
+    end
+
+    def verify_apt_globals(settings)
+      settings.slice('acquire::http::proxy', 'acquire::https::proxy').each do |key, value|
+        next if [@desired.fetch('url'), "#{@desired.fetch('url')}/"].include?(value)
+
+        raise "Foreign APT #{key} conflicts with the normal Empeira proxy"
+      end
+    end
+
+    # Parse native flat and nested scopes; host-specific proxy/DIRECT keys remain untouched.
+    # rubocop:disable-next Metrics/AbcSize, Metrics/MethodLength, Metrics/CyclomaticComplexity, Metrics/PerceivedComplexity -- Parse flat and nested native APT scopes without evaluating configuration.
+    def apt_settings(content)
+      scanner = StringScanner.new(content)
+      scopes = []
+      statement = []
+      values = {}
+      until scanner.eos?
+        next if scanner.scan(%r{\s+|//[^\n]*|/\*.*?\*/|#(?!(?:include|clear)\b)[^\n]*}m)
+
+        token = scanner.scan(/"(?:\\.|[^"\\])*"|[^\s{};]+|[{};]/)
+        raise 'Cannot safely parse foreign APT configuration' unless token
+        raise 'Foreign APT #include/#clear requires explicit proxy configuration review' if token.start_with?('#')
+
+        case token
+        when '{' then scopes << statement.join('::')
+                      statement = []
+        when '}' then scopes.pop
+                      statement = []
+        when ';'
+          values[[*scopes, statement.first].compact.join('::')] =
+            statement.last&.delete_prefix('"')&.delete_suffix('"')
+          statement = []
+        else statement << token
+        end
+      end
+      values
+    end
+
+    def dnf_content(definition)
+      return '' unless definition
+
+      "#{BEGIN_MARKER}proxy=#{definition.fetch('url')}\n#{END_MARKER}"
+    end
+
+    # rubocop:disable-next Naming/PredicateMethod -- Reconciliation mutates the DNF main block.
+    def reconcile_dnf
+      target = path(DNF_PATH)
+      current = read(target)
+      raise 'Missing /etc/dnf/dnf.conf; refusing to initialize foreign configuration' unless current
+
+      block = current[/#{Regexp.escape(BEGIN_MARKER)}.*?#{Regexp.escape(END_MARKER)}/m]
+      verify_dnf_block(current, block)
+      foreign = block ? current.sub(block, '') : current
+      desired = dnf_content(@desired)
+      content = integrate_dnf(foreign, desired)
+      return false if current == content
+
+      write(target, content, mode: target.stat.mode & 0o777)
+      true
+    end
+
+    def verify_dnf_block(current, block)
+      return unless current.include?(BEGIN_MARKER) || current.include?(END_MARKER)
+      return if owned_dnf_block?(current, block)
+
+      raise 'Modified Empeira DNF proxy block; refusing to replace or remove it'
+    end
+
+    def owned_dnf_block?(current, block)
+      block && @accepted.map { |entry| dnf_content(entry) }.include?(block) &&
+        current.scan(BEGIN_MARKER).size == 1 && current.scan(END_MARKER).size == 1 &&
+        current.match?(/^\s*\[main\][^\n]*\n#{Regexp.escape(block)}/i)
+    end
+
+    def integrate_dnf(content, desired)
+      sections = content.split(/(?=^\s*\[)/)
+      main = sections.grep(/\A\s*\[main\]\s*\n/i)
+      raise 'DNF requires one unambiguous [main] section for normal proxy integration' unless main.size == 1
+
+      verify_dnf_proxy(main.first) if @desired
+      # Insert directly after the section header without changing any existing lines.
+      replacement = main.first.sub(/(\A\s*\[main\][^\n]*\n)/i) { "#{Regexp.last_match(1)}#{desired}" }
+      sections.map { |section| section.equal?(main.first) ? replacement : section }.join
+    end
+
+    def verify_dnf_proxy(section)
+      section.each_line do |line|
+        match = /^\s*proxy\s*=\s*(.*?)\s*$/i.match(line)
+        next unless match
+        next if match[1] == @desired.fetch('url')
+
+        raise 'Foreign DNF [main] proxy conflicts with the normal Empeira proxy; repository overrides are preserved'
+      end
+    end
+  end
+end
+
+if $PROGRAM_NAME == __FILE__
+  begin
+    puts JSON.generate('changed' => Empeira::RuntimeProxyGuest.new(JSON.parse(ARGV.fetch(0))).reconcile)
+  rescue StandardError => e
+    warn e.message
+    exit 1
+  end
+end

