empeira 0.1.0.pre.alpha.4 → 0.1.0.pre.alpha.6

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 4e4e7094658b9e3d8f4ee0edbafa3e4e45be28921900cce8eb4af7d66096cee6
-  data.tar.gz: 7f062dc35a9cef14ad52f55362beba6c4a5a0ab1b57225ce27a191123dc01fc9
+  metadata.gz: 6a6bd2bd179b9a3fa789f2342e0646d9e5d681941cd2df234770cf8a94a01f31
+  data.tar.gz: 8925fd4ded29c7206cfe6c1d2d072f7a41a649582504dbf1a29232543525aacf
 SHA512:
-  metadata.gz: 8410139aeffa1ccaab90f3ddac57a809a86420e385f1354f801f8181c936ecf5653762cc4dbade0178d6df99b2dad1cc8b68cb8d537013132ec09e2ed65aefa1
-  data.tar.gz: 52ba2b37546bc90263d9834193b5080440e2a66425c9f9403b19800e791bf5f26b895d4c4e1af4bc218951b3a0e433437c07c550f493f4577e4e8dfd156a06bb
+  metadata.gz: 988ab09ce7e604a6bddfe1f5acad7f2847939b96e33ad6b73d06a03d49a6aafc7048222f5bb2a26eddb412dd75442b6d57addddd9558cb974a675603c11a1fb6
+  data.tar.gz: 6d5c737b4f18f0d400f279c59b0b10f7e68bb3b564c649b42207e0f447ba7b68a2acd93b34258ca7d025252d91de4c2befcfc741b85195f23a8b8feecaa99e46

data/config/defaults.yaml

@@ -50,12 +50,18 @@ puppetdb:
       bootstrap_config: /etc/puppetlabs/puppetdb/bootstrap.cfg
       data: /opt/puppetlabs/server/data/puppetdb
 network:
-  egress: []
+  egress:
+    nodes: []
+    infrastructure: []
   redirects: []
 proxy:
-  enabled: false
-  global: []
-  rules: []
+  nodes:
+    enabled: false
+    global: []
+    rules: []
+  infrastructure:
+    enabled: false
+    allow: []
 vm:
   disk: 30
   interfaces: []

data/docs/addons.md

@@ -208,8 +208,12 @@ Array elements can be mappings, arrays or scalars. For example:
 
 ```yaml
 proxy:
-  enabled: true
-  global: [forge.puppet.com, github.com]
+  nodes:
+    enabled: true
+    global: [forge.puppet.com, github.com]
+  infrastructure:
+    enabled: false
+    allow: []
 server:
   mounts:
     - source: /home/user/data
@@ -217,10 +221,10 @@ server:
       readonly: true
 ```
 
-produces `EMPEIRA_CONFIG_PROXY_ENABLED=true`,
-`EMPEIRA_CONFIG_PROXY_GLOBAL_COUNT=2`,
-`EMPEIRA_CONFIG_PROXY_GLOBAL_0=forge.puppet.com`,
-`EMPEIRA_CONFIG_PROXY_GLOBAL_1=github.com`,
+produces `EMPEIRA_CONFIG_PROXY_NODES_ENABLED=true`,
+`EMPEIRA_CONFIG_PROXY_NODES_GLOBAL_COUNT=2`,
+`EMPEIRA_CONFIG_PROXY_NODES_GLOBAL_0=forge.puppet.com`,
+`EMPEIRA_CONFIG_PROXY_NODES_GLOBAL_1=github.com`,
 `EMPEIRA_CONFIG_SERVER_MOUNTS_COUNT=1`, and the variables
 `EMPEIRA_CONFIG_SERVER_MOUNTS_0_SOURCE`, `_TARGET`, `_READONLY`.
 

