@forgezero/agent 0.1.134 → 0.1.136

package/dist/metal-provision.js

@@ -56,6 +56,10 @@ function guestUnit(spec) {
     `ExecStopPost=-/usr/sbin/ip link del ${spec.tap}`
   ].join(`
 `) : "";
+  const encryptedDisk = spec.diskEncryption ? `LoadCredentialEncrypted=${spec.diskEncryption.credentialName}:${spec.diskEncryption.credentialPath}
+ExecStartPre=/usr/sbin/cryptsetup open --type luks2 --key-file %d/${spec.diskEncryption.credentialName} ${spec.diskEncryption.source} ${spec.diskEncryption.mapper}
+ExecStopPost=-/usr/sbin/cryptsetup close ${spec.diskEncryption.mapper}
+` : "";
   return `[Unit]
 Description=ForgeZero guest ${spec.name}
 Documentation=https://www.forgezero.net
@@ -65,7 +69,7 @@ Wants=network-online.target
 [Service]
 Type=simple
 Slice=forgezero-guests.slice
-${tapSetup}
+${encryptedDisk}${tapSetup}
 ExecStart=${argv}
 Restart=always
 RestartSec=5
@@ -754,8 +758,9 @@ function assertSupportedGuestImage(imageKey, confidential = false) {
 }
 