data/resources/nodes/ssh/proxy.rb

@@ -0,0 +1,16 @@
+# frozen_string_literal: true
+
+# OpenSSH ProxyCommand delegates only the byte transport to the central runner.
+require_relative '../../../lib/empeira'
+
+runtime, id, port = ARGV
+port ||= '22'
+unless Empeira::Runtime.registry.names.include?(runtime) && id&.match?(/\A[a-f0-9]{12,64}\z/) &&
+       port.match?(/\A[0-9]{1,5}\z/) && port.to_i.between?(1, 65_535) && ARGV.size <= 3
+  abort 'Invalid managed SSH transport'
+end
+result = Empeira::Execution::Runner.new.stream(runtime, arguments: [
+                                                 'exec', '--interactive', id, '/opt/puppetlabs/puppet/bin/ruby',
+                                                 '/usr/local/libexec/empeira-ssh-connect.rb', port
+                                               ])
+exit result.exit_status

data/resources/nodes/ssh/sshd_config

@@ -0,0 +1,15 @@
+Port 22
+AddressFamily inet
+PermitRootLogin prohibit-password
+PasswordAuthentication no
+KbdInteractiveAuthentication no
+PubkeyAuthentication yes
+AuthenticationMethods publickey
+AuthorizedKeysFile .ssh/authorized_keys
+UsePAM yes
+DisableForwarding yes
+PermitTunnel no
+X11Forwarding no
+PermitUserEnvironment no
+PrintMotd no
+Subsystem sftp internal-sftp

data/resources/nodes/ssh/start

@@ -0,0 +1,6 @@
+#!/bin/sh
+# Initialize disposable node host keys, then hand control to sshd or systemd.
+set -eu
+mkdir -p /run/sshd
+ssh-keygen -A
+exec "$@"

data/resources/proxy/Containerfile

@@ -0,0 +1,10 @@
+ARG EMPEIRA_BASE_UBUNTU=library/ubuntu@sha256:da6fc2be547864451aa253836dd926da33623312df4a9a243e35dc877c378a78
+FROM ${EMPEIRA_BASE_UBUNTU}
+ENV DEBIAN_FRONTEND=noninteractive
+RUN ["apt-get", "-o", "APT::Update::Error-Mode=any", "update"]
+RUN ["apt-get", "install", "--yes", "--no-install-recommends", "ca-certificates"]
+RUN ["sed", "-i", "/Types: deb/a Snapshot: yes", "/etc/apt/sources.list.d/ubuntu.sources"]
+RUN ["apt-get", "--snapshot", "20261001T000000Z", "-o", "APT::Update::Error-Mode=any", "update"]
+RUN ["apt-get", "--snapshot", "20261001T000000Z", "install", "--yes", "--no-install-recommends", "squid=7.2-2ubuntu2.2"]
+RUN ["apt-get", "clean"]
+USER proxy

data/resources/relay/Containerfile

@@ -0,0 +1,5 @@
+# Official Ruby 3.4.11 on Alpine 3.23; no package installation or project build context.
+ARG EMPEIRA_BASE_RUBY=library/ruby:3.4.11-alpine3.23
+FROM ${EMPEIRA_BASE_RUBY}
+USER 65534:65534
+ENTRYPOINT ["ruby"]

