empeira 0.1.0.pre.alpha.3 → 0.1.0.pre.alpha.6

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: c856b6d473f798e1882b261f6dec67a20ebaa89142a073ba9b977265cd24cd6f
-  data.tar.gz: ac23a47ef8ecf4abfdd8d48557cee762f5954e69c40c335b12e7d6428e376709
+  metadata.gz: 6a6bd2bd179b9a3fa789f2342e0646d9e5d681941cd2df234770cf8a94a01f31
+  data.tar.gz: 8925fd4ded29c7206cfe6c1d2d072f7a41a649582504dbf1a29232543525aacf
 SHA512:
-  metadata.gz: 30b50d1c33a73512fdd2067064e0f17b63dda84204045b90994137ec79ee8374c466501b232119ea2fff3b81f9dda39c62edd8fed47b5ee50a528f75f063dbf6
-  data.tar.gz: 8daa8af9f4f9bb5ffcc1751cf3c8714e6853142dd59878ba6791150b79511549b626cc3edd9eafc95e36adfed3b00f793e8f97d78a607ac6d29dd70865e91dc4
+  metadata.gz: 988ab09ce7e604a6bddfe1f5acad7f2847939b96e33ad6b73d06a03d49a6aafc7048222f5bb2a26eddb412dd75442b6d57addddd9558cb974a675603c11a1fb6
+  data.tar.gz: 6d5c737b4f18f0d400f279c59b0b10f7e68bb3b564c649b42207e0f447ba7b68a2acd93b34258ca7d025252d91de4c2befcfc741b85195f23a8b8feecaa99e46

data/README.md

@@ -6,7 +6,7 @@
 [![OpenVox E2E](https://img.shields.io/github/actions/workflow/status/c8m6/empeira/openvox.yml?branch=main&label=OpenVox%20E2E)](https://github.com/c8m6/empeira/actions/workflows/openvox.yml)
 [![Release](https://img.shields.io/github/v/release/c8m6/empeira?include_prereleases&sort=date&label=Release)](https://github.com/c8m6/empeira/releases)
 [![Ruby: 3.1–4.0](https://img.shields.io/badge/Ruby-3.1%20%7C%203.2%20%7C%203.3%20%7C%203.4%20%7C%204.0-CC342D)](docs/installation.md)
-[![License: AGPL-3.0-only](https://img.shields.io/badge/License-AGPL--3.0--only-blue)](LICENSE)
+[![License: AGPL-3.0-or-later](https://img.shields.io/badge/License-AGPL--3.0--or--later-blue)](LICENSE)
 
 **ἐμπειρία (empeiría)** — experience gained through practice. The name reflects
 learning about infrastructure by experimenting, testing and seeing what happens.
@@ -149,6 +149,6 @@ and [pull requests](https://github.com/c8m6/empeira/pulls) are welcome. Follow t
 [security policy](SECURITY.md).
 
 Project-owned code and documentation are licensed under
-[AGPL-3.0-only](LICENSE). Third-party packages and images retain their own licenses
+[AGPL-3.0-or-later](LICENSE). Third-party packages and images retain their own licenses
 and notices and are obtained from upstream; empeira does not bundle them or
 redistribute proprietary Puppet Enterprise software.

data/config/defaults.yaml

@@ -50,12 +50,18 @@ puppetdb:
       bootstrap_config: /etc/puppetlabs/puppetdb/bootstrap.cfg
       data: /opt/puppetlabs/server/data/puppetdb
 network:
-  egress: []
+  egress:
+    nodes: []
+    infrastructure: []
   redirects: []
 proxy:
-  enabled: false
-  global: []
-  rules: []
+  nodes:
+    enabled: false
+    global: []
+    rules: []
+  infrastructure:
+    enabled: false
+    allow: []
 vm:
   disk: 30
   interfaces: []

data/docs/addons.md

@@ -208,8 +208,12 @@ Array elements can be mappings, arrays or scalars. For example:
 
 ```yaml
 proxy:
-  enabled: true
-  global: [forge.puppet.com, github.com]
+  nodes:
+    enabled: true
+    global: [forge.puppet.com, github.com]
+  infrastructure:
+    enabled: false
+    allow: []
 server:
   mounts:
     - source: /home/user/data
@@ -217,10 +221,10 @@ server:
       readonly: true
 ```
 
-produces `EMPEIRA_CONFIG_PROXY_ENABLED=true`,
-`EMPEIRA_CONFIG_PROXY_GLOBAL_COUNT=2`,
-`EMPEIRA_CONFIG_PROXY_GLOBAL_0=forge.puppet.com`,
-`EMPEIRA_CONFIG_PROXY_GLOBAL_1=github.com`,
+produces `EMPEIRA_CONFIG_PROXY_NODES_ENABLED=true`,
+`EMPEIRA_CONFIG_PROXY_NODES_GLOBAL_COUNT=2`,
+`EMPEIRA_CONFIG_PROXY_NODES_GLOBAL_0=forge.puppet.com`,
+`EMPEIRA_CONFIG_PROXY_NODES_GLOBAL_1=github.com`,
 `EMPEIRA_CONFIG_SERVER_MOUNTS_COUNT=1`, and the variables
 `EMPEIRA_CONFIG_SERVER_MOUNTS_0_SOURCE`, `_TARGET`, `_READONLY`.
 

data/docs/architecture.md

@@ -184,9 +184,12 @@ there are no implicit database-major migrations or automatic node replacements.
 
 Managed servers disable environment caching through native Puppet configuration
 (`environment_timeout = 0` in `[server]`), applied by the startup wrapper before
-the configured image entrypoint. `up` checks the actual native setting and restarts
-only a server whose setting changed; it preserves every other configuration key
-and retained storage. The configured Puppet confdir must agree with Puppetserver
+the configured image entrypoint. An independent `environment.conf` copy in the
+managed environment enforces zero even when the control repository specifies
+`unlimited`; the original remains unchanged and read-only. `up` refreshes the copy,
+checks both native and selected-environment settings, and restarts only a server
+whose native setting changed. It preserves every other configuration key and
+retained storage. The configured Puppet confdir must agree with Puppetserver
 HOCON `master-conf-dir`. Catalog
 requests reload live code without repository hashes or environment-cache checkpoints.
 See [nodes](nodes.md#environment-cache-and-live-code).