data/docs/configuration.md

@@ -107,9 +107,15 @@ runtime:
 server:
   environment: production
 network:
-  egress: []
+  egress:
+    nodes: []
+    infrastructure: []
 proxy:
-  enabled: false
+  nodes:
+    enabled: false
+  infrastructure:
+    enabled: false
+    allow: []
 node_defaults:
   os: ubuntu
   version: "24.04"
@@ -150,11 +156,14 @@ release version. A partial project mapping may omit it and inherit the default.
 | `server.timeout` | Positive readiness timeout in seconds per component, `240` |
 | `server.mounts` | Additional server-only host bind mounts, `[]`; `source`, `target`, optional boolean `readonly` (default `true`) |
 | `puppetdb.memory` | Positive integer MiB, `768` |
-| `network.egress` | Direct TCP proxy-bypass host/port entries, `[]`; a project array replaces the default array |
+| `network.egress.nodes` | Node-only direct TCP host/port grants, `[]`; arrays replace |
+| `network.egress.infrastructure` | Infrastructure-only direct TCP host/port grants, `[]`; arrays replace |
 | `network.redirects` | Exact IPv4/protocol/port endpoints redirected to enabled internal services, `[]` |
-| `proxy.enabled` | Boolean, `false`; creates the normal HTTP/HTTPS policy proxy |
-| `proxy.global` | DNS destination array, `[]` |
-| `proxy.rules` | Additive hostname-glob rules with `hosts` and `allow` arrays, `[]` |
+| `proxy.nodes.enabled` | Boolean, `false`; enables normal node HTTP/HTTPS proxy access |
+| `proxy.nodes.global` | DNS destination array, `[]` |
+| `proxy.nodes.rules` | Additive node hostname-glob rules with `hosts` and `allow` arrays, `[]` |
+| `proxy.infrastructure.enabled` | Boolean, `false`; enables infrastructure HTTP/HTTPS proxy access |
+| `proxy.infrastructure.allow` | Independent infrastructure DNS destination array, `[]` |
 | `vm.disk` | New VM virtual disk capacity in GiB, integer `1`–`2048`, default `30`; must accommodate the base image |
 | `vm.interfaces` | VM-only hostname rules defining dummy/VLAN devices with explicit IPv4 CIDR host addresses, `[]` |
 | `vm.console.root_password` | Initial console password, `empeira`; a string overrides it and `null` disables it |
@@ -488,14 +497,20 @@ The numeric gem packaging fallback is never used to bypass this check.
 ```yaml
 network:
   egress:
-    - host: api.example.com
-      ports: [443]
+    nodes:
+      - host: api.example.com
+        ports: [443]
+    infrastructure: []
 proxy:
-  enabled: true
-  global: [forgeapi.puppet.com]
-  rules:
-    - hosts: ["*-web-*"]
-      allow: [github.com, "*.github.com"]
+  nodes:
+    enabled: true
+    global: [forgeapi.puppet.com]
+    rules:
+      - hosts: ["*-web-*"]
+        allow: [github.com, "*.github.com"]
+  infrastructure:
+    enabled: false
+    allow: []
 hiera:
   mounts:
     - source: ../hieradata
@@ -507,7 +522,12 @@ vm:
     root_password: null
 ```
 
-When `proxy.enabled` is true, every node may use its matching destination policy.
+When `proxy.nodes.enabled` is true, every node may use its matching destination policy.
+Infrastructure access is separately controlled by `proxy.infrastructure.enabled`
+and `proxy.infrastructure.allow`; both scopes default to disabled. Disabled
+infrastructure has no configured proxy endpoint even when nodes use the proxy.
+Keep its direct-egress list empty for internal-only infrastructure. See the
+[migration instructions](proxy.md#migrating-shared-settings) for former shared keys.
 After bootstrap cleanup, Empeira reconciles normal proxy settings on running,
 provisioned nodes during `up` and `node start`. Repeated Puppet runs use the
 existing guest configuration. No
@@ -719,21 +739,24 @@ desired state; Puppet owns package state after the first catalog.
 
 ## Direct egress
 
-`network.egress` contains destination TCP grants, independent of HTTP/HTTPS proxy
-policy. Entries have exactly one `host` or IPv4 `ip` and a nonempty unique `ports`
+`network.egress.nodes` and `network.egress.infrastructure` contain separate
+destination TCP grants, independent of HTTP/HTTPS proxy policy. A node grant never
+applies to infrastructure or conversely. Entries have exactly one `host` or IPv4 `ip` and a nonempty unique `ports`
 array (1–65535). `up` resolves all A records and replaces the complete policy;
 resolution/apply failure blocks egress. IPv6 and external UDP grants are unsupported.
 
 ```yaml
 network:
   egress:
-    - host: repository.example.net
-      ports: [443]
-    - ip: 203.0.113.10
-      ports: [443, 8443]
+    nodes:
+      - host: repository.example.net
+        ports: [443]
+      - ip: 203.0.113.10
+        ports: [443, 8443]
+    infrastructure: []
 ```
 
-Named direct destinations enter generated `NO_PROXY`; applications choose DIRECT
+Direct destinations enter only their own scope's generated `NO_PROXY`; applications choose DIRECT
 or proxy themselves. See [networking](networking.md#one-gateway-one-direct-egress-policy)
 for routing, revocation and privilege boundaries.
 
@@ -765,7 +788,7 @@ vm:
           network: 192.0.2.20/32
 ```
 
-Patterns use the same `*`/`?` glob matcher as `proxy.rules`, against the full stored
+Patterns use the same `*`/`?` glob matcher as `proxy.nodes.rules`, against the full stored
 node hostname, case-insensitively. Patterns within a rule are alternatives. All
 matching rules contribute devices; identical definitions merge once. A conflicting
 definition names the hostname, device and both configuration paths. No match creates

data/docs/hiera-and-eyaml.md

@@ -207,8 +207,8 @@ The obsolete `images.modules` key is rejected.
 The disposable installer belongs to the update plane. It uses the selected
 runtime's normal bridge network (`bridge` on Docker, `podman` on Podman), with
 normal runtime DNS and external connectivity. It never joins an Empeira workspace
-network and needs neither CoreDNS nor Squid. Workspace `network.egress`, `proxy.enabled`,
-`proxy.global` and `proxy.rules` do not affect
+network and needs neither CoreDNS nor Squid. Workspace `network.egress`, `proxy.nodes.enabled`,
+`proxy.nodes.global` and `proxy.nodes.rules` do not affect
 Forge or Git acquisition. Supplied `HTTP_PROXY`, `HTTPS_PROXY`, `NO_PROXY` and their
 lowercase equivalents are inherited unchanged; Empeira generates no proxy URL.
 The host/runtime's normal network and corporate-proxy configuration must permit

data/docs/networking.md

@@ -102,17 +102,26 @@ Every peer uses the owned gateway as its IPv4 default route. Only the gateway ha
 an external uplink; DNS, proxies, server, database and nodes stay isolated.
 The fixed browser UI relay has a separate loopback access path with forwarding off.
 
-`network.egress` grants destination IPv4/TCP-port pairs:
+`network.egress.nodes` and `network.egress.infrastructure` grant destination
+IPv4/TCP-port pairs independently:
 
