Ilker ManapandClaude Opus 5.5
32c3942040
firewall.enabled (default true) is a cluster setting, applied live: the leader sends a Firewall message to every agent when it registers and when the setting or firewall_networks changes, and the agent (root) takes llmgw's nft table out or installs it. A control plane writes the state to /var/lib/llmgw/firewall.json, which llmgw-firewall-sync.path applies as root with `llmgw firewall sync`; server init and server add install the units, `llmgw firewall sync --install` on one set up before. node add and server add put no firewall on a machine while the setting is off. `llmgw wipe` removes llmgw from a machine after listing what goes and asking for its name: units, engines' processes, the nft table, /etc/llmgw, /var/lib/llmgw, the agent's state, the sudo grant, the CA from the trust store, keepalived's configuration when llmgw wrote it, and the users. --models, --store (Patroni member, etcd, or the local database) and --all take more. The console has it under Do. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
52 lines
1.3 KiB
Go
52 lines
1.3 KiB
Go
package cli
|
|
|
|
import (
|
|
"context"
|
|
"strings"
|
|
"testing"
|
|
)
|
|
|
|
type scriptLog struct {
|
|
scripts []string
|
|
reply func(script string) string
|
|
}
|
|
|
|
func (s *scriptLog) Run(_ context.Context, script string, _ []byte) ([]byte, error) {
|
|
s.scripts = append(s.scripts, script)
|
|
if s.reply != nil {
|
|
return []byte(s.reply(script)), nil
|
|
}
|
|
return nil, nil
|
|
}
|
|
|
|
func TestAControlPlaneFollowsTheFirewallSetting(t *testing.T) {
|
|
off := &scriptLog{}
|
|
if _, err := syncFirewall(context.Background(), off, firewallState{Enabled: false}); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if !strings.Contains(strings.Join(off.scripts, "\n"), "nft delete table inet llmgw") {
|
|
t.Errorf("off did not take the table out: %q", off.scripts)
|
|
}
|
|
|
|
none := &scriptLog{reply: func(s string) string {
|
|
if strings.Contains(s, "echo loaded") {
|
|
return "none\n"
|
|
}
|
|
return ""
|
|
}}
|
|
msg, err := syncFirewall(context.Background(), none, firewallState{Enabled: true})
|
|
if err != nil || !strings.Contains(msg, "server init") {
|
|
t.Errorf("on, with no rules here: %q %v", msg, err)
|
|
}
|
|
|
|
on := &scriptLog{reply: func(s string) string {
|
|
if strings.Contains(s, "echo loaded") {
|
|
return "loaded\n"
|
|
}
|
|
return ""
|
|
}}
|
|
if msg, err := syncFirewall(context.Background(), on, firewallState{Enabled: true}); err != nil || msg != "llmgw's firewall is on here" {
|
|
t.Errorf("on: %q %v", msg, err)
|
|
}
|
|
}
|