data/docs/configuration.md

@@ -107,9 +107,15 @@ runtime:
 server:
   environment: production
 network:
-  egress: []
+  egress:
+    nodes: []
+    infrastructure: []
 proxy:
-  enabled: false
+  nodes:
+    enabled: false
+  infrastructure:
+    enabled: false
+    allow: []
 node_defaults:
   os: ubuntu
   version: "24.04"
@@ -150,11 +156,14 @@ release version. A partial project mapping may omit it and inherit the default.
 | `server.timeout` | Positive readiness timeout in seconds per component, `240` |
 | `server.mounts` | Additional server-only host bind mounts, `[]`; `source`, `target`, optional boolean `readonly` (default `true`) |
 | `puppetdb.memory` | Positive integer MiB, `768` |
-| `network.egress` | Direct TCP proxy-bypass host/port entries, `[]`; a project array replaces the default array |
+| `network.egress.nodes` | Node-only direct TCP host/port grants, `[]`; arrays replace |
+| `network.egress.infrastructure` | Infrastructure-only direct TCP host/port grants, `[]`; arrays replace |
 | `network.redirects` | Exact IPv4/protocol/port endpoints redirected to enabled internal services, `[]` |
-| `proxy.enabled` | Boolean, `false`; creates the normal HTTP/HTTPS policy proxy |
-| `proxy.global` | DNS destination array, `[]` |
-| `proxy.rules` | Additive hostname-glob rules with `hosts` and `allow` arrays, `[]` |
+| `proxy.nodes.enabled` | Boolean, `false`; enables normal node HTTP/HTTPS proxy access |
+| `proxy.nodes.global` | DNS destination array, `[]` |
+| `proxy.nodes.rules` | Additive node hostname-glob rules with `hosts` and `allow` arrays, `[]` |
+| `proxy.infrastructure.enabled` | Boolean, `false`; enables infrastructure HTTP/HTTPS proxy access |
+| `proxy.infrastructure.allow` | Independent infrastructure DNS destination array, `[]` |
 | `vm.disk` | New VM virtual disk capacity in GiB, integer `1`–`2048`, default `30`; must accommodate the base image |
 | `vm.interfaces` | VM-only hostname rules defining dummy/VLAN devices with explicit IPv4 CIDR host addresses, `[]` |
 | `vm.console.root_password` | Initial console password, `empeira`; a string overrides it and `null` disables it |
@@ -404,20 +413,25 @@ runtime values without inferring them from the image name. Missing or unsafe
 runtime fields fail configuration validation. Managed servers use
 `environment_timeout = 0` in the native `[server]` section. The startup wrapper
 uses `puppet config set` before the configured entrypoint, independently of image
-environment-variable mappings. Startup and `up` read Puppet's native server
-settings without selecting an environment override, against the
-confdir containing `server.runtime.paths.puppetdb_config`; custom Puppetserver
+environment-variable mappings. Empeira also prepares an independent copy of the
+project's `environment.conf` in its managed environment directory, replacing or
+adding only `environment_timeout = 0`. Other settings, including `modulepath` and
+`config_version`, are preserved. The original file and the control repository
+remain read-only in the server. The copy is refreshed during `up`, including when
+the project has no `environment.conf` or Hiera mounts.
+
+`up` verifies both the native server setting and the effective timeout for
+`server.environment`, against the confdir containing
+`server.runtime.paths.puppetdb_config`; custom Puppetserver
 `jruby-puppet.master-conf-dir` must refer to that same directory. Puppetserver
-HOCON master directories take precedence over Puppet CLI defaults. A changed
-effective timeout updates only that key and restarts the same owned server; an
+HOCON master directories take precedence over Puppet CLI defaults. Native setting
+drift updates only that key and restarts the same owned server; an
 entrypoint that overwrites it fails verification. CA, SSL and database storage
 are preserved. The next catalog request reloads live code without
-an Empeira content scan or admin API invalidation. An explicit `environment.conf`
-can override this server setting; keep its timeout at zero for immediate edits.
-Such overrides are preserved and do not prevent server startup or cause repeated
-restarts. `puppet config print environment_timeout --section server` includes the
-selected environment's override, so it can report `unlimited` while the native
-server setting is zero. Inspect both configuration layers when diagnosing caching.
+an Empeira content scan or admin API invalidation. A project timeout of `unlimited`
+therefore stays unchanged in the checkout while the managed server uses zero.
+To verify it, run `puppet config print environment_timeout --section server
+--environment ENVIRONMENT` inside the server with the configured environment name.
 
 `puppetdb.runtime` holds the independent OpenVoxDB process contract. Custom
 images may override its executable, numeric user, Java and main arguments,
@@ -483,14 +497,20 @@ The numeric gem packaging fallback is never used to bypass this check.
 ```yaml
 network:
   egress:
-    - host: api.example.com
-      ports: [443]
+    nodes:
+      - host: api.example.com
+        ports: [443]
+    infrastructure: []
 proxy:
-  enabled: true
-  global: [forgeapi.puppet.com]
-  rules:
-    - hosts: ["*-web-*"]
-      allow: [github.com, "*.github.com"]
+  nodes:
+    enabled: true
+    global: [forgeapi.puppet.com]
+    rules:
+      - hosts: ["*-web-*"]
+        allow: [github.com, "*.github.com"]
+  infrastructure:
+    enabled: false
+    allow: []
 hiera:
   mounts:
     - source: ../hieradata
@@ -502,7 +522,12 @@ vm:
     root_password: null
 ```
 
-When `proxy.enabled` is true, every node may use its matching destination policy.
+When `proxy.nodes.enabled` is true, every node may use its matching destination policy.
+Infrastructure access is separately controlled by `proxy.infrastructure.enabled`
+and `proxy.infrastructure.allow`; both scopes default to disabled. Disabled
+infrastructure has no configured proxy endpoint even when nodes use the proxy.
+Keep its direct-egress list empty for internal-only infrastructure. See the
+[migration instructions](proxy.md#migrating-shared-settings) for former shared keys.
 After bootstrap cleanup, Empeira reconciles normal proxy settings on running,
 provisioned nodes during `up` and `node start`. Repeated Puppet runs use the
 existing guest configuration. No
@@ -714,21 +739,24 @@ desired state; Puppet owns package state after the first catalog.
 
 ## Direct egress
 
-`network.egress` contains destination TCP grants, independent of HTTP/HTTPS proxy
-policy. Entries have exactly one `host` or IPv4 `ip` and a nonempty unique `ports`
+`network.egress.nodes` and `network.egress.infrastructure` contain separate
+destination TCP grants, independent of HTTP/HTTPS proxy policy. A node grant never
+applies to infrastructure or conversely. Entries have exactly one `host` or IPv4 `ip` and a nonempty unique `ports`
 array (1–65535). `up` resolves all A records and replaces the complete policy;
 resolution/apply failure blocks egress. IPv6 and external UDP grants are unsupported.
 
 ```yaml
 network:
   egress:
-    - host: repository.example.net
-      ports: [443]
-    - ip: 203.0.113.10
-      ports: [443, 8443]
+    nodes:
+      - host: repository.example.net
+        ports: [443]
+      - ip: 203.0.113.10
+        ports: [443, 8443]
+    infrastructure: []
 ```
 
-Named direct destinations enter generated `NO_PROXY`; applications choose DIRECT
+Direct destinations enter only their own scope's generated `NO_PROXY`; applications choose DIRECT
 or proxy themselves. See [networking](networking.md#one-gateway-one-direct-egress-policy)
 for routing, revocation and privilege boundaries.
 
