mirror of
https://github.com/jmcorgan/fips.git
synced 2026-07-30 19:46:15 +00:00
Johnathan Corgan
9e63b42bd9
Replace 4 near-identical per-harness Docker setups with unified shared infrastructure. Net result: -463 lines across 55 files, faster CI (8.5 min vs ~13.5 min), 14 scenarios (down from 21). Unified Docker image (testing/docker/): - Single Dockerfile (trixie-slim) with FIPS_TEST_MODE env var for mode dispatch: default, chaos, sidecar, tor-socks5, tor-directory - Single entrypoint.sh with conditional logic per mode - Replaces 5 Dockerfiles, 3 entrypoints, 4 resolv.conf copies Shared build and libraries (testing/scripts/, testing/lib/): - testing/scripts/build.sh: single build script with macOS zigbuild support, replaces 4 per-harness copies - testing/lib/derive_keys.py: shared key derivation module, replaces 3 copies of derive-keys.py - testing/lib/log_analysis.py: shared log analysis extracted from chaos sim/logs.py, with CLI interface and rekey cutover tracking - testing/lib/wait-converge.sh: shared convergence wait helpers (wait_for_links, wait_for_peers) using fipsctl JSON polling Scenario consolidation: - Remove 7 redundant scenarios: tcp-chain (subsumed by tcp-mesh), tcp-only (subsumed by tcp-mesh), chaos-10 (replaced by churn-mixed --nodes 10), churn-10/churn-20/churn-20-mixed (subsumed by parameterized churn-mixed), cost-mixed-7node (overlaps mixed-technology) - Add churn-mixed scenario with --nodes flag for scale testing - Reduce idle scenario durations: smoke-10 60s→30s, ethernet-only 90s→30s, cost-avoidance 120s→45s, depth-vs-cost 120s→45s, bottleneck-parent 120s→60s, mixed-technology 180s→90s CI updates: - ci-local.sh: unified image build, structured chaos suite entries with per-scenario flags, --skip-build for sidecar - ci.yml: shared binary install + image build step, updated scenario matrix, chaos_flags support for parameterized scenarios - Add tcp-mesh and congestion-stress to CI matrix - Static ping test uses active peer convergence detection instead of hardcoded 5s sleep Chaos infrastructure improvements (from discovery-rework branch): - Pre-built Docker image instead of per-service build at scale - --nodes flag in chaos.sh for runtime topology size override
303 lines
7.9 KiB
YAML
303 lines
7.9 KiB
YAML
networks:
|
|
fips-net:
|
|
driver: bridge
|
|
ipam:
|
|
config:
|
|
- subnet: 172.20.0.0/24
|
|
|
|
x-fips-common: &fips-common
|
|
image: fips-test:latest
|
|
cap_add:
|
|
- NET_ADMIN
|
|
devices:
|
|
- /dev/net/tun:/dev/net/tun
|
|
sysctls:
|
|
- net.ipv6.conf.all.disable_ipv6=0
|
|
restart: "no"
|
|
env_file:
|
|
- ./generated-configs/npubs.env
|
|
environment:
|
|
- RUST_LOG=info
|
|
|
|
services:
|
|
# ── Mesh topology ──────────────────────────────────────────────
|
|
node-a:
|
|
<<: *fips-common
|
|
profiles: ["mesh"]
|
|
container_name: fips-node-a
|
|
hostname: node-a
|
|
volumes:
|
|
- ../docker/resolv.conf:/etc/resolv.conf:ro
|
|
- ./generated-configs/mesh/node-a.yaml:/etc/fips/fips.yaml:ro
|
|
networks:
|
|
fips-net:
|
|
ipv4_address: 172.20.0.10
|
|
|
|
node-b:
|
|
<<: *fips-common
|
|
profiles: ["mesh"]
|
|
container_name: fips-node-b
|
|
hostname: node-b
|
|
volumes:
|
|
- ../docker/resolv.conf:/etc/resolv.conf:ro
|
|
- ./generated-configs/mesh/node-b.yaml:/etc/fips/fips.yaml:ro
|
|
networks:
|
|
fips-net:
|
|
ipv4_address: 172.20.0.11
