mirror of
https://github.com/jmcorgan/fips.git
synced 2026-07-30 19:46:15 +00:00
Johnathan Corgan
2fdc831ce3
The NAT lab was the last suite pinning fixed IPv4 subnets, so two overlapping runs collided on the wan and shared-lan bridges. Each run now claims a free /24 for each bridge, scanning candidates and advancing on an overlap while still failing fast on any other network-create error. The claim exports NAT_WAN_PREFIX and NAT_LAN_PREFIX, and every routable address in the compose file and the suite scripts derives from them, with defaults that render exactly what the lab used before. The router-side LANs are deliberately left pinned: they live inside per-container network namespaces, never become docker networks, and cannot collide. An external-network overlay lets the suites attach to the networks the run already claimed instead of creating their own. Two of the three suite scripts had no overlay hook, so they would have requested the claimed range a second time; both now have one. Host veth names are scoped by a short token rather than the full run id, which overruns the fifteen-character interface-name limit at the default run-id length, and the cleanup reaper's pattern is widened to match the new shape. Networks are released inline on every exit path rather than in a trap, since a trap written inside a shell function replaces the script-level handler and would disable the whole run's teardown.
27 lines
1.2 KiB
YAML
27 lines
1.2 KiB
YAML
# Override: attach the NAT lab's two bridges to pre-created external networks
|
|
# instead of letting compose create them from the base file's fixed pins.
|
|
#
|
|
# Applied only by ci-local.sh's run_nat / run_nostr_publish_consume /
|
|
# run_stun_faults, which claim a free /24 per network per suite invocation
|
|
# (ci_claim_nat_networks) and export FIPS_NAT_WAN_NET / FIPS_NAT_LAN_NET and
|
|
# NAT_WAN_PREFIX / NAT_LAN_PREFIX before `up`. That is what makes two
|
|
# concurrent local NAT runs collision-safe: each claims distinct ranges, so
|
|
# neither requests address space the other holds.
|
|
#
|
|
# The GitHub matrix, testing/mesh-lab/run-loop.sh, the README invocation and
|
|
# any standalone `docker compose up` do NOT apply this overlay; they use the
|
|
# base file's normal networks with the `:-` defaults, which render today's
|
|
# exact addresses. This mirrors static/docker-compose.gateway-external-net.yml
|
|
# and sidecar/docker-compose.external-net.yml.
|
|
#
|
|
# One file carries both networks: they are claimed and released together, and
|
|
# splitting them would let a suite attach to one claimed and one compose-made
|
|
# bridge.
|
|
networks:
|
|
wan:
|
|
external: true
|
|
name: ${FIPS_NAT_WAN_NET:-fips-nat-wan}
|
|
shared-lan:
|
|
external: true
|
|
name: ${FIPS_NAT_LAN_NET:-fips-nat-shared-lan}
|