@@ -760,7 +788,7 @@ vm:
           network: 192.0.2.20/32
 ```
 
-Patterns use the same `*`/`?` glob matcher as `proxy.rules`, against the full stored
+Patterns use the same `*`/`?` glob matcher as `proxy.nodes.rules`, against the full stored
 node hostname, case-insensitively. Patterns within a rule are alternatives. All
 matching rules contribute devices; identical definitions merge once. A conflicting
 definition names the hostname, device and both configuration paths. No match creates

data/docs/development.md

@@ -253,6 +253,7 @@ The APT authentication regression uses a local HTTPS repository with synthetic B
 credentials and an ephemeral GPG signing key. It checks the helper's effective
 `auth.conf.d` configuration, private file mode and exact credential bytes, then
 verifies metadata returns 401 before one interactive login and 200 after the retry.
+The fixture omits the 401 reason phrase to exercise APT's bare status/IP diagnostic.
 The selected package download must reuse that login and pass its SHA-256 check.
 It requires host `gpg`/`gpgconf` and a locally reachable container engine; helper and
 host TLS verification remain enabled. Run it explicitly for either engine:
@@ -511,9 +512,10 @@ Run `EMPEIRA_INTEGRATION=server-environment bundle exec rspec spec/integration/s
 to check native timeout 0, live edits, CA retention, PuppetDB and idempotent up
 under Docker/rootless Podman with the default server and a custom entrypoint
 that ignores timeout environment mapping.
-The same gate verifies startup and idempotent `up` with an explicit
-`environment.conf` timeout override, preserving the file and distinguishing its
-effective value from the native server setting.
+The same gate verifies that an explicit `environment.conf` timeout of `unlimited`
+is zero in the managed copy while the original stays unchanged. It edits a Ruby
+Puppet function between catalogs and checks the changed result without `up` or a
+restart, followed by an idempotent `up`.
 
 Run the isolated diagnostics/recovery gate with each native runtime:
 

data/docs/hiera-and-eyaml.md

@@ -105,7 +105,8 @@ An optional mount is not permission to ignore unsafe configuration.
 Puppet's [default modulepath](https://help.puppet.com/core/current/Content/PuppetCore/config_file_environment.htm)
 includes the environment's `modules` directory. Empeira checks explicit
 `environment.conf` modulepaths and reports a known exclusion before startup. It
-never rewrites that file. Expressions containing unresolved Puppet variables cannot
+never rewrites the original file. Its managed copy changes only
+`environment_timeout` to zero. Expressions containing unresolved Puppet variables cannot
 be verified completely from the CLI host; ensure the effective server modulepath
 includes the mount destination. Environment mounts can be referenced by ordinary
 relative paths in `hiera.yaml`, such as `data/external` or `external` when the datadir
@@ -117,7 +118,8 @@ an image rebuild, `up`, or a service restart.
 Empeira neither copies their data nor writes probe files into them. It uses a managed
 environment directory containing links to the read-only control repository so nested
 mount targets can exist without modifying control code. Existing control files and
-linked directories remain live. `up` refreshes links for new control entries under
+linked directories remain live; `environment.conf` is an independent copy refreshed
+by `up`. `up` also refreshes links for new top-level control entries and entries under
 projected ancestor directories. EYAML keys remain configured separately in `eyaml`,
 and decryption runs on the server.
 
@@ -205,8 +207,8 @@ The obsolete `images.modules` key is rejected.
 The disposable installer belongs to the update plane. It uses the selected
 runtime's normal bridge network (`bridge` on Docker, `podman` on Podman), with
 normal runtime DNS and external connectivity. It never joins an Empeira workspace
-network and needs neither CoreDNS nor Squid. Workspace `network.egress`, `proxy.enabled`,
-`proxy.global` and `proxy.rules` do not affect
+network and needs neither CoreDNS nor Squid. Workspace `network.egress`, `proxy.nodes.enabled`,
+`proxy.nodes.global` and `proxy.nodes.rules` do not affect
 Forge or Git acquisition. Supplied `HTTP_PROXY`, `HTTPS_PROXY`, `NO_PROXY` and their
 lowercase equivalents are inherited unchanged; Empeira generates no proxy URL.
 The host/runtime's normal network and corporate-proxy configuration must permit

data/docs/networking.md

@@ -102,17 +102,26 @@ Every peer uses the owned gateway as its IPv4 default route. Only the gateway ha
 an external uplink; DNS, proxies, server, database and nodes stay isolated.
 The fixed browser UI relay has a separate loopback access path with forwarding off.
 
-`network.egress` grants destination IPv4/TCP-port pairs:
+`network.egress.nodes` and `network.egress.infrastructure` grant destination
+IPv4/TCP-port pairs independently:
 
 ```yaml
 network:
   egress:
-    - host: repository.example.net
-      ports: [443]
-    - ip: 203.0.113.10
-      ports: [443, 8443]
+    nodes:
+      - host: repository.example.net
+        ports: [443]
+      - ip: 203.0.113.10
+        ports: [443, 8443]
+    infrastructure: []
 ```
 
+The gateway restricts node grants to the reserved VM/container node address ranges
+and infrastructure grants to its separate runtime allocation pool. Both directions
+of direct connections are source-bound. The shared workspace subnet is never used
+as a blanket source for direct grants. Custom gateway images must advertise
+`scoped-egress-v1`; an older image fails closed before receiving external access.
+
 Entries have exactly one `host` or `ip`. Hostnames match exactly, without wildcards;
 `up` resolves every current A record and replaces the complete policy. IP selectors
 bypass DNS and may intentionally permit private LAN/VPN destinations. A different
@@ -128,9 +137,9 @@ CoreDNS alone receives TCP/UDP 53 to its selected resolvers. Proxies alone recei
 TCP 80/443 and enforce their destination allowlists. Normal proxy allow rules apply
 regardless of target IP range; the temporary authenticated bootstrap proxy retains
 its separate private/reserved-address restrictions.
-`proxy.global` does not grant direct egress. Applications choose DIRECT/proxy using
+`proxy.nodes.global` does not grant direct egress. Applications choose DIRECT/proxy using
 their own settings and `NO_PROXY`; direct/proxy selection has no automatic fallback.
-Both explicit hostnames and IPv4 selectors from `network.egress` are included in
+Both explicit hostnames and IPv4 selectors are included only in their own scope's
 normal proxy bypass settings. The gateway still permits only their configured TCP ports.
 See [proxy policy](proxy.md) for hostname rules and bootstrap destinations.
 

data/docs/nodes.md

@@ -87,18 +87,22 @@ Managed servers enforce native `[server] environment_timeout = 0` before startup
 and verify the effective setting during `up`, independently of image environment
 variable support. Existing workspaces adopt it on
 their next `up`; run that once after updating from a version that enabled caching.
+Adopting the managed environment copy changes the server mount and recreates its
+container once, retaining CA, SSL and database storage.
 Each catalog request reloads live control code, modules and mounted Hiera data.
 Empeira does not hash these trees,
 persist content checkpoints or call the environment-cache admin API. Code edits
 need neither `up` nor a server restart, including for agents invoked manually.
 Empeira does not enable `use_cached_catalog`.
 
-A repository's own `environment.conf` can override the server timeout; use zero
-for immediate edits. Avoid concurrent edits during a catalog run. Existing files
-and directories in projected environments stay live through read-only links.
-New siblings under ancestors projected for nested Hiera mounts require `up` to
-create their links. `node start` resumes the node without invoking Puppet; Puppet
-services enabled by a catalog may run independently on startup.
+Empeira copies `environment.conf` into its managed environment and sets its timeout
+to zero there, preserving all other settings and the original file. Run `up` to
+refresh this copy after editing other environment settings. Avoid concurrent edits
+during a catalog run. Existing files and directories stay live through read-only
+links. New top-level entries and new siblings under ancestors projected for nested
+Hiera mounts require `up` to create their links. `node start` resumes the node
+without invoking Puppet; Puppet services enabled by a catalog may run independently
+on startup.
 
 ## Distribution package sources
 

data/docs/proxy.md

@@ -1,19 +1,23 @@
 # Proxy policy
 
-Normal external HTTP/HTTPS access stays behind Squid. Enabling the workspace proxy
-makes it available to every node; global and hostname rules remain the destination
-allowlist:
+Normal external HTTP/HTTPS access stays behind Squid. Nodes and infrastructure
+have independent switches and destination lists, both disabled by default. Enabling
+the node scope makes its global and hostname rules available to nodes:
 
