OpenStack/openstack-caracal-dc-dc

Fork: 0

OpenStack / openstack-caracal-dc-dc

History for openstack-caracal-dc-dc / scripts / dc-snap-proxy.sh

2026-07-31	364ff12 Browse files » Snap proxy tool BUILT and REVIEWED (not yet applied); 4 real bugs logged ... Ruling 2's repo side. squid 6.14 as a dedicated instance on each DC rack at the D-134 utility .4:3129, CONNECT-only, restricted to Canonical's documented store and CDN hosts, consumed via juju snap-http-proxy/snap-https-proxy. Design cited to vendor sources, not preference: every snap endpoint is :443 so a CONNECT proxy is mandatory and CACHING IS IMPOSSIBLE (squid cannot read a CONNECT tunnel), which removes the apt-style caching argument entirely; squid is in main, tinyproxy is universe with six unevaluated CVEs and defaults to allowing all CONNECT ports. MEASUREMENTS THAT CHANGED THE DESIGN: - the failing apps are LXD containers sourcing from METAL-ADMIN (10.12.8.122), NOT the 10.12.12.116 juju status displays. An ACL on the displayed address would have denied every client the proxy exists for. - ports 3128 AND 8000 are already held wildcard-bound by MAAS's own squid on both racks -- hence 3129 and a dedicated instance. - no new D-134 octet needed: .4 is already aliased on both racks. - LOGGED NOT ADOPTED: MAAS's squid ALREADY CONNECT-proxies api.snapcraft.io, measured working from the failing container. snap-https-proxy pointed at 10.12.8.6:8000 may unblock the deploy today with nothing built. Rejected as the shipped design (per-revision path, NO destination restriction, the hidden-coupling shape D-135 already has a scar from) but it is a real operator option, not a dismissal. QUALITY: 53 mutations, 53 killed, 0 survived -- including the dc-mirror.sh existence-vs-content false-green class reproduced and caught. One survivor was a MALFORMED mutation that broke bash -n and therefore tested nothing; recorded as malformed and redone rather than counted. Three of the harness's own cases were found too weak and were STRENGTHENED, not left green. INDEPENDENT REVIEW: ruled design HONOURED on all four counts -- utility band, no direct node egress (in fact stronger: destination-allowlisted, and that scope is flagged as a build-time choice NOT a ruling), site-keyed both DCs with the dc1 limit stated honestly, and it OWNS its own network prerequisites rather than borrowing another service's -- with the coupling anti-pattern now under test (M09/M10) rather than only under comment. FOUR REAL BUGS LOGGED, NOT FIXED (hard rule 1 -- the file was frozen for review): BUG-1 dead snap_probe ACL; the probes are actually admitted by snap_clients, and the comment misdescribes its own mechanism BUG-2 \| grep -q under pipefail -- INHERITED from dc-mirror.sh and dc-cache-proxy.sh alike; a three-script sweep, not a local fix BUG-3 the deny probe's 403 shape was measured from a PORT deny, never a DSTDOMAIN deny. If squid answers differently the gate REFUSES PERMANENTLY -- and a gate that cannot PASS blocks a GA-R6 close as hard as one that cannot fail. Requires a one-time apply-time confirmation. BUG-4 dpkg -s reports a deinstall-ok-config-files package as present SIZE: 636 lines / 320 code vs dc-mirror 385/227 and dc-cache-proxy 396/200. The reviewer's landing zone is ~535/~250 and it RECOMMENDS AGAINST forcing 385 -- two extra generators (75 lines) are measured-forced because the packaged squid cannot be repointed, and further cuts would delete mutation-proven assertions. ~50 lines of the excess is header prose, which carries zero bug risk. TWO BLOCKERS BEFORE THE PLAN IS APPLIED: the S8 consolidation invalidates M32-M39/M42-M47/M49-M52 as evidence, so the mutation pass MUST be re-run; and BUG-3 must be confirmed once against the built proxy before check is cited to close anything. NOTHING IS PROVEN END TO END -- no proxy installed, no snap fetched through one. The harness green is FIXTURE green and says so. repo-lint 0 fail; gauntlet ALL GREEN (94). OWNED: my earlier teardown commit e57ad09 used 'git add -A' while the agent was writing and swept its audit capture and CURRENT-STATE paragraph into a commit about the model teardown. This commit is staged EXPLICITLY by path. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01HvCyrwvYTTcDYnRErfMsNf JANeumatrix committed 7 hours ago

2026-07-31

364ff12
Browse files »

Snap proxy tool BUILT and REVIEWED (not yet applied); 4 real bugs logged ...