 // src/metal-provision.ts
-import { createHash as createHash2 } from "node:crypto";
+import { createHash as createHash2, randomBytes } from "node:crypto";
 import {
+  chmodSync as chmodSync2,
   existsSync as existsSync2,
   mkdirSync as mkdirSync2,
   readFileSync as readFileSync2,
@@ -989,6 +994,8 @@ function guestBootstrapOperations(profile, attested = Boolean(profile.confidenti
   validateMetalProfile(profile);
   const agentBun = "/usr/local/lib/forgezero/bun";
   return [
+    ["/usr/sbin/swapoff", "--all"],
+    ["/usr/bin/systemctl", "mask", "--now", "swap.target"],
     ...attested ? [
       ["/usr/sbin/modprobe", "sev-guest"],
       ["/usr/bin/test", "-c", "/dev/sev-guest"]
@@ -1065,6 +1072,7 @@ ${access.sshPublicKeys.map((key) => `      - ${JSON.stringify(key)}`).join(`
   return {
     userData: `#cloud-config
 package_update: true
+swap: { size: 0 }
 ${users}disable_root: true
 # Git is part of the deployment transport, not a tenant-selected prerequisite:
 # every dynamically claimed repository must be cloneable on a clean image.
@@ -1097,7 +1105,8 @@ var checked = async (exec, argv) => {
 async function provisionMetalGuest(profile, claim, exec) {
   validateMetalProfile(profile);
   assertSupportedGuestImage(claim.spec.imageKey, claim.spec.confidential);
-  if (!claim.computeKey || !claim.spec.reference || !SAFE_NAME.test(claim.spec.imageKey) || claim.spec.guestName !== undefined && !SAFE_NAME.test(claim.spec.guestName) || claim.spec.cpuPoolKey !== undefined && !SAFE_NAME.test(claim.spec.cpuPoolKey) || !Number.isInteger(claim.spec.physicalCores) || claim.spec.physicalCores < 1 || claim.spec.physicalCores > 256 || !Number.isInteger(claim.spec.vcpu) || claim.spec.vcpu < 1 || claim.spec.vcpu > 512 || !Number.isInteger(claim.spec.memoryGib) || claim.spec.memoryGib < 1 || claim.spec.memoryGib > 8192 || !Number.isInteger(claim.spec.diskGib) || claim.spec.diskGib < 8 || claim.spec.diskGib > 65536 || !Number.isInteger(claim.spec.egressGuaranteedMbps) || claim.spec.egressGuaranteedMbps < 0 || !Number.isInteger(claim.spec.egressBurstMbps) || claim.spec.egressBurstMbps < claim.spec.egressGuaranteedMbps)
+  const diskEncryption = claim.spec.diskEncryption ?? "none";
+  if (!claim.computeKey || !claim.spec.reference || !SAFE_NAME.test(claim.spec.imageKey) || claim.spec.guestName !== undefined && !SAFE_NAME.test(claim.spec.guestName) || claim.spec.cpuPoolKey !== undefined && !SAFE_NAME.test(claim.spec.cpuPoolKey) || !Number.isInteger(claim.spec.physicalCores) || claim.spec.physicalCores < 1 || claim.spec.physicalCores > 256 || !Number.isInteger(claim.spec.vcpu) || claim.spec.vcpu < 1 || claim.spec.vcpu > 512 || !Number.isInteger(claim.spec.memoryGib) || claim.spec.memoryGib < 1 || claim.spec.memoryGib > 8192 || !Number.isInteger(claim.spec.diskGib) || claim.spec.diskGib < 8 || claim.spec.diskGib > 65536 || !["none", "luks2"].includes(diskEncryption) || !Number.isInteger(claim.spec.egressGuaranteedMbps) || claim.spec.egressGuaranteedMbps < 0 || !Number.isInteger(claim.spec.egressBurstMbps) || claim.spec.egressBurstMbps < claim.spec.egressGuaranteedMbps)
     throw new MetalProvisionError("invalid compute claim");
   const image = profile.images[claim.spec.imageKey];
   if (!image || !isAbsolute(image.path) || !SHA256.test(image.sha256)) {
@@ -1126,6 +1135,9 @@ async function provisionMetalGuest(profile, claim, exec) {
   const prior = manifests.find((row) => row.computeKey === claim.computeKey);
   if (prior && prior.reference !== claim.spec.reference)
     throw new MetalProvisionError("compute identity conflicts with host inventory");
+  if (prior && (prior.diskEncryption ?? "none") !== diskEncryption) {
+    throw new MetalProvisionError("an allocated guest disk encryption mode is immutable");
+  }
   const address = requestedAddress(profile, claim, manifests);
   const cpuPool = allocateCpuPool(profile, claim, manifests);
   const manifest = prior ?? {
@@ -1137,6 +1149,7 @@ async function provisionMetalGuest(profile, claim, exec) {
     cpuPoolKey: cpuPool.key,
     allowedCpus: cpuPool.cpus,
     allowedMemoryNodes: cpuPool.memoryNodes,
+    diskEncryption,
     phase: "allocating"
   };
   const save = () => writeFileSync2(manifestPath, `${JSON.stringify(manifest, null, 2)}
@@ -1146,8 +1159,70 @@ async function provisionMetalGuest(profile, claim, exec) {
   const exists = (await exec(["lvs", "--noheadings", lv])).exitCode === 0;
   if (!exists)
     await checked(exec, ["lvcreate", "-y", "-n", name, "-L", `${claim.spec.diskGib}G`, profile.volumeGroup]);
+  const encrypted = diskEncryption === "luks2";
+  const mapper = `fz-${createHash2("sha256").update(claim.computeKey).digest("hex").slice(0, 20)}`;
+  const mappedDisk = `/dev/mapper/${mapper}`;
+  const credentialName = `guest-disk-${createHash2("sha256").update(claim.computeKey).digest("hex").slice(0, 20)}`;