 ```yaml
 proxy:
-  enabled: true
-  global:
-    - forgeapi.puppet.com
-  rules:
-    - hosts: ["lab-*"]
-      allow: ["*.github.com"]
-    - hosts: ["*-web-*"]
-      allow: [github.com, nginx.org]
+  nodes:
+    enabled: true
+    global:
+      - forgeapi.puppet.com
+    rules:
+      - hosts: ["lab-*"]
+        allow: ["*.github.com"]
+      - hosts: ["*-web-*"]
+        allow: [github.com, nginx.org]
+  infrastructure:
+    enabled: false
+    allow: []
 ```
 
 ```console
@@ -46,7 +50,7 @@ infrastructure has already been reconciled.
 
 ## Matching and destinations
 
-Defaults are `proxy.global: []` and `proxy.rules: []`. Every node receives
+Defaults are `proxy.nodes.global: []` and `proxy.nodes.rules: []`. Every node receives
 all global destinations plus `allow` from **every** matching rule. Duplicate entries
 are removed while preserving configuration order. A rule matches when any of its
 `hosts` patterns matches the complete lowercase hostname. Patterns must be lowercase.
@@ -66,14 +70,14 @@ Destination rules are separate from hostname globs:
 Only HTTP port 80 and HTTPS CONNECT port 443 are allowed. Allowed DNS destinations
 are reachable regardless of their target IP range, including private, loopback,
 link-local and reserved addresses. Domains without a matching allow rule remain
-denied. There is no TLS interception. Server-side outbound traffic gets
-`proxy.global` only; node hostname rules do not expand server access.
+denied. There is no TLS interception. Node destinations never grant infrastructure
+access, and infrastructure destinations never grant node access.
 
 ## Node policy and reconciliation
 
-When `proxy.enabled` is true, all nodes are authorized as proxy clients. Nodes get
+When `proxy.nodes.enabled` is true, all nodes are authorized as proxy clients. Nodes get
 upper/lowercase proxy variables and internal `NO_PROXY` entries, including explicitly
-configured `network.egress` hosts. Those named hosts use the common workspace
+configured `network.egress.nodes` hosts. Those named hosts use the common workspace
 gateway for their configured ports. VM access uses the same destination policy bound
 directly to the VM instance's reserved peer address. The proxy is reached at
 `proxy.empeira.internal:3128` on the isolated network. A request without a matching
@@ -90,17 +94,56 @@ Container and VM nodes consume the new policy without a restart; open proxy
 connections can end during reconciliation. Enabling/disabling proxy mode is a
 separate topology change and may require explicit node cleanup as reported by `up`.
 
-Changing direct-egress destinations also changes the server's `NO_PROXY`
-environment. `up` replaces a server whose environment definition changes while
+Changing `network.egress.infrastructure` destinations also changes infrastructure
+`NO_PROXY`. Changing node destinations does not change the server environment. `up` replaces a server whose environment definition changes while
 retaining CA storage and node identities. Changing only destination ports or
 transparent redirect rules preserves the server when its definition is unchanged.
 
+## Infrastructure policy
+
+`proxy.infrastructure.enabled` controls the Puppet/OpenVox server, PostgreSQL,
+PuppetDB backend/relay and `containers.additional` services. Its independent
+`allow` list uses the same exact-domain and domain-family syntax as node grants.
+The browser, DNS, Squid and gateway transports do not receive these application
+proxy settings.
+
+```yaml
+proxy:
+  infrastructure:
+    enabled: true
+    allow: [api.example.net]
+```
+
+When disabled, infrastructure definitions contain empty proxy values, overriding
+any image defaults. They contain no configured proxy endpoint and receive no Squid
+client grants, even if the node proxy is enabled. No startup wrapper removes an
+otherwise configured proxy. Internal names and mocks remain directly reachable.
+When enabled, only infrastructure's own direct destinations enter its `NO_PROXY`.
+Explicit environment settings in additional-service definitions remain application
+configuration; they do not add Squid permissions.
+
+`up` creates the shared normal proxy when either scope is enabled and removes it
+when both are disabled. Changing infrastructure's switch updates affected service
+definitions while retaining storage and node identities. Allowlist-only edits reload
+Squid without replacing unrelated services. Direct grants remain independent of
+both proxy switches; keep `network.egress.infrastructure: []` for internal-only
+infrastructure.
+
+## Migrating shared settings
+
+The former `proxy.enabled`, `proxy.global` and `proxy.rules` keys are rejected with
+a migration diagnostic. Move them under `proxy.nodes`; configure infrastructure
+explicitly with its own switch and `allow` list. Old shared `network.egress` arrays
+and legacy `mode` values are also rejected. Move grants to `network.egress.nodes`
+or `network.egress.infrastructure` according to the intended clients. No existing
+grant is silently copied to infrastructure.
+
 ## Managed bootstrap
 
 Managed bootstrap destinations are separate from normal user policy. Reviewed
 agent and distribution endpoints in `agent.install` and `bootstrap.guests` allow
 Puppet/OpenVox and required guest packages to be installed without duplicating them
-in `proxy.global`. The temporary authenticated bootstrap proxy uses workspace DNS
+in `proxy.nodes.global`. The temporary authenticated bootstrap proxy uses workspace DNS
 and retains its private, loopback, link-local and reserved destination-address
 restrictions independently of normal proxy policy. Its credential is not stored in
 the guest seed, JSON inventory or logs. A /32 source ACL admits only the provisioning

data/docs/troubleshooting.md

@@ -33,6 +33,14 @@ HTTP 403 does not trigger login, and HTTP 407 identifies proxy authentication. R
 authentication continues to use native `docker login` / `podman login` and the reported
 registry host; Empeira does not log into registries automatically.
 
+APT can report an HTTP status without a reason phrase, for example
+`401 [IP: 192.0.2.1 443]`. This still triggers the single repository login attempt
+when no ENV credentials are set and both standard input and standard error are
+connected to a TTY. The corresponding `403` and `407` forms retain their access-denied
+and proxy-authentication diagnoses without prompting. A node retained as `incomplete`
+after an acquisition failure must be destroyed with `empeira node destroy HOSTNAME`
+and recreated with the original `empeira node run` arguments after resolving the cause.
+
 APT helper credentials use literal `login` and `password` tokens in a temporary
 0600 file under `/etc/apt/auth.conf.d`. APT treats surrounding quotes and added
 backslashes as credential bytes, so Empeira does not add them. A successful login
@@ -124,7 +132,7 @@ or restart of that same VM conflicts with the shared instance guard: detach with
 ## Proxy destination denied
 
 Run `empeira proxy show HOSTNAME` and check every matching rule. Verify the node
-exists in the workspace, `proxy.enabled` is true, and `up` has reconciled the
+exists in the workspace, `proxy.nodes.enabled` is true, and `up` has reconciled the
 configuration and current node addresses. Allowed DNS destinations may resolve to
 private or reserved IP addresses; only HTTP port 80 and HTTPS CONNECT port 443 are
 permitted. After updating Empeira, run `empeira up` to replace a proxy still using
@@ -140,11 +148,14 @@ problem. A successful probe with different directory listings indicates a
 different engine view of the source. Empeira does not weaken mount checks or
 change host permissions automatically.
 