 ```yaml
 network:
   egress:
-    - host: repository.example.net
-      ports: [443]
-    - ip: 203.0.113.10
-      ports: [443, 8443]
+    nodes:
+      - host: repository.example.net
+        ports: [443]
+      - ip: 203.0.113.10
+        ports: [443, 8443]
+    infrastructure: []
 ```
 
+The gateway restricts node grants to the reserved VM/container node address ranges
+and infrastructure grants to its separate runtime allocation pool. Both directions
+of direct connections are source-bound. The shared workspace subnet is never used
+as a blanket source for direct grants. Custom gateway images must advertise
+`scoped-egress-v1`; an older image fails closed before receiving external access.
+
 Entries have exactly one `host` or `ip`. Hostnames match exactly, without wildcards;
 `up` resolves every current A record and replaces the complete policy. IP selectors
 bypass DNS and may intentionally permit private LAN/VPN destinations. A different
@@ -128,9 +137,9 @@ CoreDNS alone receives TCP/UDP 53 to its selected resolvers. Proxies alone recei
 TCP 80/443 and enforce their destination allowlists. Normal proxy allow rules apply
 regardless of target IP range; the temporary authenticated bootstrap proxy retains
 its separate private/reserved-address restrictions.
-`proxy.global` does not grant direct egress. Applications choose DIRECT/proxy using
+`proxy.nodes.global` does not grant direct egress. Applications choose DIRECT/proxy using
 their own settings and `NO_PROXY`; direct/proxy selection has no automatic fallback.
-Both explicit hostnames and IPv4 selectors from `network.egress` are included in
+Both explicit hostnames and IPv4 selectors are included only in their own scope's
 normal proxy bypass settings. The gateway still permits only their configured TCP ports.
 See [proxy policy](proxy.md) for hostname rules and bootstrap destinations.
 

data/docs/proxy.md

@@ -1,19 +1,23 @@
 # Proxy policy
 
-Normal external HTTP/HTTPS access stays behind Squid. Enabling the workspace proxy
-makes it available to every node; global and hostname rules remain the destination
-allowlist:
+Normal external HTTP/HTTPS access stays behind Squid. Nodes and infrastructure
+have independent switches and destination lists, both disabled by default. Enabling
+the node scope makes its global and hostname rules available to nodes:
 
 ```yaml
 proxy:
-  enabled: true
-  global:
-    - forgeapi.puppet.com
-  rules:
-    - hosts: ["lab-*"]
-      allow: ["*.github.com"]
-    - hosts: ["*-web-*"]
-      allow: [github.com, nginx.org]
+  nodes:
+    enabled: true
+    global:
+      - forgeapi.puppet.com
+    rules:
+      - hosts: ["lab-*"]
+        allow: ["*.github.com"]
+      - hosts: ["*-web-*"]
+        allow: [github.com, nginx.org]
+  infrastructure:
+    enabled: false
+    allow: []
 ```
 
 ```console
@@ -46,7 +50,7 @@ infrastructure has already been reconciled.
 
 ## Matching and destinations
 
-Defaults are `proxy.global: []` and `proxy.rules: []`. Every node receives
+Defaults are `proxy.nodes.global: []` and `proxy.nodes.rules: []`. Every node receives
 all global destinations plus `allow` from **every** matching rule. Duplicate entries
 are removed while preserving configuration order. A rule matches when any of its
 `hosts` patterns matches the complete lowercase hostname. Patterns must be lowercase.
@@ -66,14 +70,14 @@ Destination rules are separate from hostname globs:
 Only HTTP port 80 and HTTPS CONNECT port 443 are allowed. Allowed DNS destinations
 are reachable regardless of their target IP range, including private, loopback,
 link-local and reserved addresses. Domains without a matching allow rule remain
-denied. There is no TLS interception. Server-side outbound traffic gets
-`proxy.global` only; node hostname rules do not expand server access.
+denied. There is no TLS interception. Node destinations never grant infrastructure
+access, and infrastructure destinations never grant node access.
 
 ## Node policy and reconciliation
 
-When `proxy.enabled` is true, all nodes are authorized as proxy clients. Nodes get
+When `proxy.nodes.enabled` is true, all nodes are authorized as proxy clients. Nodes get
 upper/lowercase proxy variables and internal `NO_PROXY` entries, including explicitly
-configured `network.egress` hosts. Those named hosts use the common workspace
+configured `network.egress.nodes` hosts. Those named hosts use the common workspace
 gateway for their configured ports. VM access uses the same destination policy bound
 directly to the VM instance's reserved peer address. The proxy is reached at
 `proxy.empeira.internal:3128` on the isolated network. A request without a matching
@@ -90,17 +94,56 @@ Container and VM nodes consume the new policy without a restart; open proxy
 connections can end during reconciliation. Enabling/disabling proxy mode is a
 separate topology change and may require explicit node cleanup as reported by `up`.
 