+  const credentialPath = `/etc/forgezero/creds/${credentialName}.cred`;
+  const keyPath = `/run/forgezero/${credentialName}.key`;
+  let imageTarget = lv;
+  if (encrypted) {
+    mkdirSync2(dirname2(credentialPath), { recursive: true, mode: 448 });
+    mkdirSync2(dirname2(keyPath), { recursive: true, mode: 448 });
+    if (existsSync2(keyPath))
+      unlinkSync2(keyPath);
+    if (!existsSync2(credentialPath)) {
+      if (exists && (await exec(["cryptsetup", "isLuks", lv])).exitCode === 0) {
+        throw new MetalProvisionError("encrypted guest disk exists without its sealed unlock credential");
+      }
+      writeFileSync2(keyPath, randomBytes(64), { mode: 384, flag: "wx" });
+      try {
+        await checked(exec, ["systemd-creds", "encrypt", `--name=${credentialName}`, keyPath, credentialPath]);
+        chmodSync2(credentialPath, 384);
+      } catch (cause) {
+        if (existsSync2(credentialPath))
+          unlinkSync2(credentialPath);
+        throw cause;
+      }
+    } else {
+      await checked(exec, ["systemd-creds", "decrypt", `--name=${credentialName}`, credentialPath, keyPath]);
+    }
+    try {
+      if ((await exec(["cryptsetup", "isLuks", lv])).exitCode !== 0) {
+        await checked(exec, [
+          "cryptsetup",
+          "luksFormat",
+          "--batch-mode",
+          "--type",
+          "luks2",
+          "--cipher",
+          "aes-xts-plain64",
+          "--key-size",
+          "512",
+          "--key-file",
+          keyPath,
+          lv
+        ]);
+      }
+      if ((await exec(["cryptsetup", "status", mapper])).exitCode !== 0) {
+        await checked(exec, ["cryptsetup", "open", "--type", "luks2", "--key-file", keyPath, lv, mapper]);
+      }
+      imageTarget = mappedDisk;
+      if (manifest.phase === "allocating") {
+        await checked(exec, ["qemu-img", "convert", "-O", "raw", image.path, imageTarget]);
+        manifest.phase = "image-ready";
+        save();
+      }
+    } finally {
+      if (existsSync2(keyPath))
+        unlinkSync2(keyPath);
+      if ((await exec(["cryptsetup", "status", mapper])).exitCode === 0) {
+        await checked(exec, ["cryptsetup", "close", mapper]);
+      }
+    }
+  }
   if (manifest.phase === "allocating") {
-    await checked(exec, ["qemu-img", "convert", "-O", "raw", image.path, lv]);
+    await checked(exec, ["qemu-img", "convert", "-O", "raw", image.path, imageTarget]);
     manifest.phase = "image-ready";
     save();
   }
@@ -1171,7 +1246,8 @@ async function provisionMetalGuest(profile, claim, exec) {
     memoryGib: claim.spec.memoryGib,
     allowedCpus: manifest.allowedCpus,
     allowedMemoryNodes: manifest.allowedMemoryNodes,
-    disk: lv,
+    disk: encrypted ? mappedDisk : lv,
+    ...encrypted ? { diskEncryption: { source: lv, mapper, credentialName, credentialPath } } : {},
     seed,
     bridge: profile.bridge,
     mac: manifest.mac,
@@ -1229,6 +1305,7 @@ function legacyPlatformManifest(profile, claim, name) {
     cpuPoolKey: claim.spec.cpuPoolKey ?? "",
     allowedCpus: values.get("CPUSET") ?? "",
     allowedMemoryNodes: values.get("NUMA"),
+    diskEncryption: "none",
     phase: "running",
     disk,
     unit: `forgezero-guest@${name}.service`
@@ -1243,6 +1320,9 @@ async function removeMetalGuest(profile, claim, exec) {
   const service = `forgezero-guest@${name}.service`;
   const unitPath = join2(profile.unitDir, service);
   const lv = `/dev/${profile.volumeGroup}/${name}`;
+  const mapper = `fz-${createHash2("sha256").update(claim.computeKey).digest("hex").slice(0, 20)}`;
+  const credentialName = `guest-disk-${createHash2("sha256").update(claim.computeKey).digest("hex").slice(0, 20)}`;
+  const credentialPath = `/etc/forgezero/creds/${credentialName}.cred`;
   const manifest = existsSync2(manifestPath) ? JSON.parse(readFileSync2(manifestPath, "utf8")) : legacyPlatformManifest(profile, claim, name);
   if (!manifest) {
     const seedBase = join2(profile.seedDir, name);
@@ -1277,9 +1357,14 @@ async function removeMetalGuest(profile, claim, exec) {
   else if ((await exec(["systemctl", "is-active", service])).exitCode === 0) {
     throw new MetalProvisionError("guest unit is active but its owned unit file is missing");
   }
+  const encrypted = (manifest.diskEncryption ?? "none") === "luks2";
+  if (encrypted && (await exec(["cryptsetup", "status", mapper])).exitCode === 0) {
+    throw new MetalProvisionError("guest disk mapping remained active after the guest stopped");
+  }
   if ((await exec(["lvs", "--noheadings", lv])).exitCode === 0)
     await checked(exec, ["lvremove", "-fy", lv]);
   for (const path2 of [
+    ...encrypted ? [credentialPath] : [],
     unitPath,
     join2(profile.seedDir, `${name}-seed.iso`),
     join2(profile.seedDir, `${name}-user-data`),