-An explicit `environment_timeout` in the project's `environment.conf` overrides
-the native server setting. Empeira preserves it. Bare `puppet config print`
-includes that override; server startup and reconciliation verify only the native
-server value. Set the environment override to zero or remove it when immediate
-code reloads are required. No explicit cache invalidation is performed.
+Empeira enforces `environment_timeout = 0` in both the native server setting and
+its independent copy of `environment.conf`. The project's original file remains
+unchanged, even when it specifies `unlimited`. Run `up` after updating Empeira or
+editing other settings in `environment.conf` to refresh the managed copy. Inside
+the server, `puppet config print environment_timeout --section server --environment
+ENVIRONMENT` must report `0` for the configured environment. A different value
+fails startup verification; check the custom server's confdir and environmentpath.
+No explicit cache invalidation is performed.
 
 `config show` includes `effective_hiera_mounts`. A skipped optional source is
 reported during `up`; mount it locally or correct the source path, then run `up`
@@ -356,6 +367,6 @@ external runtime network as a workaround. Docker workspace bridge attachment
 errors require an accessible Linux-engine host namespace and an identifiable
 iptables backend. The helper changes only owned bridge rules. Do not disable the
 host firewall globally. Check Docker Desktop host-network restrictions separately.
-Proxy errors require checking Squid source bindings and `proxy.global`/`proxy.rules`,
+Proxy errors require checking Squid source bindings and `proxy.nodes.global`/`proxy.nodes.rules`,
 not adding unrelated direct grants. Corporate DNS still follows host discovery;
 IPv6-only upstreams must be replaced with reachable IPv4 resolvers for this backend.

data/lib/empeira/agent/native_commands.rb

@@ -39,11 +39,11 @@ module Empeira
         diagnostic = Execution::Diagnostics.native(result.with(stderr: text, stdout: ''),
                                                    operation: "Agent #{operation}", tool: arguments.first)
         case text
-        when /407\s+Proxy Authentication Required|(?:HTTP|Status code|HTTP code)\s*:?\s*407\b/i
+        when /407\s+Proxy Authentication Required|(?:HTTP|Status code|HTTP code)\s*:?\s*407\b|\b407[ \t]+\[IP:/i
           raise Error, "Host helper proxy authentication failed\n#{diagnostic}", cause: nil
-        when /401\s+Unauthorized|(?:HTTP|Status code|HTTP code)\s*:?\s*401\b/i
+        when /401\s+Unauthorized|(?:HTTP|Status code|HTTP code)\s*:?\s*401\b|\b401[ \t]+\[IP:/i
           raise Agent::AuthenticationRequired, diagnostic, cause: nil
-        when /403\s+Forbidden|(?:HTTP|Status code|HTTP code)\s*:?\s*403\b/i
+        when /403\s+Forbidden|(?:HTTP|Status code|HTTP code)\s*:?\s*403\b|\b403[ \t]+\[IP:/i
           raise Error, "Agent repository access denied\n#{diagnostic}", cause: nil
         end
         raise Error, "Agent #{operation} failed\n#{diagnostic}", cause: nil

data/lib/empeira/build.json

@@ -1,5 +1,5 @@
 {
-  "version": "0.1.0-alpha.3",
-  "revision": "bfada39f711fd74dae3f061f80e1c5293bd13eec",
-  "build_time": "2026-10-15T13:10:56Z"
+  "version": "0.1.0-alpha.6",
+  "revision": "398c47f3abc571dd3c6668f62399eb624b465019",
+  "build_time": "2026-10-23T07:29:14Z"
 }

data/lib/empeira/cli/proxy.rb

@@ -5,7 +5,7 @@ module Empeira
     class Proxy < Base
       desc 'show HOSTNAME', 'Explain the normal proxy destination policy for a hostname'
       def show(hostname)
-        config = application.context.configuration.fetch('proxy')
+        config = application.context.configuration.dig('proxy', 'nodes')
         resolver = Network::HostPolicy.new(config)
         say "Effective proxy policy for #{hostname.downcase}"
         say access_message(config)
@@ -19,7 +19,7 @@ module Empeira
           return "All workspace nodes may use this policy after 'empeira up' reconciles the proxy." if
             config.fetch('enabled')
 
-          'The normal workspace proxy is disabled.'
+          'The normal node proxy is disabled.'
         end
 
         def display_matches(rules)

data/lib/empeira/configuration/schema.rb

@@ -20,8 +20,10 @@ module Empeira
                       'environment' => :environment,
                       'memory' => :positive_integer, 'cpus' => :positive_integer, 'timeout' => :positive_integer },
         'puppetdb' => { 'enabled' => :boolean, 'memory' => :positive_integer, 'runtime' => :puppetdb_runtime },
-        'network' => { 'egress' => :network_egress, 'redirects' => :network_redirects },
-        'proxy' => { 'enabled' => :boolean, 'global' => :allowlist, 'rules' => :proxy_rules },
+        'network' => { 'egress' => { 'nodes' => :network_egress, 'infrastructure' => :network_egress },
+                       'redirects' => :network_redirects },
+        'proxy' => { 'nodes' => { 'enabled' => :boolean, 'global' => :allowlist, 'rules' => :proxy_rules },
+                     'infrastructure' => { 'enabled' => :boolean, 'allow' => :allowlist } },
         'vm' => { 'disk' => :vm_disk, 'interfaces' => :vm_interfaces,
                   'console' => { 'root_password' => :optional_string } },
         'dns' => { 'upstream' => { 'mode' => :dns_mode, 'servers' => :dns_servers },
@@ -116,12 +118,35 @@ module Empeira
       end
 
       def validate_fragment!(data)
+        validate_scope_migration!(data)
         validate_mapping!(data, RULES, [])
         data
       end
 
       private
 
+      def validate_scope_migration!(data)
+        return unless data.is_a?(Hash)
+
+        validate_proxy_scope_migration!(data['proxy'])
+        network = data['network']
+        validate_egress_scope_migration!(network['egress']) if network.is_a?(Hash)
+      end
+
+      def validate_proxy_scope_migration!(proxy)
+        return unless proxy.is_a?(Hash) && proxy.keys.intersect?(%w[enabled global rules])
+
+        raise ConfigurationError, 'Shared proxy settings have moved to proxy.nodes; configure ' \
+                                  'proxy.infrastructure separately'
+      end
+
+      def validate_egress_scope_migration!(egress)
+        return unless egress.is_a?(Array) || (egress.is_a?(Hash) && egress.key?('mode'))
+
+        raise ConfigurationError, 'Shared network.egress grants must be moved explicitly to ' \
+                                  'network.egress.nodes or network.egress.infrastructure'
+      end
+
       def validate_operational!(data)
         validate_images!(data.fetch('images'))
         NodeImages.effective!(data.fetch('images'))

data/lib/empeira/control_plane/controller.rb

@@ -254,8 +254,10 @@ module Empeira
       end
 
       def resolve_direct_egress
-        config = @plan.config.dig('network', 'egress')
-        @direct_resolver.resolve(config)
+        entries = @plan.config.dig('network', 'egress').flat_map do |scope, grants|
+          @direct_resolver.resolve(grants).entries.map { |entry| entry.merge('scope' => scope) }
+        end
+        Network::DirectEgress::Resolved.new(entries)
       end
 
       def bootstrap_dns?(upstreams:, routes:)
@@ -350,10 +352,11 @@ module Empeira
 
       def reconcile_server_environment
         environment = Server::EnvironmentConfiguration.new(runtime: @runtime, plan: @plan)
-        return unless environment.reconcile(@observed.fetch('server'))
+        if environment.reconcile(@observed.fetch('server'))
+          @changed = true
+          @health.wait('server', @observed)
+        end
 