-Changing direct-egress destinations also changes the server's `NO_PROXY`
-environment. `up` replaces a server whose environment definition changes while
+Changing `network.egress.infrastructure` destinations also changes infrastructure
+`NO_PROXY`. Changing node destinations does not change the server environment. `up` replaces a server whose environment definition changes while
 retaining CA storage and node identities. Changing only destination ports or
 transparent redirect rules preserves the server when its definition is unchanged.
 
+## Infrastructure policy
+
+`proxy.infrastructure.enabled` controls the Puppet/OpenVox server, PostgreSQL,
+PuppetDB backend/relay and `containers.additional` services. Its independent
+`allow` list uses the same exact-domain and domain-family syntax as node grants.
+The browser, DNS, Squid and gateway transports do not receive these application
+proxy settings.
+
+```yaml
+proxy:
+  infrastructure:
+    enabled: true
+    allow: [api.example.net]
+```
+
+When disabled, infrastructure definitions contain empty proxy values, overriding
+any image defaults. They contain no configured proxy endpoint and receive no Squid
+client grants, even if the node proxy is enabled. No startup wrapper removes an
+otherwise configured proxy. Internal names and mocks remain directly reachable.
+When enabled, only infrastructure's own direct destinations enter its `NO_PROXY`.
+Explicit environment settings in additional-service definitions remain application
+configuration; they do not add Squid permissions.
+
+`up` creates the shared normal proxy when either scope is enabled and removes it
+when both are disabled. Changing infrastructure's switch updates affected service
+definitions while retaining storage and node identities. Allowlist-only edits reload
+Squid without replacing unrelated services. Direct grants remain independent of
+both proxy switches; keep `network.egress.infrastructure: []` for internal-only
+infrastructure.
+
+## Migrating shared settings
+
+The former `proxy.enabled`, `proxy.global` and `proxy.rules` keys are rejected with
+a migration diagnostic. Move them under `proxy.nodes`; configure infrastructure
+explicitly with its own switch and `allow` list. Old shared `network.egress` arrays
+and legacy `mode` values are also rejected. Move grants to `network.egress.nodes`
+or `network.egress.infrastructure` according to the intended clients. No existing
+grant is silently copied to infrastructure.
+
 ## Managed bootstrap
 
 Managed bootstrap destinations are separate from normal user policy. Reviewed
 agent and distribution endpoints in `agent.install` and `bootstrap.guests` allow
 Puppet/OpenVox and required guest packages to be installed without duplicating them
-in `proxy.global`. The temporary authenticated bootstrap proxy uses workspace DNS
+in `proxy.nodes.global`. The temporary authenticated bootstrap proxy uses workspace DNS
 and retains its private, loopback, link-local and reserved destination-address
 restrictions independently of normal proxy policy. Its credential is not stored in
 the guest seed, JSON inventory or logs. A /32 source ACL admits only the provisioning

data/docs/troubleshooting.md

@@ -132,7 +132,7 @@ or restart of that same VM conflicts with the shared instance guard: detach with
 ## Proxy destination denied
 
 Run `empeira proxy show HOSTNAME` and check every matching rule. Verify the node
-exists in the workspace, `proxy.enabled` is true, and `up` has reconciled the
+exists in the workspace, `proxy.nodes.enabled` is true, and `up` has reconciled the
 configuration and current node addresses. Allowed DNS destinations may resolve to
 private or reserved IP addresses; only HTTP port 80 and HTTPS CONNECT port 443 are
 permitted. After updating Empeira, run `empeira up` to replace a proxy still using
@@ -367,6 +367,6 @@ external runtime network as a workaround. Docker workspace bridge attachment
 errors require an accessible Linux-engine host namespace and an identifiable
 iptables backend. The helper changes only owned bridge rules. Do not disable the
 host firewall globally. Check Docker Desktop host-network restrictions separately.
-Proxy errors require checking Squid source bindings and `proxy.global`/`proxy.rules`,
+Proxy errors require checking Squid source bindings and `proxy.nodes.global`/`proxy.nodes.rules`,
 not adding unrelated direct grants. Corporate DNS still follows host discovery;
 IPv6-only upstreams must be replaced with reachable IPv4 resolvers for this backend.

data/lib/empeira/build.json

@@ -1,5 +1,5 @@
 {
-  "version": "0.1.0-alpha.4",
-  "revision": "b073c6a15db14c4dace4a732703240f4289cbb48",
-  "build_time": "2026-10-21T11:41:02Z"
+  "version": "0.1.0-alpha.6",
+  "revision": "398c47f3abc571dd3c6668f62399eb624b465019",
+  "build_time": "2026-10-23T07:29:14Z"
 }

data/lib/empeira/cli/proxy.rb

@@ -5,7 +5,7 @@ module Empeira
     class Proxy < Base
       desc 'show HOSTNAME', 'Explain the normal proxy destination policy for a hostname'
       def show(hostname)
-        config = application.context.configuration.fetch('proxy')
+        config = application.context.configuration.dig('proxy', 'nodes')
         resolver = Network::HostPolicy.new(config)
         say "Effective proxy policy for #{hostname.downcase}"
         say access_message(config)
@@ -19,7 +19,7 @@ module Empeira
           return "All workspace nodes may use this policy after 'empeira up' reconciles the proxy." if
             config.fetch('enabled')
 