package/dist/operator-bootstrap.js

@@ -1460,7 +1460,7 @@ var UPDATE_RETRY_BASE_MS = 5 * 60000;
 var UPDATE_RETRY_MAX_MS = 24 * 60 * 60000;
 
 // src/version.ts
-var VERSION = "0.1.134";
+var VERSION = "0.1.136";
 
 // src/software.ts
 var PINNED_BUN_VERSION = "1.3.14";
@@ -3070,6 +3070,10 @@ function validatePlatformGenesisGuests(guests, expectedCount = 3) {
       throw new Error("platform genesis vCPU count cannot be smaller than physical cores");
     const memoryGib = integer(input.memoryGib, 1, 8192, "memory");
     const diskGib = integer(input.diskGib, 8, 65536, "disk");
+    const diskEncryption = input.diskEncryption ?? "none";
+    if (!["none", "luks2"].includes(diskEncryption)) {
+      throw new Error("platform genesis disk encryption mode is unsupported");
+    }
     const egressGuaranteedMbps = integer(input.egressGuaranteedMbps, 0, 1e6, "guaranteed egress");
     const egressBurstMbps = integer(input.egressBurstMbps, egressGuaranteedMbps, 1e6, "burst egress");
     return {
@@ -3081,6 +3085,7 @@ function validatePlatformGenesisGuests(guests, expectedCount = 3) {
       vcpu,
       memoryGib,
       diskGib,
+      diskEncryption,
       egressGuaranteedMbps,
       egressBurstMbps,
       confidential: input.confidential
@@ -3111,6 +3116,7 @@ var claimFor = (guest, keys, action) => {
       vcpu: guest.vcpu,
       memoryGib: guest.memoryGib,
       diskGib: guest.diskGib,
+      diskEncryption: guest.diskEncryption,
       egressGuaranteedMbps: guest.egressGuaranteedMbps,
       egressBurstMbps: guest.egressBurstMbps,
       confidential: guest.confidential
@@ -3200,6 +3206,7 @@ function validatePlatformInitialInventory(value) {
       "vcpu",
       "memoryGib",
       "diskGib",
+      "diskEncryption",
       "egressGuaranteedMbps",
       "egressBurstMbps",
       "confidential",
@@ -5230,6 +5237,7 @@ function strictBootstrapDocument(value) {
           "vcpu",
           "memoryGib",
           "diskGib",
+          "diskEncryption",
           "egressGuaranteedMbps",
           "egressBurstMbps",
           "confidential",
@@ -6194,6 +6202,7 @@ async function applyMetalBootstrap(config, options) {
     "qemu-utils",
     "cloud-image-utils",
     "lvm2",
+    "cryptsetup",
     "nftables",
     "curl",
     "ca-certificates"
@@ -6634,11 +6643,12 @@ var validateMetalRequestValue = (value, options = {}) => {
       "vcpu",
       "memoryGib",
       "diskGib",
+      "diskEncryption",
       "egressGuaranteedMbps",
       "egressBurstMbps",
       "confidential"
     ], label);
-    if (typeof row.name !== "string" || typeof row.address !== "string" || typeof row.imageKey !== "string" || row.cpuPoolKey !== undefined && typeof row.cpuPoolKey !== "string" || !["physicalCores", "vcpu", "memoryGib", "diskGib", "egressGuaranteedMbps", "egressBurstMbps"].every((key) => typeof row[key] === "number") || typeof row.confidential !== "boolean") {
+    if (typeof row.name !== "string" || typeof row.address !== "string" || typeof row.imageKey !== "string" || row.cpuPoolKey !== undefined && typeof row.cpuPoolKey !== "string" || !["physicalCores", "vcpu", "memoryGib", "diskGib", "egressGuaranteedMbps", "egressBurstMbps"].every((key) => typeof row[key] === "number") || row.diskEncryption !== undefined && !["none", "luks2"].includes(row.diskEncryption) || typeof row.confidential !== "boolean") {
       throw new Error(`${label} has invalid resource coordinates`);
     }
     return {
@@ -6650,6 +6660,7 @@ var validateMetalRequestValue = (value, options = {}) => {
       vcpu: row.vcpu,
       memoryGib: row.memoryGib,
       diskGib: row.diskGib,
+      diskEncryption: row.diskEncryption ?? "none",
       egressGuaranteedMbps: row.egressGuaranteedMbps,
       egressBurstMbps: row.egressBurstMbps,
       confidential: row.confidential