-        @changed = true
-        @health.wait('server', @observed)
         environment.verify!(@observed.fetch('server'))
       end
 
@@ -635,6 +638,7 @@ module Empeira
         end
         reconcile('gateway')
         lockdown_gateway(@observed.fetch('gateway'))
+        require_scoped_egress_capability
         require_redirect_capability
         attach_gateway('gateway')
         apply_gateway_policy
@@ -667,6 +671,16 @@ module Empeira
                      'images.direct_egress image'
       end
 
+      def require_scoped_egress_capability
+        return if @gateway_plan.fetch('entries').empty?
+
+        result = @runtime.service_exec(@observed.fetch('gateway'),
+                                       [Network::Gateway::EXECUTABLE, 'scoped-egress-capability'])
+        return if result.success? && result.stdout.strip == 'scoped-egress-v1'
+
+        raise Error, 'Gateway does not support scoped direct egress; configure a compatible images.direct_egress image'
+      end
+
       def apply_gateway_policy
         # An uncertain apply must force fresh lockdown during failure recovery.
         @gateway_locked_id = nil

data/lib/empeira/control_plane/environment.rb

@@ -9,7 +9,7 @@ module Empeira
       def initialize(context:, hiera:)
         @project = context.project.path
         @root = root(context)
-        @targets = mount_targets(hiera)
+        @targets = ['environment.conf', *mount_targets(hiera)]
         @modules = Modules::Storage.new(context: context).root if @project.join('Puppetfile').file?
         @targets |= ['modules'] if @modules
         @base = context.locations.workspace(context.workspace).join('environments')
@@ -17,14 +17,11 @@ module Empeira
       end
 
       def mounts
-        return [bind(@project, @root)] if @targets.empty?
-
         [bind(@project, CONTROL), bind(@directory, @root),
          *(@modules ? [bind(@modules, "#{@root}/modules")] : [])]
       end
 
       def prepare
-        return if @targets.empty?
         raise Error, 'Managed environment directory must not be a symlink' if @directory.symlink?
 
         FileUtils.mkdir_p(@directory, mode: 0o755)
@@ -81,13 +78,36 @@ module Empeira
       end
 
       def create_entry(relative, destination)
-        if @targets.any? { |target| target == relative || target.start_with?("#{relative}/") }
+        if relative == 'environment.conf'
+          prepare_configuration(destination)
+        elsif @targets.any? { |target| target == relative || target.start_with?("#{relative}/") }
           create_target(relative, destination)
         else
           create_link(relative, destination)
         end
       end
 
+      def prepare_configuration(destination)
+        content = environment_configuration
+        return if !destination.symlink? && destination.file? && destination.binread == content
+
+        Tempfile.create('environment-', @directory) do |file|
+          file.chmod(0o644)
+          file.write(content)
+          file.flush
+          File.rename(file.path, destination)
+        end
+      end
+
+      def environment_configuration
+        source = @project.join('environment.conf')
+        content = source.exist? ? source.binread : ''
+        content = content.gsub(/^[ \t]*environment_timeout[ \t]*=[^\r\n]*/, 'environment_timeout = 0')
+        content += "\n" unless content.empty? || content.end_with?("\n")
+        content += "environment_timeout = 0\n" unless content.match?(/^environment_timeout = 0\r?$/)
+        content
+      end
+
       def create_target(relative, destination)
         raise Error, 'Managed environment destination is unsafe' if destination.symlink?
 

data/lib/empeira/control_plane/files.rb

@@ -116,10 +116,7 @@ module Empeira
         bindings = Network::ProxyBindings.new(context: @context, resources: resources, network: network, nodes: nodes)
         # The workspace parent is private; Squid's mapped service user must read the bind mount.
         rules_changed = write('proxy-rules.conf', bindings.configuration)
-        allowed = proxy_allowed(nodes)
-        addresses = resources.slice(*allowed).values.filter_map do |resource|
-          resource&.dig('networks', network, 'IPAddress')
-        end
+        addresses = bindings.addresses
         clients_changed = write('proxy-clients', "#{(['127.0.0.1/32'] + addresses.reject(&:empty?).sort).join("\n")}\n")
         rules_changed || clients_changed
       end
@@ -131,10 +128,6 @@ module Empeira
         Infrastructure::Definition.fingerprint(content)
       end
 
-      def proxy_allowed(nodes)
-        ['server', *nodes.keys]
-      end
-
       private
 
       def corefile_content(upstreams:, routes:, bootstrap: false)

data/lib/empeira/control_plane/plan.rb

@@ -27,8 +27,7 @@ module Empeira
       end
 
       def proxy?
-        egress = config.dig('network', 'egress')
-        config.dig('proxy', 'enabled') || (egress.is_a?(Hash) && egress['mode'] == 'proxy')
+        %w[nodes infrastructure].any? { |scope| config.dig('proxy', scope, 'enabled') }
       end
 
       def database?
@@ -63,7 +62,7 @@ module Empeira
       def additional_services(common = {})
         config.dig('containers', 'additional').each_with_index.to_h do |entry, index|
           options = { image: image_reference(entry.fetch('image')), memory: 256,
-                      environment: proxy_environment_for('').merge(entry.fetch('environment', {})),
+                      environment: infrastructure_proxy_environment.merge(entry.fetch('environment', {})),
                       command: entry.fetch('command', []) }
           location = "containers.additional[#{index}].configuration"
           generated = additional_configurations.options(entry, mounts: common.fetch(:mounts, []), location: location)
@@ -175,9 +174,9 @@ module Empeira
       end
 
       def node_proxy_environment
-        return {} unless proxy?
+        return {} unless config.dig('proxy', 'nodes', 'enabled')
 
-        proxy_environment_for("http://#{naming.hostname('proxy')}:3128")
+        proxy_environment_for("http://#{naming.hostname('proxy')}:3128", scope: 'nodes')
       end
 
       private
@@ -209,9 +208,10 @@ module Empeira
       def database_services(common)
         return {} unless database?
 