-          'The normal workspace proxy is disabled.'
+          'The normal node proxy is disabled.'
         end
 
         def display_matches(rules)

data/lib/empeira/configuration/schema.rb

@@ -20,8 +20,10 @@ module Empeira
                       'environment' => :environment,
                       'memory' => :positive_integer, 'cpus' => :positive_integer, 'timeout' => :positive_integer },
         'puppetdb' => { 'enabled' => :boolean, 'memory' => :positive_integer, 'runtime' => :puppetdb_runtime },
-        'network' => { 'egress' => :network_egress, 'redirects' => :network_redirects },
-        'proxy' => { 'enabled' => :boolean, 'global' => :allowlist, 'rules' => :proxy_rules },
+        'network' => { 'egress' => { 'nodes' => :network_egress, 'infrastructure' => :network_egress },
+                       'redirects' => :network_redirects },
+        'proxy' => { 'nodes' => { 'enabled' => :boolean, 'global' => :allowlist, 'rules' => :proxy_rules },
+                     'infrastructure' => { 'enabled' => :boolean, 'allow' => :allowlist } },
         'vm' => { 'disk' => :vm_disk, 'interfaces' => :vm_interfaces,
                   'console' => { 'root_password' => :optional_string } },
         'dns' => { 'upstream' => { 'mode' => :dns_mode, 'servers' => :dns_servers },
@@ -116,12 +118,35 @@ module Empeira
       end
 
       def validate_fragment!(data)
+        validate_scope_migration!(data)
         validate_mapping!(data, RULES, [])
         data
       end
 
       private
 
+      def validate_scope_migration!(data)
+        return unless data.is_a?(Hash)
+
+        validate_proxy_scope_migration!(data['proxy'])
+        network = data['network']
+        validate_egress_scope_migration!(network['egress']) if network.is_a?(Hash)
+      end
+
+      def validate_proxy_scope_migration!(proxy)
+        return unless proxy.is_a?(Hash) && proxy.keys.intersect?(%w[enabled global rules])
+
+        raise ConfigurationError, 'Shared proxy settings have moved to proxy.nodes; configure ' \
+                                  'proxy.infrastructure separately'
+      end
+
+      def validate_egress_scope_migration!(egress)
+        return unless egress.is_a?(Array) || (egress.is_a?(Hash) && egress.key?('mode'))
+
+        raise ConfigurationError, 'Shared network.egress grants must be moved explicitly to ' \
+                                  'network.egress.nodes or network.egress.infrastructure'
+      end
+
       def validate_operational!(data)
         validate_images!(data.fetch('images'))
         NodeImages.effective!(data.fetch('images'))

data/lib/empeira/control_plane/controller.rb

@@ -254,8 +254,10 @@ module Empeira
       end
 
       def resolve_direct_egress
-        config = @plan.config.dig('network', 'egress')
-        @direct_resolver.resolve(config)
+        entries = @plan.config.dig('network', 'egress').flat_map do |scope, grants|
+          @direct_resolver.resolve(grants).entries.map { |entry| entry.merge('scope' => scope) }
+        end
+        Network::DirectEgress::Resolved.new(entries)
       end
 
       def bootstrap_dns?(upstreams:, routes:)
@@ -636,6 +638,7 @@ module Empeira
         end
         reconcile('gateway')
         lockdown_gateway(@observed.fetch('gateway'))
+        require_scoped_egress_capability
         require_redirect_capability
         attach_gateway('gateway')
         apply_gateway_policy
@@ -668,6 +671,16 @@ module Empeira
                      'images.direct_egress image'
       end
 
+      def require_scoped_egress_capability
+        return if @gateway_plan.fetch('entries').empty?
+
+        result = @runtime.service_exec(@observed.fetch('gateway'),
+                                       [Network::Gateway::EXECUTABLE, 'scoped-egress-capability'])
+        return if result.success? && result.stdout.strip == 'scoped-egress-v1'
+
+        raise Error, 'Gateway does not support scoped direct egress; configure a compatible images.direct_egress image'
+      end
+
       def apply_gateway_policy
         # An uncertain apply must force fresh lockdown during failure recovery.
         @gateway_locked_id = nil

data/lib/empeira/control_plane/files.rb

@@ -116,10 +116,7 @@ module Empeira
         bindings = Network::ProxyBindings.new(context: @context, resources: resources, network: network, nodes: nodes)
         # The workspace parent is private; Squid's mapped service user must read the bind mount.
         rules_changed = write('proxy-rules.conf', bindings.configuration)
-        allowed = proxy_allowed(nodes)
-        addresses = resources.slice(*allowed).values.filter_map do |resource|
-          resource&.dig('networks', network, 'IPAddress')
-        end
+        addresses = bindings.addresses
         clients_changed = write('proxy-clients', "#{(['127.0.0.1/32'] + addresses.reject(&:empty?).sort).join("\n")}\n")
         rules_changed || clients_changed
       end
@@ -131,10 +128,6 @@ module Empeira
         Infrastructure::Definition.fingerprint(content)
       end
 