data/resources/relay/puppetdb.rb

@@ -0,0 +1,81 @@
+# frozen_string_literal: true
+
+require 'socket'
+require 'openssl'
+require 'resolv'
+require 'timeout'
+
+# Two fixed listeners for one backend. The TLS endpoint satisfies the PuppetDB
+# terminus; the isolated Empeira network is the security boundary.
+BACKEND = 'puppetdb-backend.empeira.internal'
+MAX_CONNECTIONS = 64
+tokens = Queue.new
+MAX_CONNECTIONS.times { tokens << true }
+context = OpenSSL::SSL::SSLContext.new
+context.cert = OpenSSL::X509::Certificate.new(File.read('/empeira-relay/cert.pem'))
+context.key = OpenSSL::PKey.read(File.read('/empeira-relay/key.pem'))
+context.verify_mode = OpenSSL::SSL::VERIFY_NONE
+listeners = { TCPServer.new('0.0.0.0', 8080) => false, TCPServer.new('0.0.0.0', 8081) => true }
+
+def backend_address
+  Resolv::DNS.open(nameserver: [ENV.fetch('EMPEIRA_DNS_IP')], search: [], ndots: 1) do |dns|
+    dns.timeouts = 2
+    dns.getresource(BACKEND, Resolv::DNS::Resource::IN::A).address.to_s
+  end
+end
+
+def respond(connection, status)
+  connection.write("HTTP/1.1 #{status}\r\nConnection: close\r\nContent-Length: 0\r\n\r\n")
+rescue IOError, SystemCallError
+  nil
+end
+
+def pump(source, destination)
+  loop { destination.write(source.readpartial(16_384)) }
+rescue EOFError
+  destination.close_write if destination.is_a?(TCPSocket)
+end
+
+# rubocop:disable-next Metrics/BlockLength -- Bounded bidirectional connection handling is kept together.
+loop do
+  IO.select(listeners.keys).first.each do |listener|
+    socket = listener.accept
+    begin
+      tokens.pop(true)
+    rescue ThreadError
+      respond(socket, '503 Service Unavailable') unless listeners.fetch(listener)
+      socket.close
+      next
+    end
+    Thread.new(socket, listeners.fetch(listener)) do |client, tls|
+      connection = nil
+      upstream = nil
+      sender = nil
+      begin
+        connection = tls ? OpenSSL::SSL::SSLSocket.new(client, context) : client
+        Timeout.timeout(5) { connection.accept } if tls
+        request = Timeout.timeout(10) { connection.gets("\n", 8192) }
+        unless request&.match?(%r{\A(?:GET|POST|PUT|DELETE|HEAD|OPTIONS|PATCH) /\S* HTTP/1\.[01]\r?\n\z})
+          respond(connection, '400 Bad Request')
+          next
+        end
+        upstream = Socket.tcp(backend_address, 8080, connect_timeout: 5)
+        upstream.write(request)
+        Timeout.timeout(120) do
+          sender = Thread.new { pump(connection, upstream) }
+          pump(upstream, connection)
+        end
+      rescue Timeout::Error
+        respond(connection, '504 Gateway Timeout') if connection && !upstream
+      rescue IOError, SystemCallError, Resolv::ResolvError, SocketError, OpenSSL::SSL::SSLError
+        respond(connection, '502 Bad Gateway') if connection && !upstream
+      ensure
+        sender&.kill&.join
+        upstream&.close
+        connection&.close
+        client.close unless client.closed?
+        tokens << true
+      end
+    end
+  end
+end

data/resources/relay/server_environment.rb

@@ -0,0 +1,10 @@
+# frozen_string_literal: true
+
+# SPDX-License-Identifier: AGPL-3.0-only
+
+require 'puppet'
+
+# Read native server settings without selecting an environment.conf override.
+Puppet.initialize_settings(ARGV)
+Puppet.settings.preferred_run_mode = :server
+print Puppet.settings.value(:environment_timeout)

data/resources/relay/server_start.sh

@@ -0,0 +1,41 @@
+#!/bin/sh
+set -eu
+
+# Keep the standard Puppet config read-only outside upstream ownership sweeps.
+stage_eyaml() {
+  for key in private_key public_key; do
+    source="/empeira-eyaml/${key}.pkcs7.pem"
+    destination="/etc/puppetlabs/puppet/eyaml/${key}.pkcs7.pem"
+    mode=0644
+    if [ "$key" = private_key ]; then mode=0600; fi
+    install -o puppet -g puppet -m "$mode" "$source" "${destination}.pending"
+    mv -f "${destination}.pending" "$destination"
+  done
+}
+
+if [ "${1:-}" = refresh-eyaml ]; then
+  stage_eyaml
+  exit 0
+fi
+
+upstream_entrypoint="$1"
+config_destination="$2"
+eyaml_mode="$3"
+puppetdb_mode="$4"
+shift 4
+# Use Puppet's own writer: retain every other setting in the configured confdir.
+# Environment-variable mappings are only supplementary image startup hints.
+confdir="${config_destination%/*}"
+/opt/puppetlabs/bin/puppet config set environment_timeout 0 --section server --confdir "$confdir"
+native_timeout=$(/opt/puppetlabs/puppet/bin/ruby /empeira-server/environment.rb --confdir "$confdir")
+if [ "$native_timeout" != 0 ]; then
+  echo "Native Puppetserver [server] environment_timeout is not 0 after configuration" >&2
+  exit 1
+fi
+if [ "$eyaml_mode" = staged ]; then
+  stage_eyaml
+fi
+if [ "$puppetdb_mode" = puppetdb ]; then
+  ln -sfn /empeira-server/puppetdb.conf "$config_destination"
+fi
+exec "$upstream_entrypoint" "$@"