-        { 'postgres' => service('postgres', **common, **postgres),
-          'puppetdb-backend' => service('puppetdb-backend', **common, **puppetdb),
-          'puppetdb' => service('puppetdb', **common, **puppetdb_relay(dns: common[:dns])) }
+        options = common.merge(environment: infrastructure_proxy_environment)
+        { 'postgres' => service('postgres', **options, **postgres),
+          'puppetdb-backend' => service('puppetdb-backend', **options, **puppetdb),
+          'puppetdb' => service('puppetdb', **options, **puppetdb_relay(dns: common[:dns])) }
       end
 
       def server
@@ -271,15 +271,16 @@ module Empeira
           reports: database? ? 'puppetdb' : 'log',
           # Upstream entrypoints otherwise rewrite puppetdb.conf from their default URL.
           puppetdb_server_urls: ''
-        ).merge(proxy_environment)
+        ).merge(infrastructure_proxy_environment)
       end
 
-      def proxy_environment
-        proxy_environment_for(proxy? ? "http://#{naming.hostname('proxy')}:3128" : '')
+      def infrastructure_proxy_environment
+        enabled = config.dig('proxy', 'infrastructure', 'enabled')
+        proxy_environment_for(enabled ? "http://#{naming.hostname('proxy')}:3128" : '', scope: 'infrastructure')
       end
 
-      def proxy_environment_for(url)
-        bypass = Network::DirectEgress.destinations(config.dig('network', 'egress'))
+      def proxy_environment_for(url, scope:)
+        bypass = Network::DirectEgress.destinations(config.dig('network', 'egress', scope))
         no_proxy = naming.no_proxy(bypass)
         { 'http_proxy' => url, 'https_proxy' => url, 'HTTP_PROXY' => url, 'HTTPS_PROXY' => url,
           'all_proxy' => '', 'ALL_PROXY' => '', 'no_proxy' => no_proxy, 'NO_PROXY' => no_proxy }
@@ -289,7 +290,8 @@ module Empeira
         { image: image_reference(config.dig('images', 'postgres')), memory: 256,
           env_file: files.secret_path,
           configuration: files.configuration.fetch('database-setup.sql'),
-          environment: { 'POSTGRES_USER' => 'postgres', 'POSTGRES_DB' => 'puppetdb' },
+          environment: infrastructure_proxy_environment.merge('POSTGRES_USER' => 'postgres',
+                                                              'POSTGRES_DB' => 'puppetdb'),
           mounts: [storage('postgres-data', '/var/lib/postgresql/data'),
                    bind(files.path('database-setup.sql'), '/empeira/setup.sql')],
           command: ['postgres', '-c', 'shared_buffers=64MB', '-c', 'max_connections=50'] }

data/lib/empeira/network/direct_egress.rb

@@ -24,7 +24,6 @@ module Empeira
       module_function
 
       def validate!(value, path = 'network.egress')
-        return legacy!(value, path) if value.is_a?(Hash)
         unless value.is_a?(Array) && value.size <= MAX_HOSTS
           raise ConfigurationError, "#{path} must be an array with at most #{MAX_HOSTS} destination entries"
         end
@@ -33,12 +32,6 @@ module Empeira
         raise ConfigurationError, "#{path} contains duplicate destinations" unless hosts.uniq.size == hosts.size
       end
 
-      def legacy!(value, path)
-        return if value.keys == ['mode'] && %w[none proxy].include?(value['mode'])
-
-        raise ConfigurationError, "#{path} must be a host array (legacy mode accepts only none or proxy)"
-      end
-
       def destinations(value)
         return [] unless value.is_a?(Array)
 

data/lib/empeira/network/gateway.rb

@@ -22,7 +22,15 @@ module Empeira
         { 'version' => 1, 'subnet' => subnet, 'gateway' => address(subnet),
           'dns' => address(subnet, 'dns'), 'resolvers' => resolvers,
           'proxies' => %w[proxy bootstrap-proxy].map { |key| address(subnet, key) },
-          'blocked' => blocked_addresses(state), 'entries' => resolved.entries, 'redirects' => redirects }
+          'blocked' => blocked_addresses(state), 'entries' => scoped_entries(resolved, subnet),
+          'redirects' => redirects }
+      end
+
+      def self.scoped_entries(resolved, subnet)
+        layout = Peer::Layout.new(subnet)
+        resolved.entries.map do |entry|
+          entry.except('scope').merge('sources' => layout.egress_sources(entry.fetch('scope')))
+        end
       end
 
       def self.blocked_addresses(state)

data/lib/empeira/network/host_policy.rb

@@ -3,7 +3,7 @@
 module Empeira
   module Network
     class HostPolicy
-      def self.validate!(rules, path = 'proxy.rules')
+      def self.validate!(rules, path = 'proxy.nodes.rules')
         raise ConfigurationError, "#{path} must be an array" unless rules.is_a?(Array)
 
         rules.each_with_index { |rule, index| validate_rule!(rule, "#{path}.#{index}") }

data/lib/empeira/network/peer/layout.rb

@@ -28,6 +28,14 @@ module Empeira
           "#{address(128)}/25"
         end
 
+        def egress_sources(scope)
+          case scope
+          when 'nodes' then ["#{address(32)}/27", "#{address(64)}/26"]
+          when 'infrastructure' then [container_pool]
+          else raise Error, 'Unknown direct-egress scope'
+          end
+        end
+
         def lease(nodes)
           used = nodes.values.filter_map { |record| record.dig('peer', 'ip') }
           ip = (32..95).map { |offset| address(offset) }.find { |candidate| !used.include?(candidate) }

data/lib/empeira/network/proxy_bindings.rb

@@ -12,22 +12,39 @@ module Empeira
       end
 
       def configuration
-        entries = %w[server].map do |name|
-          rules(name.tr('-', '_'), address(name), @config.fetch('global'))
+        entries = bindings.filter_map do |label, hostname, domains|
+          rules(label, address(hostname), domains)
         end
-        @nodes.sort.each_with_index do |(hostname, record), index|
-          entries << node_rules(hostname, record, index)
-        end
-        "#{entries.compact.join("\n")}\n"
+        "#{entries.join("\n")}\n"
+      end
+
+      def addresses
+        bindings.filter_map { |_, hostname, _| address(hostname) }.uniq
       end
 
       private
 
-      def node_rules(hostname, record, index)
-        return if record['network_phase'] == 'bootstrap'
+      def bindings
+        infrastructure_bindings + node_bindings
+      end
+
+      def infrastructure_bindings
+        scope = @config.fetch('infrastructure')
+        return [] unless scope.fetch('enabled')
 