-      def proxy_allowed(nodes)
-        ['server', *nodes.keys]
-      end
-
       private
 
       def corefile_content(upstreams:, routes:, bootstrap: false)

data/lib/empeira/control_plane/plan.rb

@@ -27,8 +27,7 @@ module Empeira
       end
 
       def proxy?
-        egress = config.dig('network', 'egress')
-        config.dig('proxy', 'enabled') || (egress.is_a?(Hash) && egress['mode'] == 'proxy')
+        %w[nodes infrastructure].any? { |scope| config.dig('proxy', scope, 'enabled') }
       end
 
       def database?
@@ -63,7 +62,7 @@ module Empeira
       def additional_services(common = {})
         config.dig('containers', 'additional').each_with_index.to_h do |entry, index|
           options = { image: image_reference(entry.fetch('image')), memory: 256,
-                      environment: proxy_environment_for('').merge(entry.fetch('environment', {})),
+                      environment: infrastructure_proxy_environment.merge(entry.fetch('environment', {})),
                       command: entry.fetch('command', []) }
           location = "containers.additional[#{index}].configuration"
           generated = additional_configurations.options(entry, mounts: common.fetch(:mounts, []), location: location)
@@ -175,9 +174,9 @@ module Empeira
       end
 
       def node_proxy_environment
-        return {} unless proxy?
+        return {} unless config.dig('proxy', 'nodes', 'enabled')
 
-        proxy_environment_for("http://#{naming.hostname('proxy')}:3128")
+        proxy_environment_for("http://#{naming.hostname('proxy')}:3128", scope: 'nodes')
       end
 
       private
@@ -209,9 +208,10 @@ module Empeira
       def database_services(common)
         return {} unless database?
 
-        { 'postgres' => service('postgres', **common, **postgres),
-          'puppetdb-backend' => service('puppetdb-backend', **common, **puppetdb),
-          'puppetdb' => service('puppetdb', **common, **puppetdb_relay(dns: common[:dns])) }
+        options = common.merge(environment: infrastructure_proxy_environment)
+        { 'postgres' => service('postgres', **options, **postgres),
+          'puppetdb-backend' => service('puppetdb-backend', **options, **puppetdb),
+          'puppetdb' => service('puppetdb', **options, **puppetdb_relay(dns: common[:dns])) }
       end
 
       def server
@@ -271,15 +271,16 @@ module Empeira
           reports: database? ? 'puppetdb' : 'log',
           # Upstream entrypoints otherwise rewrite puppetdb.conf from their default URL.
           puppetdb_server_urls: ''
-        ).merge(proxy_environment)
+        ).merge(infrastructure_proxy_environment)
       end
 
-      def proxy_environment
-        proxy_environment_for(proxy? ? "http://#{naming.hostname('proxy')}:3128" : '')
+      def infrastructure_proxy_environment
+        enabled = config.dig('proxy', 'infrastructure', 'enabled')
+        proxy_environment_for(enabled ? "http://#{naming.hostname('proxy')}:3128" : '', scope: 'infrastructure')
       end
 
-      def proxy_environment_for(url)
-        bypass = Network::DirectEgress.destinations(config.dig('network', 'egress'))
+      def proxy_environment_for(url, scope:)
+        bypass = Network::DirectEgress.destinations(config.dig('network', 'egress', scope))
         no_proxy = naming.no_proxy(bypass)
         { 'http_proxy' => url, 'https_proxy' => url, 'HTTP_PROXY' => url, 'HTTPS_PROXY' => url,
           'all_proxy' => '', 'ALL_PROXY' => '', 'no_proxy' => no_proxy, 'NO_PROXY' => no_proxy }
@@ -289,7 +290,8 @@ module Empeira
         { image: image_reference(config.dig('images', 'postgres')), memory: 256,
           env_file: files.secret_path,
           configuration: files.configuration.fetch('database-setup.sql'),
-          environment: { 'POSTGRES_USER' => 'postgres', 'POSTGRES_DB' => 'puppetdb' },
+          environment: infrastructure_proxy_environment.merge('POSTGRES_USER' => 'postgres',
+                                                              'POSTGRES_DB' => 'puppetdb'),
           mounts: [storage('postgres-data', '/var/lib/postgresql/data'),
                    bind(files.path('database-setup.sql'), '/empeira/setup.sql')],
           command: ['postgres', '-c', 'shared_buffers=64MB', '-c', 'max_connections=50'] }

data/lib/empeira/network/direct_egress.rb

@@ -24,7 +24,6 @@ module Empeira
       module_function
 
       def validate!(value, path = 'network.egress')
-        return legacy!(value, path) if value.is_a?(Hash)
         unless value.is_a?(Array) && value.size <= MAX_HOSTS
           raise ConfigurationError, "#{path} must be an array with at most #{MAX_HOSTS} destination entries"
         end
@@ -33,12 +32,6 @@ module Empeira
         raise ConfigurationError, "#{path} contains duplicate destinations" unless hosts.uniq.size == hosts.size
       end
 