Ruling 2's repo side. squid 6.14 as a dedicated instance on each DC rack at the
D-134 utility .4:3129, CONNECT-only, restricted to Canonical's documented store
and CDN hosts, consumed via juju snap-http-proxy/snap-https-proxy. Design cited
to vendor sources, not preference: every snap endpoint is :443 so a CONNECT
proxy is mandatory and CACHING IS IMPOSSIBLE (squid cannot read a CONNECT
tunnel), which removes the apt-style caching argument entirely; squid is in
main, tinyproxy is universe with six unevaluated CVEs and defaults to allowing
all CONNECT ports.

MEASUREMENTS THAT CHANGED THE DESIGN:
 - the failing apps are LXD containers sourcing from METAL-ADMIN (10.12.8.122),
   NOT the 10.12.12.116 juju status displays. An ACL on the displayed address
   would have denied every client the proxy exists for.
 - ports 3128 AND 8000 are already held wildcard-bound by MAAS's own squid on
   both racks -- hence 3129 and a dedicated instance.
 - no new D-134 octet needed: .4 is already aliased on both racks.
 - LOGGED NOT ADOPTED: MAAS's squid ALREADY CONNECT-proxies api.snapcraft.io,
   measured working from the failing container. snap-https-proxy pointed at
   10.12.8.6:8000 may unblock the deploy today with nothing built. Rejected as
   the shipped design (per-revision path, NO destination restriction, the
   hidden-coupling shape D-135 already has a scar from) but it is a real
   operator option, not a dismissal.

QUALITY: 53 mutations, 53 killed, 0 survived -- including the dc-mirror.sh
existence-vs-content false-green class reproduced and caught. One survivor was
a MALFORMED mutation that broke bash -n and therefore tested nothing; recorded
as malformed and redone rather than counted. Three of the harness's own cases
were found too weak and were STRENGTHENED, not left green.

INDEPENDENT REVIEW: ruled design HONOURED on all four counts -- utility band, no
direct node egress (in fact stronger: destination-allowlisted, and that scope is
flagged as a build-time choice NOT a ruling), site-keyed both DCs with the dc1
limit stated honestly, and it OWNS its own network prerequisites rather than
borrowing another service's -- with the coupling anti-pattern now under test
(M09/M10) rather than only under comment.

FOUR REAL BUGS LOGGED, NOT FIXED (hard rule 1 -- the file was frozen for review):
 BUG-1 dead snap_probe ACL; the probes are actually admitted by snap_clients,
       and the comment misdescribes its own mechanism
 BUG-2 | grep -q under pipefail -- INHERITED from dc-mirror.sh and
       dc-cache-proxy.sh alike; a three-script sweep, not a local fix
 BUG-3 the deny probe's 403 shape was measured from a PORT deny, never a
       DSTDOMAIN deny. If squid answers differently the gate REFUSES
       PERMANENTLY -- and a gate that cannot PASS blocks a GA-R6 close as hard
       as one that cannot fail. Requires a one-time apply-time confirmation.
 BUG-4 dpkg -s reports a deinstall-ok-config-files package as present

SIZE: 636 lines / 320 code vs dc-mirror 385/227 and dc-cache-proxy 396/200. The
reviewer's landing zone is ~535/~250 and it RECOMMENDS AGAINST forcing 385 --
two extra generators (75 lines) are measured-forced because the packaged squid
cannot be repointed, and further cuts would delete mutation-proven assertions.
~50 lines of the excess is header prose, which carries zero bug risk.

TWO BLOCKERS BEFORE THE PLAN IS APPLIED: the S8 consolidation invalidates
M32-M39/M42-M47/M49-M52 as evidence, so the mutation pass MUST be re-run; and
BUG-3 must be confirmed once against the built proxy before check is cited to
close anything.

NOTHING IS PROVEN END TO END -- no proxy installed, no snap fetched through one.
The harness green is FIXTURE green and says so.

repo-lint 0 fail; gauntlet ALL GREEN (94).

OWNED: my earlier teardown commit e57ad09 used 'git add -A' while the agent was
writing and swept its audit capture and CURRENT-STATE paragraph into a commit
about the model teardown. This commit is staged EXPLICITLY by path.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HvCyrwvYTTcDYnRErfMsNf

JANeumatrix committed 7 hours ago