-        domains = HostPolicy.new(@config).resolve(hostname)
-        rules("node_#{index}", address(hostname), domains)
+        names = %w[server postgres puppetdb-backend puppetdb] +
+                @context.configuration.dig('containers', 'additional').map { |service| service.fetch('name') }
+        names.map { |name| [name.tr('-', '_'), name, scope.fetch('allow')] }
+      end
+
+      def node_bindings
+        scope = @config.fetch('nodes')
+        return [] unless scope.fetch('enabled')
+
+        policy = HostPolicy.new(scope)
+        @nodes.sort.each_with_index.filter_map do |(hostname, record), index|
+          ["node_#{index}", hostname, policy.resolve(hostname)] unless record['network_phase'] == 'bootstrap'
+        end
       end
 
       def address(name)

data/lib/empeira/node/runtime_proxy.rb

@@ -63,9 +63,9 @@ module Empeira
 
         naming = Network::Naming.new
         internal = naming.reserved(@context.configuration).flat_map { |name| naming.aliases(name) }
+        bypass = Network::DirectEgress.destinations(@context.configuration.dig('network', 'egress', 'nodes'))
         { 'url' => environment.fetch('http_proxy'), 'no_proxy' => environment.fetch('no_proxy'),
-          'direct' => ['localhost', '127.0.0.1', *internal,
-                       *Network::DirectEgress.destinations(@context.configuration.dig('network', 'egress'))].uniq }
+          'direct' => ['localhost', '127.0.0.1', *internal, *bypass].uniq }
       end
 
       def execute(desired, previous)

data/lib/empeira/runtime/service_arguments.rb

@@ -3,6 +3,7 @@
 module Empeira
   module Runtime
     class ServiceArguments
+      PROXY_VARIABLES = %w[http_proxy https_proxy all_proxy HTTP_PROXY HTTPS_PROXY ALL_PROXY no_proxy NO_PROXY].freeze
       SCALARS = { 'dns' => '--dns', 'user' => '--user', 'entrypoint' => '--entrypoint',
                   'env_file' => '--env-file', 'shm_size' => '--shm-size', 'mac_address' => '--mac-address',
                   'ip' => '--ip', 'runtime_ip' => '--ip' }.freeze
@@ -20,7 +21,7 @@ module Empeira
          '--network', @options.fetch('network'), '--memory', "#{@options.fetch('memory')}m",
          '--cpus', @options.fetch('cpus', 1).to_s, '--no-healthcheck',
          *init_options, *security_options, *pairs('--label', @definition.labels), *scalar_options,
-         *pairs('--env', @options.fetch('environment', {}).merge(@options.fetch('runtime_environment', {}))),
+         *pairs('--env', environment),
          *pairs('--sysctl', @options.fetch('sysctls', {})),
          *@options.fetch('mounts', []).flat_map { |mount| ['--mount', mount] },
          *@options.fetch('ports', []).flat_map { |port| ['--publish', port] },
@@ -29,6 +30,11 @@ module Empeira
 
       private
 
+      def environment
+        PROXY_VARIABLES.to_h { |key| [key, ''] }.merge(@options.fetch('environment', {}))
+                       .merge(@options.fetch('runtime_environment', {}))
+      end
+
       def security_options
         values = { 'cap_drop' => '--cap-drop', 'cap_add' => '--cap-add', 'devices' => '--device',
                    'security_options' => '--security-opt' }

data/lib/empeira/server/environment_configuration.rb

@@ -24,10 +24,10 @@ module Empeira
       end
 
       def verify!(resource)
-        return if current(resource) == '0'
+        return if current(resource) == '0' && effective(resource) == '0'
 
         raise Error, 'Puppetserver environment_timeout is not 0 after startup; the custom entrypoint or ' \
-                     'server confdir overrides the managed setting; inspect the server runtime contract'
+                     'server confdir/environment overrides the managed setting; inspect the server runtime contract'
       end
 
       private
@@ -36,6 +36,12 @@ module Empeira
         execute(resource, [ControlPlane::Health::RUBY, READER, '--confdir', confdir]).stdout.strip
       end
 
+      def effective(resource)
+        arguments = [PUPPET, 'config', 'print', 'environment_timeout', '--section', 'server',
+                     '--confdir', confdir, '--environment', @plan.config.dig('server', 'environment')]
+        execute(resource, arguments).stdout.strip
+      end
+
       def execute(resource, arguments)
         result = @runtime.service_exec(resource, arguments)
         return result if result.success?

data/resources/gateway/configure.rb

@@ -111,17 +111,13 @@ module EmpeiraGateway
   end
 
   def direct_rules(plan, internal, external)
-    filter = []
-    plan.fetch('entries').each do |entry|
-      entry.fetch('addresses').each do |ip|
-        entry.fetch('ports').each do |port|
-          filter << "-A FORWARD -i #{internal} -o #{external} -s #{plan.fetch('subnet')} " \
-                    "-d #{ip}/32 -p tcp --dport #{port} -j ACCEPT"
-          filter << reply(internal, external, destination: ip, port: port)
-        end
+    plan.fetch('entries').flat_map do |entry|
+      entry.fetch('sources').product(entry.fetch('addresses'), entry.fetch('ports')).flat_map do |source, ip, port|
+        ["-A FORWARD -i #{internal} -o #{external} -s #{source} " \
+         "-d #{ip}/32 -p tcp --dport #{port} -j ACCEPT",
+         reply(internal, external, source: source, destination: ip, port: port)]
       end
     end
-    filter
   end
 
   def reply(internal, external, port:, source: nil, destination: nil, protocol: 'tcp')
@@ -145,7 +141,7 @@ module EmpeiraGateway
     raise 'Invalid workspace subnet' unless subnet.ipv4? && subnet.private? && subnet.prefix == 24
 
     validate_addresses(plan, subnet)
-    validate_entries(plan.fetch('entries'))
+    validate_entries(plan.fetch('entries'), subnet)
     validate_redirects(plan.fetch('redirects', []), subnet)
   end
 
@@ -197,14 +193,27 @@ module EmpeiraGateway
     %w[resolvers proxies blocked].each { |key| plan.fetch(key, []).each { |ip| ipv4(ip) } }
   end
 
-  def validate_entries(entries)
+  def validate_entries(entries, subnet)
     entries.each do |entry|
+      validate_sources(entry.fetch('sources'), subnet)
       entry.fetch('addresses').each { |ip| ipv4(ip) }
       valid = entry.fetch('ports').all? { |port| port.is_a?(Integer) && port.between?(1, 65_535) }
       raise 'Invalid gateway ports' unless valid
     end
   end
 
+  def validate_sources(sources, subnet)
+    valid = sources.is_a?(Array) && !sources.empty? && sources.all? { |source| valid_source?(source, subnet) }
+    raise 'Invalid direct-egress source ranges' unless valid
+  end
+
+  def valid_source?(source, subnet)
+    range = IPAddr.new(source)
+    range.ipv4? && range.prefix > subnet.prefix && subnet.include?(range) && "#{range}/#{range.prefix}" == source
+  rescue IPAddr::InvalidAddressError, TypeError
+    false
+  end
+
   def ipv4_interfaces
     Socket.getifaddrs.select { |entry| entry.addr&.ipv4? && !entry.addr.ipv4_loopback? }
   end
@@ -301,6 +310,7 @@ module EmpeiraGateway
     when 'redirects-capability'
       command('conntrack', '--version')
       puts 'tcp-udp-redirects-v2'
+    when 'scoped-egress-capability' then puts 'scoped-egress-v1'
     when 'lockdown'
       restore(lockdown)
     when 'apply' then apply(arguments.fetch(1))

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: empeira
 version: !ruby/object:Gem::Version
-  version: 0.1.0.pre.alpha.3
+  version: 0.1.0.pre.alpha.6
 platform: ruby
 authors:
 - Christian Meißner (c8m6)
@@ -304,7 +304,7 @@ files:
 - resources/relay/server_start.sh
 homepage: https://github.com/c8m6/empeira
 licenses:
-- AGPL-3.0-only
+- AGPL-3.0-or-later
 metadata:
   rubygems_mfa_required: 'true'
 rdoc_options: []