@forgezero/agent 0.1.135 → 0.1.137

package/README.md

@@ -101,7 +101,7 @@ export default defineDeployment({
 	  provisioning: {
 	    regionKey: 'default', imageKey: 'ubuntu-24.04-x64', environmentKey: 'production', ownership: 'platform',
 	    resources: {
-	      physicalCores: 1, vcpu: 2, memoryGib: 2, diskGib: 16,
+	      physicalCores: 1, vcpu: 2, memoryGib: 2, diskGib: 16, diskEncryption: 'luks2',
 	      egressGuaranteedMbps: 100, egressBurstMbps: 200, confidential: false
 	    },
 	    monthlyAmountCents: '1200', maxMonthlySpendMinor: '25000'

package/dist/agent-heartbeat.js

@@ -917,7 +917,7 @@ async function postSignedNode(options, path, body) {
 }
 
 // src/version.ts
-var VERSION3 = "0.1.135";
+var VERSION3 = "0.1.137";
 
 // src/agent-heartbeat.ts
 function readAgentHostMetrics() {

package/dist/bootstrap.js

@@ -1460,7 +1460,7 @@ var UPDATE_RETRY_BASE_MS = 5 * 60000;
 var UPDATE_RETRY_MAX_MS = 24 * 60 * 60000;
 
 // src/version.ts
-var VERSION = "0.1.135";
+var VERSION = "0.1.137";
 
 // src/software.ts
 var PINNED_BUN_VERSION = "1.3.14";
@@ -3070,6 +3070,10 @@ function validatePlatformGenesisGuests(guests, expectedCount = 3) {
       throw new Error("platform genesis vCPU count cannot be smaller than physical cores");
     const memoryGib = integer(input.memoryGib, 1, 8192, "memory");
     const diskGib = integer(input.diskGib, 8, 65536, "disk");
+    const diskEncryption = input.diskEncryption ?? "none";
+    if (!["none", "luks2"].includes(diskEncryption)) {
+      throw new Error("platform genesis disk encryption mode is unsupported");
+    }
     const egressGuaranteedMbps = integer(input.egressGuaranteedMbps, 0, 1e6, "guaranteed egress");
     const egressBurstMbps = integer(input.egressBurstMbps, egressGuaranteedMbps, 1e6, "burst egress");
     return {
@@ -3081,6 +3085,7 @@ function validatePlatformGenesisGuests(guests, expectedCount = 3) {
       vcpu,
       memoryGib,
       diskGib,
+      diskEncryption,
       egressGuaranteedMbps,
       egressBurstMbps,
       confidential: input.confidential
@@ -3111,6 +3116,7 @@ var claimFor = (guest, keys, action) => {
       vcpu: guest.vcpu,
       memoryGib: guest.memoryGib,
       diskGib: guest.diskGib,
+      diskEncryption: guest.diskEncryption,
       egressGuaranteedMbps: guest.egressGuaranteedMbps,
       egressBurstMbps: guest.egressBurstMbps,
       confidential: guest.confidential
@@ -3200,6 +3206,7 @@ function validatePlatformInitialInventory(value) {
       "vcpu",
       "memoryGib",
       "diskGib",
+      "diskEncryption",
       "egressGuaranteedMbps",
       "egressBurstMbps",
       "confidential",
@@ -5230,6 +5237,7 @@ function strictBootstrapDocument(value) {
           "vcpu",
           "memoryGib",
           "diskGib",
+          "diskEncryption",
           "egressGuaranteedMbps",
           "egressBurstMbps",
           "confidential",

package/dist/compute.d.ts

@@ -35,6 +35,13 @@ export interface GuestSpec {
     memoryGib: number;
     /** Block device or image path. Raw LVM on our metal; a file is allowed. */
     disk: string;
+    /** Host-at-rest LUKS2 envelope. The key is a host-sealed systemd credential. */
+    diskEncryption?: {
+        source: string;
+        mapper: string;
+        credentialName: string;
+        credentialPath: string;
+    };
     /** cloud-init seed, attached read-only. */
     seed: string;
     bridge: string;

package/dist/compute.js

@@ -56,6 +56,10 @@ function guestUnit(spec) {
     `ExecStopPost=-/usr/sbin/ip link del ${spec.tap}`
   ].join(`
 `) : "";
+  const encryptedDisk = spec.diskEncryption ? `LoadCredentialEncrypted=${spec.diskEncryption.credentialName}:${spec.diskEncryption.credentialPath}
+ExecStartPre=/usr/sbin/cryptsetup open --type luks2 --key-file %d/${spec.diskEncryption.credentialName} ${spec.diskEncryption.source} ${spec.diskEncryption.mapper}
+ExecStopPost=-/usr/sbin/cryptsetup close ${spec.diskEncryption.mapper}
+` : "";
   return `[Unit]
 Description=ForgeZero guest ${spec.name}
 Documentation=https://www.forgezero.net
@@ -65,7 +69,7 @@ Wants=network-online.target
 [Service]
 Type=simple
 Slice=forgezero-guests.slice
-${tapSetup}
+${encryptedDisk}${tapSetup}
 ExecStart=${argv}
 Restart=always
 RestartSec=5

