#!/usr/bin/env bash
# scripts/dc-cache-proxy.sh <check|install> <site> -- per-DC apt CACHING PROXY
# (apt-cacher-ng). D-135 amendment 2026-07-24 (operator-ruled): the INTERIM DC1
# apt path so the DC1 build starts WITHOUT waiting on the full ~950 GiB
# debmirror. DC0 stays the full-mirror path (D-135 item 1); DC1's proxy is
# REPLACED by a full mirror afterward. Roosevelt: cache-proxy vs full-mirror is
# a per-DC utility-node artifact-delivery choice (D-132/D-133).
#
# RUNS ON THE DC RACK HOST, invoked over ssh like dc-mirror.sh (no clone there):
# check: ssh -i <dc-key> -J voffice1 <user>@<rack-transit-ip> \
# 'sudo bash -s' -- check dc1 < scripts/dc-cache-proxy.sh
# install: same with 'install dc1' (idempotent; safe to re-run).
#
# PREREQS on the rack:
# - the utility NET LAYER (the .4 alias on metal-admin + the default route via
# the DC edge) must already be up -- it is provided by dc-mirror.sh's
# <site>-mirror-net.service, present on any site that ran the mirror install.
# This script does NOT re-create it (it REUSES it); check fails loud if absent.
# - apt-cacher-ng must be apt-installed first (fail-loud with the exact line).
#
# CONSUMPTION (Stage 5, PROXY mode -- all http apt cached, incl. UCA, no remap):
# juju model-config apt-http-proxy=http://<LISTEN>:3142
# (or per-node /etc/apt/apt.conf.d: Acquire::http::Proxy "http://<LISTEN>:3142";)
#
# EXIT: 0 ok | 1 check failed | 2 bad args/unknown site | 4 install failed.
# ASCII + LF only.
set -uo pipefail
MODE="${1:-}"; SITE="${2:-}"
case "$MODE" in check|install) ;; *)
echo "usage: dc-cache-proxy.sh <check|install> <site>" >&2; exit 2 ;; esac
# ---------------------------------------------------------------------------
# Site table. Same MEASURED/RULED utility .4 + edge gateway per DC as
# dc-mirror.sh (the proxy listens at the SAME utility address the deploy
# already expects). ADD A SITE ONLY WITH MEASURED/RULED VALUES (hard rule 2);
# the harness rejects rows without a MEASURED tag.
# ---------------------------------------------------------------------------
case "$SITE" in
dc0)
# MEASURED/RULED 2026-07-23 (D-134 amendment + D-135). NOTE: dc0's RULED
# path is the FULL MIRROR (D-135 item 1); this row exists for tooling
# parity only -- dc0 is not deployed via the proxy.
UTIL_NET="vr1-dc0-metal-admin"
LISTEN_CIDR="10.12.8.4/22"
EDGE_GW="10.12.4.1"
;;
dc1)
# MEASURED/RULED 2026-07-24 (D-135 amendment -- interim DC1 apt path):
# LISTEN 10.12.68.4 -- the D-134 utility .4, reused from the mirror-net
# layer; EDGE_GW 10.12.64.1 -- dc1 edge LAN gw (upstream egress).
UTIL_NET="vr1-dc1-metal-admin"
LISTEN_CIDR="10.12.68.4/22"
EDGE_GW="10.12.64.1"
;;
*) echo "FAIL: unknown site '$SITE' -- add a MEASURED row block first" >&2; exit 2 ;;
esac
LISTEN="${LISTEN_CIDR%%/*}"
PROXY_PORT="3142"
ACNG_DROPIN="/etc/apt-cacher-ng/acng.conf.d/${SITE}-cache-proxy.conf"
# ---------------------------------------------------------------------------
# Generated config (single source of truth for check AND install). Minimal:
# apt-cacher-ng in proxy mode caches all http apt (archive/security/UCA) with
# no per-repo remap; we only pin the port so a package-default change cannot
# move it. Default CacheDir (/var/cache/apt-cacher-ng) is kept (owner-correct).
# ---------------------------------------------------------------------------
gen_acng_dropin() {
cat <<EOF
# ${SITE} apt caching proxy -- generated by scripts/dc-cache-proxy.sh
# (D-135 amendment 2026-07-24); do not hand-edit. apt-cacher-ng proxy mode:
# caches all http apt requested by the DC nodes (archive/security/UCA), no
# per-repo remap. Consume via: juju model-config apt-http-proxy=http://${LISTEN}:${PROXY_PORT}
Port: ${PROXY_PORT}
EOF
}
# Bridge for the utility net, resolved from the libvirt net NAME at runtime
# (virbrN is auto-assigned, not stable identity -- hard rule 3).
util_bridge() {
virsh -c qemu:///system net-dumpxml "$UTIL_NET" 2>/dev/null \
| sed -n "s/.*bridge name='\([^']*\)'.*/\1/p"