|
|
|
|
node-c:
|
|
<<: *fips-common
|
|
profiles: ["mesh"]
|
|
container_name: fips-node-c
|
|
hostname: node-c
|
|
volumes:
|
|
- ../docker/resolv.conf:/etc/resolv.conf:ro
|
|
- ./generated-configs/mesh/node-c.yaml:/etc/fips/fips.yaml:ro
|
|
networks:
|
|
fips-net:
|
|
ipv4_address: 172.20.0.12
|
|
|
|
node-d:
|
|
<<: *fips-common
|
|
profiles: ["mesh"]
|
|
container_name: fips-node-d
|
|
hostname: node-d
|
|
volumes:
|
|
- ../docker/resolv.conf:/etc/resolv.conf:ro
|
|
- ./generated-configs/mesh/node-d.yaml:/etc/fips/fips.yaml:ro
|
|
networks:
|
|
fips-net:
|
|
ipv4_address: 172.20.0.13
|
|
|
|
node-e:
|
|
<<: *fips-common
|
|
profiles: ["mesh"]
|
|
container_name: fips-node-e
|
|
hostname: node-e
|
|
volumes:
|
|
- ../docker/resolv.conf:/etc/resolv.conf:ro
|
|
- ./generated-configs/mesh/node-e.yaml:/etc/fips/fips.yaml:ro
|
|
networks:
|
|
fips-net:
|
|
ipv4_address: 172.20.0.14
|
|
|
|
# ── Mesh-public topology (mesh + external public node) ────────
|
|
pub-a:
|
|
<<: *fips-common
|
|
profiles: ["mesh-public"]
|
|
container_name: fips-node-a
|
|
hostname: node-a
|
|
volumes:
|
|
- ../docker/resolv.conf:/etc/resolv.conf:ro
|
|
- ./generated-configs/mesh-public/node-a.yaml:/etc/fips/fips.yaml:ro
|
|
networks:
|
|
fips-net:
|
|
ipv4_address: 172.20.0.10
|
|
|
|
pub-b:
|
|
<<: *fips-common
|
|
profiles: ["mesh-public"]
|
|
container_name: fips-node-b
|
|
hostname: node-b
|
|
volumes:
|
|
- ../docker/resolv.conf:/etc/resolv.conf:ro
|
|
- ./generated-configs/mesh-public/node-b.yaml:/etc/fips/fips.yaml:ro
|
|
networks:
|
|
fips-net:
|
|
ipv4_address: 172.20.0.11
|
|
|
|
pub-c:
|
|
<<: *fips-common
|
|
profiles: ["mesh-public"]
|
|
container_name: fips-node-c
|
|
hostname: node-c
|
|
volumes:
|
|
- ../docker/resolv.conf:/etc/resolv.conf:ro
|
|
- ./generated-configs/mesh-public/node-c.yaml:/etc/fips/fips.yaml:ro
|
|
networks:
|
|
fips-net:
|
|
ipv4_address: 172.20.0.12
|
|
|
|
pub-d:
|
|
<<: *fips-common
|
|
profiles: ["mesh-public"]
|
|
container_name: fips-node-d
|
|
hostname: node-d
|
|
volumes:
|
|
- ../docker/resolv.conf:/etc/resolv.conf:ro
|
|
- ./generated-configs/mesh-public/node-d.yaml:/etc/fips/fips.yaml:ro
|
|
networks:
|
|
fips-net:
|
|
ipv4_address: 172.20.0.13
|
|
|
|
pub-e:
|
|
<<: *fips-common
|
|
profiles: ["mesh-public"]
|
|
container_name: fips-node-e
|
|
hostname: node-e
|
|
volumes:
|
|
- ../docker/resolv.conf:/etc/resolv.conf:ro
|
|
- ./generated-configs/mesh-public/node-e.yaml:/etc/fips/fips.yaml:ro
|
|
networks:
|
|
fips-net:
|
|
ipv4_address: 172.20.0.14
|
|
|
|
# ── Chain topology (A-B-C-D-E) ────────────────────────────────
|
|
chain-a:
|
|
<<: *fips-common
|
|
profiles: ["chain"]
|
|
container_name: fips-node-a
|
|
hostname: node-a
|
|
volumes:
|
|
- ../docker/resolv.conf:/etc/resolv.conf:ro
|
|
- ./generated-configs/chain/node-a.yaml:/etc/fips/fips.yaml:ro
|
|
networks:
|
|
fips-net:
|
|
ipv4_address: 172.20.0.10
|
|
|
|
chain-b:
|
|
<<: *fips-common
|
|
profiles: ["chain"]
|
|
container_name: fips-node-b
|
|
hostname: node-b
|
|
volumes:
|
|
- ../docker/resolv.conf:/etc/resolv.conf:ro
|
|
- ./generated-configs/chain/node-b.yaml:/etc/fips/fips.yaml:ro
|
|
networks:
|
|
fips-net:
|
|
ipv4_address: 172.20.0.11
|
|
|
|
chain-c:
|
|
<<: *fips-common
|
|
profiles: ["chain"]
|
|
container_name: fips-node-c
|
|
hostname: node-c
|
|
volumes:
|
|