package/dist/deploy-compiler.d.ts

@@ -20,6 +20,7 @@ export interface DeploymentInitProvisioning {
         vcpu: number;
         memoryGib: number;
         diskGib: number;
+        diskEncryption?: 'none' | 'luks2';
         egressGuaranteedMbps: number;
         egressBurstMbps: number;
         confidential: boolean;

package/dist/deploy-compiler.js

@@ -928,11 +928,13 @@ function compileDeployment(sourceValue) {
       if (provisioning.metalHostname !== undefined && !/^(?=.{1,253}$)[A-Za-z0-9](?:[A-Za-z0-9.-]*[A-Za-z0-9])?$/.test(String(provisioning.metalHostname)))
         fail(`deployment.spec.targets.${targetName}.provisioning.metalHostname`, "is invalid.");
       const provisionedResources = object(provisioning.resources, `deployment.spec.targets.${targetName}.provisioning.resources`);
-      exact3(provisionedResources, ["physicalCores", "vcpu", "memoryGib", "diskGib", "egressGuaranteedMbps", "egressBurstMbps", "confidential"], `deployment.spec.targets.${targetName}.provisioning.resources`);
+      exact3(provisionedResources, ["physicalCores", "vcpu", "memoryGib", "diskGib", "diskEncryption", "egressGuaranteedMbps", "egressBurstMbps", "confidential"], `deployment.spec.targets.${targetName}.provisioning.resources`);
       integer(provisionedResources.physicalCores, `deployment.spec.targets.${targetName}.provisioning.resources.physicalCores`, 1, 1024);
       integer(provisionedResources.vcpu, `deployment.spec.targets.${targetName}.provisioning.resources.vcpu`, 1, 4096);
       integer(provisionedResources.memoryGib, `deployment.spec.targets.${targetName}.provisioning.resources.memoryGib`, 1, 4194304);
       integer(provisionedResources.diskGib, `deployment.spec.targets.${targetName}.provisioning.resources.diskGib`, 1, 1048576);
+      if (provisionedResources.diskEncryption !== undefined && !["none", "luks2"].includes(String(provisionedResources.diskEncryption)))
+        fail(`deployment.spec.targets.${targetName}.provisioning.resources.diskEncryption`, "must be none or luks2.");
       integer(provisionedResources.egressGuaranteedMbps, `deployment.spec.targets.${targetName}.provisioning.resources.egressGuaranteedMbps`, 0, 1e7);
       integer(provisionedResources.egressBurstMbps, `deployment.spec.targets.${targetName}.provisioning.resources.egressBurstMbps`, Number(provisionedResources.egressGuaranteedMbps), 1e7);
       if (typeof provisionedResources.confidential !== "boolean")
@@ -1305,7 +1307,7 @@ function initCoordinates(options) {
       if (!/^[a-z][a-z0-9-]{0,62}$/.test(value))
         throw new Error(`deployment provisioning ${label} must be a lowercase typed name`);
     const resources = options.provisioning.resources;
-    for (const [label, value] of Object.entries(resources).filter(([key]) => key !== "confidential")) {
+    for (const [label, value] of Object.entries(resources).filter(([key]) => !["confidential", "diskEncryption"].includes(key))) {
       if (!Number.isSafeInteger(value) || Number(value) < 0)
         throw new Error(`deployment provisioning ${label} must be a non-negative integer`);
     }
@@ -1314,6 +1316,8 @@ function initCoordinates(options) {
     }
     if (result.isolation === "sev-snp" && !resources.confidential)
       throw new Error("deployment provisioning must provide confidential capacity for sev-snp");
+    if (resources.diskEncryption !== undefined && !["none", "luks2"].includes(resources.diskEncryption))
+      throw new Error("deployment provisioning disk encryption mode is unsupported");
     if (!/^\d{1,18}$/.test(options.provisioning.monthlyAmountCents))
       throw new Error("deployment provisioning monthly amount must be a bounded USD-cent amount");
     if (!/^\d{1,18}$/.test(options.provisioning.maxMonthlySpendMinor))
@@ -1325,7 +1329,10 @@ function initCoordinates(options) {
     if (options.provisioning.metalHostname && !/^(?=.{1,253}$)[A-Za-z0-9](?:[A-Za-z0-9.-]*[A-Za-z0-9])?$/.test(options.provisioning.metalHostname))
       throw new Error("deployment provisioning metal hostname is invalid");
   }
-  return { ...result, ...options.provisioning ? { provisioning: options.provisioning } : {} };
+  return { ...result, ...options.provisioning ? { provisioning: {
+    ...options.provisioning,
+    resources: { ...options.provisioning.resources, diskEncryption: options.provisioning.resources.diskEncryption ?? "luks2" }
+  } } : {} };
 }
 function defaultTypeScriptDeployment(name, options = {}) {
   const selected = initCoordinates(options);