package/dist/platform-bootstrap-runtime.d.ts

@@ -11,6 +11,7 @@ export interface PlatformInitialInventoryCompute {
     vcpu: number;
     memoryGib: number;
     diskGib: number;
+    diskEncryption?: 'none' | 'luks2';
     egressGuaranteedMbps: number;
     egressBurstMbps: number;
     confidential: true;

package/dist/platform-bootstrap-runtime.js

@@ -652,6 +652,10 @@ function validatePlatformGenesisGuests(guests, expectedCount = 3) {
       throw new Error("platform genesis vCPU count cannot be smaller than physical cores");
     const memoryGib = integer(input.memoryGib, 1, 8192, "memory");
     const diskGib = integer(input.diskGib, 8, 65536, "disk");
+    const diskEncryption = input.diskEncryption ?? "none";
+    if (!["none", "luks2"].includes(diskEncryption)) {
+      throw new Error("platform genesis disk encryption mode is unsupported");
+    }
     const egressGuaranteedMbps = integer(input.egressGuaranteedMbps, 0, 1e6, "guaranteed egress");
     const egressBurstMbps = integer(input.egressBurstMbps, egressGuaranteedMbps, 1e6, "burst egress");
     return {
@@ -663,6 +667,7 @@ function validatePlatformGenesisGuests(guests, expectedCount = 3) {
       vcpu,
       memoryGib,
       diskGib,
+      diskEncryption,
       egressGuaranteedMbps,
       egressBurstMbps,
       confidential: input.confidential
@@ -693,6 +698,7 @@ var claimFor = (guest, keys, action) => {
       vcpu: guest.vcpu,
       memoryGib: guest.memoryGib,
       diskGib: guest.diskGib,
+      diskEncryption: guest.diskEncryption,
       egressGuaranteedMbps: guest.egressGuaranteedMbps,
       egressBurstMbps: guest.egressBurstMbps,
       confidential: guest.confidential
@@ -799,6 +805,7 @@ function validatePlatformInitialInventory(value) {
       "vcpu",
       "memoryGib",
       "diskGib",
+      "diskEncryption",
       "egressGuaranteedMbps",
       "egressBurstMbps",
       "confidential",

package/dist/platform-fleet-verification.js

@@ -3049,7 +3049,7 @@ function requestSoftware(requirements, socketPath = DEFAULT_SOFTWARE_HELPER_SOCK
 }
 
 // src/version.ts
-var VERSION3 = "0.1.134";
+var VERSION3 = "0.1.136";
 