- ../docker/resolv.conf:/etc/resolv.conf:ro
|
|
- ./generated-configs/chain/node-c.yaml:/etc/fips/fips.yaml:ro
|
|
networks:
|
|
fips-net:
|
|
ipv4_address: 172.20.0.12
|
|
|
|
chain-d:
|
|
<<: *fips-common
|
|
profiles: ["chain"]
|
|
container_name: fips-node-d
|
|
hostname: node-d
|
|
volumes:
|
|
- ../docker/resolv.conf:/etc/resolv.conf:ro
|
|
- ./generated-configs/chain/node-d.yaml:/etc/fips/fips.yaml:ro
|
|
networks:
|
|
fips-net:
|
|
ipv4_address: 172.20.0.13
|
|
|
|
chain-e:
|
|
<<: *fips-common
|
|
profiles: ["chain"]
|
|
container_name: fips-node-e
|
|
hostname: node-e
|
|
volumes:
|
|
- ../docker/resolv.conf:/etc/resolv.conf:ro
|
|
- ./generated-configs/chain/node-e.yaml:/etc/fips/fips.yaml:ro
|
|
networks:
|
|
fips-net:
|
|
ipv4_address: 172.20.0.14
|
|
|
|
# ── Rekey integration test (mesh + aggressive rekey timers) ──
|
|
rekey-a:
|
|
<<: *fips-common
|
|
profiles: ["rekey"]
|
|
container_name: fips-node-a
|
|
hostname: node-a
|
|
volumes:
|
|
- ../docker/resolv.conf:/etc/resolv.conf:ro
|
|
- ./generated-configs/rekey/node-a.yaml:/etc/fips/fips.yaml:ro
|
|
networks:
|
|
fips-net:
|
|
ipv4_address: 172.20.0.10
|
|
|
|
rekey-b:
|
|
<<: *fips-common
|
|
profiles: ["rekey"]
|
|
container_name: fips-node-b
|
|
hostname: node-b
|
|
volumes:
|
|
- ../docker/resolv.conf:/etc/resolv.conf:ro
|
|
- ./generated-configs/rekey/node-b.yaml:/etc/fips/fips.yaml:ro
|
|
networks:
|
|
fips-net:
|
|
ipv4_address: 172.20.0.11
|
|
|
|
rekey-c:
|
|
<<: *fips-common
|
|
profiles: ["rekey"]
|
|
container_name: fips-node-c
|
|
hostname: node-c
|
|
volumes:
|
|
- ../docker/resolv.conf:/etc/resolv.conf:ro
|
|
- ./generated-configs/rekey/node-c.yaml:/etc/fips/fips.yaml:ro
|
|
networks:
|
|
fips-net:
|
|
ipv4_address: 172.20.0.12
|
|
|
|
rekey-d:
|
|
<<: *fips-common
|
|
profiles: ["rekey"]
|
|
container_name: fips-node-d
|
|
hostname: node-d
|
|
volumes:
|
|
- ../docker/resolv.conf:/etc/resolv.conf:ro
|
|
- ./generated-configs/rekey/node-d.yaml:/etc/fips/fips.yaml:ro
|
|
networks:
|
|
fips-net:
|
|
ipv4_address: 172.20.0.13
|
|
|
|
rekey-e:
|
|
<<: *fips-common
|
|
profiles: ["rekey"]
|
|
container_name: fips-node-e
|
|
hostname: node-e
|
|
volumes:
|
|
- ../docker/resolv.conf:/etc/resolv.conf:ro
|
|
- ./generated-configs/rekey/node-e.yaml:/etc/fips/fips.yaml:ro
|
|
networks:
|
|
fips-net:
|
|
ipv4_address: 172.20.0.14
|
|
|
|
# ── TCP chain topology (A-B-C) ───────────────────────────────
|
|
tcp-a:
|
|
<<: *fips-common
|
|
profiles: ["tcp-chain"]
|
|
container_name: fips-node-a
|
|
hostname: node-a
|
|
volumes:
|
|
- ../docker/resolv.conf:/etc/resolv.conf:ro
|
|
- ./generated-configs/tcp-chain/node-a.yaml:/etc/fips/fips.yaml:ro
|
|
networks:
|
|
fips-net:
|
|
ipv4_address: 172.20.0.10
|
|
|
|
tcp-b:
|
|
<<: *fips-common
|
|
profiles: ["tcp-chain"]
|
|
container_name: fips-node-b
|
|
hostname: node-b
|
|
volumes:
|
|
- ../docker/resolv.conf:/etc/resolv.conf:ro
|
|
- ./generated-configs/tcp-chain/node-b.yaml:/etc/fips/fips.yaml:ro
|
|
networks:
|
|
fips-net:
|
|
ipv4_address: 172.20.0.11
|
|
|
|
tcp-c:
|
|
<<: *fips-common
|
|
profiles: ["tcp-chain"]
|
|
container_name: fips-node-c
|
|
hostname: node-c
|
|
volumes:
|
|
- ../docker/resolv.conf:/etc/resolv.conf:ro
|
|
- ./generated-configs/tcp-chain/node-c.yaml:/etc/fips/fips.yaml:ro
|
|
networks:
|
|
fips-net:
|
|
ipv4_address: 172.20.0.12
|