-      def legacy!(value, path)
-        return if value.keys == ['mode'] && %w[none proxy].include?(value['mode'])
-
-        raise ConfigurationError, "#{path} must be a host array (legacy mode accepts only none or proxy)"
-      end
-
       def destinations(value)
         return [] unless value.is_a?(Array)
 

data/lib/empeira/network/gateway.rb

@@ -22,7 +22,15 @@ module Empeira
         { 'version' => 1, 'subnet' => subnet, 'gateway' => address(subnet),
           'dns' => address(subnet, 'dns'), 'resolvers' => resolvers,
           'proxies' => %w[proxy bootstrap-proxy].map { |key| address(subnet, key) },
-          'blocked' => blocked_addresses(state), 'entries' => resolved.entries, 'redirects' => redirects }
+          'blocked' => blocked_addresses(state), 'entries' => scoped_entries(resolved, subnet),
+          'redirects' => redirects }
+      end
+
+      def self.scoped_entries(resolved, subnet)
+        layout = Peer::Layout.new(subnet)
+        resolved.entries.map do |entry|
+          entry.except('scope').merge('sources' => layout.egress_sources(entry.fetch('scope')))
+        end
       end
 
       def self.blocked_addresses(state)

data/lib/empeira/network/host_policy.rb

@@ -3,7 +3,7 @@
 module Empeira
   module Network
     class HostPolicy
-      def self.validate!(rules, path = 'proxy.rules')
+      def self.validate!(rules, path = 'proxy.nodes.rules')
         raise ConfigurationError, "#{path} must be an array" unless rules.is_a?(Array)
 
         rules.each_with_index { |rule, index| validate_rule!(rule, "#{path}.#{index}") }

data/lib/empeira/network/peer/layout.rb

@@ -28,6 +28,14 @@ module Empeira
           "#{address(128)}/25"
         end
 
+        def egress_sources(scope)
+          case scope
+          when 'nodes' then ["#{address(32)}/27", "#{address(64)}/26"]
+          when 'infrastructure' then [container_pool]
+          else raise Error, 'Unknown direct-egress scope'
+          end
+        end
+
         def lease(nodes)
           used = nodes.values.filter_map { |record| record.dig('peer', 'ip') }
           ip = (32..95).map { |offset| address(offset) }.find { |candidate| !used.include?(candidate) }

data/lib/empeira/network/proxy_bindings.rb

@@ -12,22 +12,39 @@ module Empeira
       end
 
       def configuration
-        entries = %w[server].map do |name|
-          rules(name.tr('-', '_'), address(name), @config.fetch('global'))
+        entries = bindings.filter_map do |label, hostname, domains|
+          rules(label, address(hostname), domains)
         end
-        @nodes.sort.each_with_index do |(hostname, record), index|
-          entries << node_rules(hostname, record, index)
-        end
-        "#{entries.compact.join("\n")}\n"
+        "#{entries.join("\n")}\n"
+      end
+
+      def addresses
+        bindings.filter_map { |_, hostname, _| address(hostname) }.uniq
       end
 
       private
 
-      def node_rules(hostname, record, index)
-        return if record['network_phase'] == 'bootstrap'
+      def bindings
+        infrastructure_bindings + node_bindings
+      end
+
+      def infrastructure_bindings
+        scope = @config.fetch('infrastructure')
+        return [] unless scope.fetch('enabled')
 
-        domains = HostPolicy.new(@config).resolve(hostname)
-        rules("node_#{index}", address(hostname), domains)
+        names = %w[server postgres puppetdb-backend puppetdb] +
+                @context.configuration.dig('containers', 'additional').map { |service| service.fetch('name') }
+        names.map { |name| [name.tr('-', '_'), name, scope.fetch('allow')] }
+      end
+
+      def node_bindings
+        scope = @config.fetch('nodes')
+        return [] unless scope.fetch('enabled')
+
+        policy = HostPolicy.new(scope)
+        @nodes.sort.each_with_index.filter_map do |(hostname, record), index|
+          ["node_#{index}", hostname, policy.resolve(hostname)] unless record['network_phase'] == 'bootstrap'
+        end
       end
 
       def address(name)

data/lib/empeira/node/runtime_proxy.rb

@@ -63,9 +63,9 @@ module Empeira
 
         naming = Network::Naming.new
         internal = naming.reserved(@context.configuration).flat_map { |name| naming.aliases(name) }
+        bypass = Network::DirectEgress.destinations(@context.configuration.dig('network', 'egress', 'nodes'))
         { 'url' => environment.fetch('http_proxy'), 'no_proxy' => environment.fetch('no_proxy'),
-          'direct' => ['localhost', '127.0.0.1', *internal,
-                       *Network::DirectEgress.destinations(@context.configuration.dig('network', 'egress'))].uniq }
+          'direct' => ['localhost', '127.0.0.1', *internal, *bypass].uniq }
       end
 
       def execute(desired, previous)