package/dist/deploy-plan-runner.js

@@ -928,11 +928,13 @@ function compileDeployment(sourceValue) {
       if (provisioning.metalHostname !== undefined && !/^(?=.{1,253}$)[A-Za-z0-9](?:[A-Za-z0-9.-]*[A-Za-z0-9])?$/.test(String(provisioning.metalHostname)))
         fail(`deployment.spec.targets.${targetName}.provisioning.metalHostname`, "is invalid.");
       const provisionedResources = object(provisioning.resources, `deployment.spec.targets.${targetName}.provisioning.resources`);
-      exact3(provisionedResources, ["physicalCores", "vcpu", "memoryGib", "diskGib", "egressGuaranteedMbps", "egressBurstMbps", "confidential"], `deployment.spec.targets.${targetName}.provisioning.resources`);
+      exact3(provisionedResources, ["physicalCores", "vcpu", "memoryGib", "diskGib", "diskEncryption", "egressGuaranteedMbps", "egressBurstMbps", "confidential"], `deployment.spec.targets.${targetName}.provisioning.resources`);
       integer(provisionedResources.physicalCores, `deployment.spec.targets.${targetName}.provisioning.resources.physicalCores`, 1, 1024);
       integer(provisionedResources.vcpu, `deployment.spec.targets.${targetName}.provisioning.resources.vcpu`, 1, 4096);
       integer(provisionedResources.memoryGib, `deployment.spec.targets.${targetName}.provisioning.resources.memoryGib`, 1, 4194304);
       integer(provisionedResources.diskGib, `deployment.spec.targets.${targetName}.provisioning.resources.diskGib`, 1, 1048576);
+      if (provisionedResources.diskEncryption !== undefined && !["none", "luks2"].includes(String(provisionedResources.diskEncryption)))
+        fail(`deployment.spec.targets.${targetName}.provisioning.resources.diskEncryption`, "must be none or luks2.");
       integer(provisionedResources.egressGuaranteedMbps, `deployment.spec.targets.${targetName}.provisioning.resources.egressGuaranteedMbps`, 0, 1e7);
       integer(provisionedResources.egressBurstMbps, `deployment.spec.targets.${targetName}.provisioning.resources.egressBurstMbps`, Number(provisionedResources.egressGuaranteedMbps), 1e7);
       if (typeof provisionedResources.confidential !== "boolean")

package/dist/deploy-plan.js

@@ -928,11 +928,13 @@ function compileDeployment(sourceValue) {
       if (provisioning.metalHostname !== undefined && !/^(?=.{1,253}$)[A-Za-z0-9](?:[A-Za-z0-9.-]*[A-Za-z0-9])?$/.test(String(provisioning.metalHostname)))
         fail(`deployment.spec.targets.${targetName}.provisioning.metalHostname`, "is invalid.");
       const provisionedResources = object(provisioning.resources, `deployment.spec.targets.${targetName}.provisioning.resources`);
-      exact3(provisionedResources, ["physicalCores", "vcpu", "memoryGib", "diskGib", "egressGuaranteedMbps", "egressBurstMbps", "confidential"], `deployment.spec.targets.${targetName}.provisioning.resources`);
+      exact3(provisionedResources, ["physicalCores", "vcpu", "memoryGib", "diskGib", "diskEncryption", "egressGuaranteedMbps", "egressBurstMbps", "confidential"], `deployment.spec.targets.${targetName}.provisioning.resources`);
       integer(provisionedResources.physicalCores, `deployment.spec.targets.${targetName}.provisioning.resources.physicalCores`, 1, 1024);
       integer(provisionedResources.vcpu, `deployment.spec.targets.${targetName}.provisioning.resources.vcpu`, 1, 4096);
       integer(provisionedResources.memoryGib, `deployment.spec.targets.${targetName}.provisioning.resources.memoryGib`, 1, 4194304);
       integer(provisionedResources.diskGib, `deployment.spec.targets.${targetName}.provisioning.resources.diskGib`, 1, 1048576);
+      if (provisionedResources.diskEncryption !== undefined && !["none", "luks2"].includes(String(provisionedResources.diskEncryption)))
+        fail(`deployment.spec.targets.${targetName}.provisioning.resources.diskEncryption`, "must be none or luks2.");
       integer(provisionedResources.egressGuaranteedMbps, `deployment.spec.targets.${targetName}.provisioning.resources.egressGuaranteedMbps`, 0, 1e7);
       integer(provisionedResources.egressBurstMbps, `deployment.spec.targets.${targetName}.provisioning.resources.egressBurstMbps`, Number(provisionedResources.egressGuaranteedMbps), 1e7);
       if (typeof provisionedResources.confidential !== "boolean")

package/dist/deploy.d.ts

@@ -195,6 +195,7 @@ export interface TargetDefinition {
             vcpu: number;
             memoryGib: number;
             diskGib: number;
+            diskEncryption?: 'none' | 'luks2';
             egressGuaranteedMbps: number;
             egressBurstMbps: number;
             confidential: boolean;

package/dist/deployment.d.ts

@@ -139,6 +139,7 @@ export interface ResolvedDeploymentTarget {
             vcpu: number;
             memoryGib: number;
             diskGib: number;
+            diskEncryption?: 'none' | 'luks2';
             egressGuaranteedMbps: number;
             egressBurstMbps: number;
             confidential: boolean;