mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-08 11:46:35 +00:00
kevinveenbirkenbachandClaude Opus 5.5
660ad2ff16
The frontend and its sso, logout, dashboard and prometheus consumers were
gated on 'svc-net-tor' not in group_names, written when a Tor node served
onion only. On a multi node that removed the clearnet filer vhost, so the
storage specs of every SeaweedFS consumer failed on a clearnet pick with
ERR_SSL_UNRECOGNIZED_NAME_ALERT on filer.<domain>.
lookup('network_served', <network>, *role_ids) answers whether the node's
resolved NETWORK_MODE serves a network and every named role is deployed.
The gates use it instead of restating the mode resolution and the provider
check, so the frontend now drops only on a tor-only node. is_explicit_truth
registers the lookup in GATED_LOOKUPS so the static closure still reads
those flags as dynamic, and the dynamic-flag and universal-logout checks ask
is_explicit_truth instead of matching "in group_names" themselves.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
52 lines
2.0 KiB
Python
52 lines
2.0 KiB
Python
import unittest
|
|
|
|
from ansible.errors import AnsibleError
|
|
|
|
import plugins.lookup.network_served as served_mod
|
|
|
|
|
|
class TestNetworkServedLookup(unittest.TestCase):
|
|
def _run(self, name, **variables):
|
|
return served_mod.LookupModule().run([name], variables=variables)[0]
|
|
|
|
def test_a_node_without_tor_serves_clearnet_only(self):
|
|
self.assertTrue(self._run("clearnet", group_names=["web-app-x"]))
|
|
self.assertFalse(self._run("tor", group_names=["web-app-x"]))
|
|
|
|
def test_a_tor_node_without_a_mode_serves_both(self):
|
|
self.assertTrue(self._run("clearnet", group_names=["svc-net-tor"]))
|
|
self.assertTrue(self._run("tor", group_names=["svc-net-tor"]))
|
|
|
|
def test_a_tor_only_node_drops_clearnet(self):
|
|
self.assertFalse(
|
|
self._run("clearnet", group_names=["svc-net-tor"], NETWORK_MODE="tor")
|
|
)
|
|
|
|
def test_a_tor_node_pinned_to_clearnet_drops_tor(self):
|
|
self.assertFalse(
|
|
self._run("tor", group_names=["svc-net-tor"], NETWORK_MODE="clearnet")
|
|
)
|
|
|
|
def test_a_named_role_must_be_deployed(self):
|
|
lookup = served_mod.LookupModule()
|
|
variables = {"group_names": ["svc-net-tor", "web-app-keycloak"]}
|
|
self.assertTrue(lookup.run(["clearnet", "web-app-keycloak"], variables=variables)[0])
|
|
self.assertFalse(lookup.run(["clearnet", "web-app-dashboard"], variables=variables)[0])
|
|
|
|
def test_a_deployed_role_on_a_tor_only_node_stays_off(self):
|
|
lookup = served_mod.LookupModule()
|
|
variables = {"group_names": ["svc-net-tor", "web-app-keycloak"], "NETWORK_MODE": "tor"}
|
|
self.assertFalse(lookup.run(["clearnet", "web-app-keycloak"], variables=variables)[0])
|
|
|
|
def test_a_mode_the_node_cannot_serve_fails_loudly(self):
|
|
with self.assertRaises(AnsibleError):
|
|
self._run("clearnet", group_names=["web-app-x"], NETWORK_MODE="tor")
|
|
|
|
def test_an_unknown_network_fails_loudly(self):
|
|
with self.assertRaises(AnsibleError):
|
|
self._run("handshake", group_names=["svc-net-tor"])
|
|
|
|
|
|
if __name__ == "__main__":
|
|
unittest.main()
|