mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-07 19:32:17 +00:00
evangelostsak
4be2a381ab
auto rotates, enforced meshes every swarm row, disabled meshes none. No exclusive: every swarm row can take the mesh, so there is nothing to drop. A run that holds the axis outranks a per-token pin, because an operator who asked for a whole sweep on one side means it.
88 lines
2.8 KiB
Python
88 lines
2.8 KiB
Python
"""The WireGuard-mesh axis of a deploy row.
|
|
|
|
Split out beside ``tor.py`` for the same reason: one axis, its modes, its
|
|
rotation and its glyph pairing belong together rather than spread through the
|
|
assigner.
|
|
|
|
A swarm deploy runs either over the mesh or straight over the underlay, and
|
|
both have to keep working -- the mesh joins physically separated clusters, so a
|
|
single-site swarm has no use for it and must not depend on it. Rotating the
|
|
axis proves both arms instead of proving one and assuming the other.
|
|
"""
|
|
|
|
from __future__ import annotations
|
|
|
|
import os
|
|
|
|
VPN_MODES = ("auto", "enforced", "disabled")
|
|
"""How a run treats the axis. ``auto`` rotates it, the other two hold every
|
|
swarm row on one side so a whole sweep can be spent proving that side. There is
|
|
no ``exclusive``: every swarm row can take the mesh, so there is nothing to
|
|
drop."""
|
|
|
|
VPN_DEPLOY_MODES = ("swarm",)
|
|
"""Modes the mesh is meaningful in. Compose is a single host, so there is
|
|
nothing to tunnel between and the axis is always off there."""
|
|
|
|
MESH_GLYPH_MODES = VPN_DEPLOY_MODES
|
|
"""Modes whose label carries a mesh glyph at all. A compose title stays as it
|
|
was, so the existing job names do not all churn for an axis they never take."""
|
|
|
|
|
|
def resolve_vpn_mode(raw: str | None = None) -> str:
|
|
"""Mesh axis mode from ``INFINITO_VPN``; unknown or empty means ``auto``.
|
|
|
|
Args:
|
|
raw: explicit value; ``None`` reads the environment.
|
|
|
|
Returns:
|
|
one of :data:`VPN_MODES`.
|
|
"""
|
|
if raw is None:
|
|
raw = os.environ.get("INFINITO_VPN")
|
|
value = (raw or "").strip().lower()
|
|
return value if value in VPN_MODES else "auto"
|
|
|
|
|
|
def vpn_states(mode: str, *, vpn_mode: str = "auto") -> list[bool]:
|
|
"""The mesh states *mode* is worth running for a priority row."""
|
|
if mode not in VPN_DEPLOY_MODES:
|
|
return [False]
|
|
if vpn_mode == "enforced":
|
|
return [True]
|
|
if vpn_mode == "disabled":
|
|
return [False]
|
|
return [False, True]
|
|
|
|
|
|
def wants_vpn(position: int, sweep: int) -> bool:
|
|
"""Whether a swarm row carries the mesh this sweep.
|
|
|
|
Quartered on ``sweep // 4`` so it flips in step with neither the mode
|
|
rotation nor the onion: a row walks every mode/tor/vpn combination over
|
|
eight sweeps instead of re-proving the same pairing.
|
|
"""
|
|
return (position + sweep // 4) % 2 == 0
|
|
|
|
|
|
def rotated_vpn(
|
|
mode: str,
|
|
*,
|
|
position: int,
|
|
sweep: int,
|
|
pin: bool | None = None,
|
|
vpn_mode: str = "auto",
|
|
) -> bool:
|
|
"""The single mesh state a regular row takes this sweep.
|
|
|
|
A pin replaces the rotation, and a run that holds the axis replaces both:
|
|
an operator who asked for a whole sweep on one side means it.
|
|
"""
|
|
if mode not in VPN_DEPLOY_MODES:
|
|
return False
|
|
if vpn_mode in ("enforced", "disabled"):
|
|
return vpn_mode == "enforced"
|
|
if pin is not None:
|
|
return pin
|
|
return wants_vpn(position, sweep)
|