}
# ---------------------------------------------------------------------------
# check -- mutate no CONFIG/service state; report and exit 0 ok / 1 incomplete.
# (The behavioral smoke test may populate the proxy cache with two Release
# files -- benign and self-managing; it is the proof the proxy actually serves.)
# ---------------------------------------------------------------------------
FAILED=0
say(){ echo " $1"; }
miss(){ echo " MISS $1"; FAILED=1; }
do_check() {
command -v apt-cacher-ng >/dev/null 2>&1 || dpkg -s apt-cacher-ng >/dev/null 2>&1 \
&& say "OK apt-cacher-ng installed" || miss "apt-cacher-ng not installed"
if [ ! -f "$ACNG_DROPIN" ]; then miss "$ACNG_DROPIN absent"; else
if diff -q <(gen_acng_dropin) "$ACNG_DROPIN" >/dev/null 2>&1; then
say "OK $ACNG_DROPIN matches"; else miss "$ACNG_DROPIN DIFFERS from generated"; fi
fi
systemctl is-active --quiet apt-cacher-ng \
&& say "OK apt-cacher-ng active" || miss "apt-cacher-ng not active"
ss -ltn 2>/dev/null | grep -q ":${PROXY_PORT} " \
&& say "OK listening on :${PROXY_PORT}" || miss "not listening on :${PROXY_PORT}"
# Utility net layer (REUSED from <site>-mirror-net.service, not owned here).
br="$(util_bridge)"
if [ -n "$br" ] && ip -4 -o addr show dev "$br" 2>/dev/null | grep -q " ${LISTEN}/"; then
say "OK ${LISTEN_CIDR} on $br ($UTIL_NET)"
else miss "${LISTEN_CIDR} absent on metal-admin bridge (run dc-mirror.sh install $SITE -- it owns the net layer)"; fi
ip route show default 2>/dev/null | grep -q "via ${EDGE_GW}" \
&& say "OK default route via edge ${EDGE_GW}" \
|| miss "default route via ${EDGE_GW} absent"
# Behavioral smoke test: fetch through the proxy (proxy mode) -- archive AND
# UCA, the two the deploy needs; proves cache-miss passthrough + upstream reach.
if command -v curl >/dev/null 2>&1; then
for u in "http://archive.ubuntu.com/ubuntu/dists/jammy/Release" \
"http://ubuntu-cloud.archive.canonical.com/ubuntu/dists/jammy-updates/caracal/Release"; do
HTTP="$(curl -s -o /dev/null -w '%{http_code}' -x "http://${LISTEN}:${PROXY_PORT}" -m 20 "$u" 2>/dev/null)"
[ "$HTTP" = "200" ] && say "OK proxy serves $u (200)" \
|| miss "proxy did NOT serve $u (got '$HTTP')"
done
fi
[ "$FAILED" -eq 0 ] && { echo "dc-cache-proxy check ($SITE): PASS"; exit 0; }
echo "dc-cache-proxy check ($SITE): FAIL"; exit 1
}
# ---------------------------------------------------------------------------
# install -- idempotent; requires root. Net layer is a PREREQ (owned by
# dc-mirror.sh), verified fail-loud; apt-cacher-ng package is fail-loud too.
# ---------------------------------------------------------------------------
do_install() {
[ "$(id -u)" = "0" ] || { echo "FAIL: install requires root" >&2; exit 4; }
umask 022
# Prereq 1: the utility net layer must be up (we reuse it, never re-create it).
br="$(util_bridge)"
if [ -z "$br" ] || ! ip -4 -o addr show dev "$br" 2>/dev/null | grep -q " ${LISTEN}/" \
|| ! ip route show default 2>/dev/null | grep -q "via ${EDGE_GW}"; then
echo "FAIL: utility net layer absent (${LISTEN} on ${UTIL_NET} + default via ${EDGE_GW})" >&2
echo " it is owned by dc-mirror.sh -- run: dc-mirror.sh install $SITE first" >&2
exit 4
fi
# Prereq 2: the package (fail-loud, like dc-mirror.sh does for debmirror/nginx).
if ! dpkg -s apt-cacher-ng >/dev/null 2>&1; then
echo "FAIL: apt-cacher-ng not installed" >&2
echo " net layer is up -- run: apt-get update && apt-get install -y apt-cacher-ng" >&2
echo " then re-run: dc-cache-proxy.sh install $SITE" >&2
exit 4
fi
mkdir -p "$(dirname "$ACNG_DROPIN")" || exit 4
gen_acng_dropin > "$ACNG_DROPIN" || exit 4
systemctl enable apt-cacher-ng >/dev/null 2>&1 || exit 4
systemctl restart apt-cacher-ng || { echo "FAIL: apt-cacher-ng restart" >&2; exit 4; }
echo "dc-cache-proxy install ($SITE): done -- running check:"
do_check
}
case "$MODE" in
check) do_check ;;
install) do_install ;;
esac