 // src/egress-policy.ts
 import { realpathSync as realpathSync3 } from "node:fs";
@@ -4168,6 +4168,10 @@ function validatePlatformGenesisGuests(guests, expectedCount = 3) {
       throw new Error("platform genesis vCPU count cannot be smaller than physical cores");
     const memoryGib = integer(input.memoryGib, 1, 8192, "memory");
     const diskGib = integer(input.diskGib, 8, 65536, "disk");
+    const diskEncryption = input.diskEncryption ?? "none";
+    if (!["none", "luks2"].includes(diskEncryption)) {
+      throw new Error("platform genesis disk encryption mode is unsupported");
+    }
     const egressGuaranteedMbps = integer(input.egressGuaranteedMbps, 0, 1e6, "guaranteed egress");
     const egressBurstMbps = integer(input.egressBurstMbps, egressGuaranteedMbps, 1e6, "burst egress");
     return {
@@ -4179,6 +4183,7 @@ function validatePlatformGenesisGuests(guests, expectedCount = 3) {
       vcpu,
       memoryGib,
       diskGib,
+      diskEncryption,
       egressGuaranteedMbps,
       egressBurstMbps,
       confidential: input.confidential
@@ -4209,6 +4214,7 @@ var claimFor = (guest, keys, action) => {
       vcpu: guest.vcpu,
       memoryGib: guest.memoryGib,
       diskGib: guest.diskGib,
+      diskEncryption: guest.diskEncryption,
       egressGuaranteedMbps: guest.egressGuaranteedMbps,
       egressBurstMbps: guest.egressBurstMbps,
       confidential: guest.confidential
@@ -4315,6 +4321,7 @@ function validatePlatformInitialInventory(value) {
       "vcpu",
       "memoryGib",
       "diskGib",
+      "diskEncryption",
       "egressGuaranteedMbps",
       "egressBurstMbps",
       "confidential",

package/dist/platform-genesis.d.ts

@@ -14,6 +14,7 @@ export interface PlatformGenesisGuest {
     vcpu: number;
     memoryGib: number;
     diskGib: number;
+    diskEncryption?: 'none' | 'luks2';
     egressGuaranteedMbps: number;
     egressBurstMbps: number;
     confidential: boolean;

package/dist/platform-genesis.js

@@ -652,6 +652,10 @@ function validatePlatformGenesisGuests(guests, expectedCount = 3) {
       throw new Error("platform genesis vCPU count cannot be smaller than physical cores");
     const memoryGib = integer(input.memoryGib, 1, 8192, "memory");
     const diskGib = integer(input.diskGib, 8, 65536, "disk");
+    const diskEncryption = input.diskEncryption ?? "none";
+    if (!["none", "luks2"].includes(diskEncryption)) {
+      throw new Error("platform genesis disk encryption mode is unsupported");
+    }
     const egressGuaranteedMbps = integer(input.egressGuaranteedMbps, 0, 1e6, "guaranteed egress");
     const egressBurstMbps = integer(input.egressBurstMbps, egressGuaranteedMbps, 1e6, "burst egress");
     return {
@@ -663,6 +667,7 @@ function validatePlatformGenesisGuests(guests, expectedCount = 3) {
       vcpu,
       memoryGib,
       diskGib,
+      diskEncryption,
       egressGuaranteedMbps,
       egressBurstMbps,
       confidential: input.confidential
@@ -693,6 +698,7 @@ var claimFor = (guest, keys, action) => {
       vcpu: guest.vcpu,
       memoryGib: guest.memoryGib,
       diskGib: guest.diskGib,
+      diskEncryption: guest.diskEncryption,
       egressGuaranteedMbps: guest.egressGuaranteedMbps,
       egressBurstMbps: guest.egressBurstMbps,
       confidential: guest.confidential

package/dist/provision.js

@@ -3049,7 +3049,7 @@ function requestSoftware(requirements, socketPath = DEFAULT_SOFTWARE_HELPER_SOCK
 }
 
 // src/version.ts
-var VERSION3 = "0.1.134";
+var VERSION3 = "0.1.136";
 
 // src/egress-policy.ts
 import { realpathSync as realpathSync3 } from "node:fs";

package/dist/provisioning-pull.d.ts

@@ -17,6 +17,8 @@ interface RemoteProvisionClaimBase {
         vcpu: number;
         memoryGib: number;
         diskGib: number;
+        /** Absent only on pre-encryption claims; normalized to `none` by the Metal Agent. */
+        diskEncryption?: 'none' | 'luks2';
         egressGuaranteedMbps: number;
         egressBurstMbps: number;
         confidential: boolean;

package/dist/version.d.ts

@@ -1,2 +1,2 @@
 /** One package version shared by both public binaries. Pinned to package.json by tests. */
-export declare const VERSION = "0.1.134";
+export declare const VERSION = "0.1.136";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@forgezero/agent",
-  "version": "0.1.134",
+  "version": "0.1.136",
   "type": "module",
   "scripts": {
     "check": "tsc --noEmit",