Ilker ManapandClaude Opus 5.5
32c3942040
firewall.enabled (default true) is a cluster setting, applied live: the leader sends a Firewall message to every agent when it registers and when the setting or firewall_networks changes, and the agent (root) takes llmgw's nft table out or installs it. A control plane writes the state to /var/lib/llmgw/firewall.json, which llmgw-firewall-sync.path applies as root with `llmgw firewall sync`; server init and server add install the units, `llmgw firewall sync --install` on one set up before. node add and server add put no firewall on a machine while the setting is off. `llmgw wipe` removes llmgw from a machine after listing what goes and asking for its name: units, engines' processes, the nft table, /etc/llmgw, /var/lib/llmgw, the agent's state, the sudo grant, the CA from the trust store, keepalived's configuration when llmgw wrote it, and the users. --models, --store (Patroni member, etcd, or the local database) and --all take more. The console has it under Do. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
43 lines
1.1 KiB
Go
43 lines
1.1 KiB
Go
package agentsvc
|
|
|
|
import (
|
|
llmgwv1 "gitea.mynodes.xyz/ilker/llmgw/api/gen/llmgw/v1"
|
|
)
|
|
|
|
// SetFirewall gives the service whether nodes keep llmgw's firewall, read
|
|
// at each use so a change to the cluster's settings is what is sent next.
|
|
func (s *Service) SetFirewall(f func() *llmgwv1.Firewall) {
|
|
s.mu.Lock()
|
|
s.firewall = f
|
|
s.mu.Unlock()
|
|
}
|
|
|
|
func (s *Service) firewallMsg() *llmgwv1.ControlMessage {
|
|
s.mu.RLock()
|
|
f := s.firewall
|
|
s.mu.RUnlock()
|
|
if f == nil {
|
|
return nil
|
|
}
|
|
fw := f()
|
|
if fw == nil {
|
|
return nil
|
|
}
|
|
return &llmgwv1.ControlMessage{Msg: &llmgwv1.ControlMessage_Firewall{Firewall: fw}}
|
|
}
|
|
|
|
// BroadcastFirewall tells every connected agent what the cluster's settings
|
|
// now say of the firewall. A node not connected is told when it registers.
|
|
func (s *Service) BroadcastFirewall() {
|
|
msg := s.firewallMsg()
|
|
if msg == nil {
|
|
return
|
|
}
|
|
for _, node := range s.ConnectedNodes() {
|
|
if err := s.send(node, msg); err != nil {
|
|
s.log.Warn("could not tell a node about the firewall; it is told when it next registers",
|
|
"node", node, "err", err)
|
|
}
|
|
}
|
|
}
|