mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-09 12:17:13 +00:00
kevinveenbirkenbachandClaude Opus 5.5
eb7056dafd
Main CI run 40976399687, socialhome#0 (swarm, tor, centos): the CLI tests
of svc-net-tor (onion:25 "socks CONNECT failed with reply 0x01") and
web-app-stalwart (probe_mail relay: ConnectionRefusedError on port 25)
failed. dockerd on the manager had aborted the whole ingress program of
the mail stack:
Failed to add ingress: failed to program ingress ports:
failed to bind host port 0.0.0.0:993/tcp: address already in use
/proc/net/tcp named the squatter: 192.168.244.10:993 -> :2049, the
node's own NFS client. The mount carries no noresvport, so the kernel
drew a source port from the 665-1023 reserved window and landed on
imaps. None of 25/465/993/995/4190/8095 got a DNAT rule or a
docker-proxy listener while every other published port did, and
stalwart still reported healthy because its healthcheck runs inside the
container. 993 and 995 are the only published ports inside that window,
so this is luck of the draw on any NFS-backed swarm host that runs the
mail role.
mount_opts now emits noresvport. insecure on the kernel-flavor export is
the other half: kernel nfsd defaults to secure and answers a mount from
an unprivileged source port with EACCES. It reaches the kernel flavor
only; ganesha already accepts unprivileged clients.
What it costs: the next deploy of every existing NFS client sees a
pending opts change and remounts the shared state; a host-side job
holding that path at that instant fails loudly. A plain remount may keep
a running mount on its old reserved port until the next real mount.
Port of f46c4d0bab from feature/store-i18n, applied identically so the
later store-i18n -> main merge stays conflict-free.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
110 lines
3.7 KiB
Python
110 lines
3.7 KiB
Python
import importlib.util
|
|
import unittest
|
|
import unittest.mock as mock
|
|
|
|
from ansible.parsing.dataloader import DataLoader
|
|
from ansible.template import Templar
|
|
|
|
from utils.storage.nfs import client_src, state_path
|
|
|
|
|
|
def _run(name, variables):
|
|
"""Lookups must read resolved values from `variables`; templar.template('{{..}}')
|
|
no-ops on untrusted strings in ansible 2.19+ and emits literal Jinja into exports."""
|
|
spec = importlib.util.spec_from_file_location(name, f"plugins/lookup/{name}.py")
|
|
m = importlib.util.module_from_spec(spec)
|
|
spec.loader.exec_module(m)
|
|
lm = m.LookupModule()
|
|
lm._templar = Templar(loader=DataLoader(), variables=variables)
|
|
return lm.run([], variables=variables)[0]
|
|
|
|
|
|
BASE = {
|
|
"storage": {"nfs": {"server": "192.168.244.2"}},
|
|
"RUNTIME": "github",
|
|
}
|
|
|
|
|
|
class TestNfsLookups(unittest.TestCase):
|
|
def test_state_path_renders(self):
|
|
self.assertEqual(_run("nfs_state_path", BASE), "/srv/nfs/infinito-state")
|
|
|
|
def test_fstype_renders(self):
|
|
self.assertEqual(_run("nfs_fstype", BASE), "nfs4")
|
|
|
|
def test_mount_opts_github_soft(self):
|
|
self.assertEqual(
|
|
_run("nfs_mount_opts", BASE),
|
|
"vers=4,rw,noresvport,soft,timeo=50,retrans=3",
|
|
)
|
|
|
|
def test_mount_opts_host_hard(self):
|
|
self.assertEqual(
|
|
_run("nfs_mount_opts", {**BASE, "RUNTIME": "host"}),
|
|
"vers=4,rw,noresvport,hard,timeo=600",
|
|
)
|
|
|
|
def test_mount_opts_act_soft(self):
|
|
self.assertEqual(
|
|
_run("nfs_mount_opts", {**BASE, "RUNTIME": "act"}),
|
|
"vers=4,rw,noresvport,soft,timeo=50,retrans=3",
|
|
)
|
|
|
|
|
|
def _load(name, variables):
|
|
spec = importlib.util.spec_from_file_location(name, f"plugins/lookup/{name}.py")
|
|
m = importlib.util.module_from_spec(spec)
|
|
spec.loader.exec_module(m)
|
|
lm = m.LookupModule()
|
|
lm._templar = Templar(loader=DataLoader(), variables=variables)
|
|
lm._loader = DataLoader()
|
|
return m, lm
|
|
|
|
|
|
class TestNfsConfigBackedLookups(unittest.TestCase):
|
|
"""nfs_flavor / nfs_client_src reach the merged-config SPOT through
|
|
lookup('config') via lookup_loader, NOT a utils.cache import."""
|
|
|
|
def test_flavor_returns_config_lookup_result(self):
|
|
m, lm = _load("nfs_flavor", {})
|
|
with mock.patch.object(m, "lookup_loader") as loader:
|
|
loader.get.return_value = mock.MagicMock(run=lambda *a, **k: ["ganesha"])
|
|
self.assertEqual(lm.run([], variables={}), ["ganesha"])
|
|
|
|
def test_flavor_config_call_shape(self):
|
|
m, lm = _load("nfs_flavor", {})
|
|
calls = []
|
|
|
|
def _run(args, **kwargs):
|
|
calls.append((tuple(args), kwargs))
|
|
return ["kernel"]
|
|
|
|
with mock.patch.object(m, "lookup_loader") as loader:
|
|
loader.get.return_value = mock.MagicMock(run=_run)
|
|
lm.run([], variables={"RUNTIME": "github"})
|
|
(args, kwargs) = calls[0]
|
|
self.assertEqual(
|
|
args,
|
|
("svc-storage-nfs-server", "services.nfs-server.flavor", "kernel"),
|
|
)
|
|
self.assertEqual(kwargs.get("variables"), {"RUNTIME": "github"})
|
|
|
|
def test_client_src_kernel_v4_uses_root_mount(self):
|
|
nfs = {"server": "10.0.0.2"}
|
|
vars_ = {"storage": {"nfs": nfs}}
|
|
m, lm = _load("nfs_client_src", vars_)
|
|
with mock.patch.object(m, "lookup_loader") as loader:
|
|
loader.get.return_value = mock.MagicMock(run=lambda *a, **k: ["kernel"])
|
|
result = lm.run([], variables=vars_)
|
|
expected = client_src(
|
|
"10.0.0.2",
|
|
4,
|
|
"kernel",
|
|
state_path("/srv/nfs", "infinito-state"),
|
|
)
|
|
self.assertEqual(result, [expected])
|
|
|
|
|
|
if __name__ == "__main__":
|
|
unittest.main()
|