data/lib/empeira/runtime/service_arguments.rb

@@ -3,6 +3,7 @@
 module Empeira
   module Runtime
     class ServiceArguments
+      PROXY_VARIABLES = %w[http_proxy https_proxy all_proxy HTTP_PROXY HTTPS_PROXY ALL_PROXY no_proxy NO_PROXY].freeze
       SCALARS = { 'dns' => '--dns', 'user' => '--user', 'entrypoint' => '--entrypoint',
                   'env_file' => '--env-file', 'shm_size' => '--shm-size', 'mac_address' => '--mac-address',
                   'ip' => '--ip', 'runtime_ip' => '--ip' }.freeze
@@ -20,7 +21,7 @@ module Empeira
          '--network', @options.fetch('network'), '--memory', "#{@options.fetch('memory')}m",
          '--cpus', @options.fetch('cpus', 1).to_s, '--no-healthcheck',
          *init_options, *security_options, *pairs('--label', @definition.labels), *scalar_options,
-         *pairs('--env', @options.fetch('environment', {}).merge(@options.fetch('runtime_environment', {}))),
+         *pairs('--env', environment),
          *pairs('--sysctl', @options.fetch('sysctls', {})),
          *@options.fetch('mounts', []).flat_map { |mount| ['--mount', mount] },
          *@options.fetch('ports', []).flat_map { |port| ['--publish', port] },
@@ -29,6 +30,11 @@ module Empeira
 
       private
 
+      def environment
+        PROXY_VARIABLES.to_h { |key| [key, ''] }.merge(@options.fetch('environment', {}))
+                       .merge(@options.fetch('runtime_environment', {}))
+      end
+
       def security_options
         values = { 'cap_drop' => '--cap-drop', 'cap_add' => '--cap-add', 'devices' => '--device',
                    'security_options' => '--security-opt' }

data/resources/gateway/configure.rb

@@ -111,17 +111,13 @@ module EmpeiraGateway
   end
 
   def direct_rules(plan, internal, external)
-    filter = []
-    plan.fetch('entries').each do |entry|
-      entry.fetch('addresses').each do |ip|
-        entry.fetch('ports').each do |port|
-          filter << "-A FORWARD -i #{internal} -o #{external} -s #{plan.fetch('subnet')} " \
-                    "-d #{ip}/32 -p tcp --dport #{port} -j ACCEPT"
-          filter << reply(internal, external, destination: ip, port: port)
-        end
+    plan.fetch('entries').flat_map do |entry|
+      entry.fetch('sources').product(entry.fetch('addresses'), entry.fetch('ports')).flat_map do |source, ip, port|
+        ["-A FORWARD -i #{internal} -o #{external} -s #{source} " \
+         "-d #{ip}/32 -p tcp --dport #{port} -j ACCEPT",
+         reply(internal, external, source: source, destination: ip, port: port)]
       end
     end
-    filter
   end
 
   def reply(internal, external, port:, source: nil, destination: nil, protocol: 'tcp')
@@ -145,7 +141,7 @@ module EmpeiraGateway
     raise 'Invalid workspace subnet' unless subnet.ipv4? && subnet.private? && subnet.prefix == 24
 
     validate_addresses(plan, subnet)
-    validate_entries(plan.fetch('entries'))
+    validate_entries(plan.fetch('entries'), subnet)
     validate_redirects(plan.fetch('redirects', []), subnet)
   end
 
@@ -197,14 +193,27 @@ module EmpeiraGateway
     %w[resolvers proxies blocked].each { |key| plan.fetch(key, []).each { |ip| ipv4(ip) } }
   end
 
-  def validate_entries(entries)
+  def validate_entries(entries, subnet)
     entries.each do |entry|
+      validate_sources(entry.fetch('sources'), subnet)
       entry.fetch('addresses').each { |ip| ipv4(ip) }
       valid = entry.fetch('ports').all? { |port| port.is_a?(Integer) && port.between?(1, 65_535) }
       raise 'Invalid gateway ports' unless valid
     end
   end
 
+  def validate_sources(sources, subnet)
+    valid = sources.is_a?(Array) && !sources.empty? && sources.all? { |source| valid_source?(source, subnet) }
+    raise 'Invalid direct-egress source ranges' unless valid
+  end
+
+  def valid_source?(source, subnet)
+    range = IPAddr.new(source)
+    range.ipv4? && range.prefix > subnet.prefix && subnet.include?(range) && "#{range}/#{range.prefix}" == source
+  rescue IPAddr::InvalidAddressError, TypeError
+    false
+  end
+
   def ipv4_interfaces
     Socket.getifaddrs.select { |entry| entry.addr&.ipv4? && !entry.addr.ipv4_loopback? }
   end
@@ -301,6 +310,7 @@ module EmpeiraGateway
     when 'redirects-capability'
       command('conntrack', '--version')
       puts 'tcp-udp-redirects-v2'
+    when 'scoped-egress-capability' then puts 'scoped-egress-v1'
     when 'lockdown'
       restore(lockdown)
     when 'apply' then apply(arguments.fetch(1))

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: empeira
 version: !ruby/object:Gem::Version
-  version: 0.1.0.pre.alpha.4
+  version: 0.1.0.pre.alpha.6
 platform: ruby
 authors:
 - Christian Meißner (c8m6)