super/box
1
0
Fork 0
Code Issues 2 Pull Requests Actions Packages Projects Releases Wiki Activity

NetVM: 1:1 profile:node mapping — hashed iface names, netvm-enter + netvm-chrome launcher

Browse Source
This commit is contained in:
Antigravity Agent
2026-10-03 00:43:08 -04:00
parent 218a527623
commit b86b6fa4b5
8 changed files with 84 additions and 46 deletions
Download Patch File Download Diff File Expand all files Collapse all files
bin/netvm-node-up.sh
+16 -25
View File
@@ -1,26 +1,13 @@
#!/usr/bin/env bash
# netvm-node-up.sh <node> — bring up a node's Warp egress in its own netns.
# Run as root (operator: sudo -n via the allowlist).
#
# Per-node layout:
# netns warp-<node>; veth pair veth-<node> <-> vpeer-<node> (10.201.X.0/30)
# with host NAT; WireGuard handshake packets route via the veth gateway
# (bypassing the tunnel — else they'd loop into it); everything else
# defaults through the tunnel.
# Run as root (operator: sudo -n via the allowlist). Idempotent.
set -euo pipefail
NODE="${1:?usage: netvm-node-up.sh <node>}"
NETNS="warp-${NODE}"
WG="wg-${NODE}"
VETH="veth-${NODE}"
VPEER="vpeer-${NODE}"
SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
. "$SCRIPT_DIR/netvm-names.sh"
netvm_names "${1:?usage: netvm-node-up.sh <node>}"
CONF="/etc/netvm/${NODE}.conf"
[ -f "$CONF" ] || { echo "missing $CONF (human: netvm-new-identity.sh $NODE)"; exit 1; }
chmod 600 "$CONF"
# deterministic /30 per node for the veth link
IDX=$(( $(echo -n "$NODE" | cksum | cut -d' ' -f1) % 60 + 10 ))
GW="10.201.${IDX}.1"; PEER_IP="10.201.${IDX}.2"; SUB="10.201.${IDX}.0/30"
nsexec() { ip netns exec "$NETNS" "$@"; }
ip netns add "$NETNS" 2>/dev/null || true
@@ -48,14 +35,14 @@ for eip in $(getent ahostsv4 "$ENDPOINT" | awk '{print $1}' | sort -u); do
nsexec ip route replace "$eip" via "$GW"
done
# wireguard interface (wg setconf rejects wg-quick extensions: strip them)
# wireguard interface (wg setconf rejects wg-quick-only keys: strip them)
if ! nsexec ip link show "$WG" >/dev/null 2>&1; then
ip link del "$WG" 2>/dev/null || true # stale host-side (reaped zombie netns)
ip link add "$WG" type wireguard
ip link set "$WG" netns "$NETNS"
fi
STRIPPED=$(mktemp)
grep -vE '^\s*(Address|DNS|MTU|Table|PreUp|PreDown|PostUp|PostDown|SaveConfig)\s*' "$CONF" > "$STRIPPED"
grep -vE '^\s*(Address|DNS|MTU|Table|PreUp|PreDown|PostUp|PostDown|SaveConfig)\s*=' "$CONF" > "$STRIPPED"
nsexec wg setconf "$WG" "$STRIPPED"
rm -f "$STRIPPED"
MTU=$(grep -oP '^\s*MTU\s*=\s*\K\d+' "$CONF" | head -1); MTU=${MTU:-1280}
@@ -68,13 +55,17 @@ nsexec ip link set "$WG" up
nsexec ip route replace default dev "$WG"
nsexec ip -6 route replace default dev "$WG" 2>/dev/null || true
# verify: handshake = tunnel up (definitive); egress IP best-effort (no DNS in netns)
sleep 3
HS=$(nsexec wg show "$WG" latest-handshakes | awk '{print $2}')
# wait for handshake (first one can take ~10s)
HS=""
for i in $(seq 1 10); do
HS=$(nsexec wg show "$WG" latest-handshakes 2>/dev/null | awk '{print $2}')
if [ -n "$HS" ] && [ "$HS" != "0" ]; then break; fi
sleep 2
done
if [ -z "$HS" ] || [ "$HS" = "0" ]; then
echo "no handshake yet (endpoint=$ENDPOINT) — may still be negotiating"
echo "no handshake yet (endpoint=$ENDPOINT)"
else
echo "handshake ok"
fi
EGRESS=$(nsexec curl -sk --max-time 15 'https://[2606:4700:4700::1111]/cdn-cgi/trace' 2>/dev/null | grep -oP '^ip=\K.*' || true)
echo "node=$NODE netns=$NETNS veth=$SUB egress=${EGRESS:-unknown}"
EGRESS=$(nsexec curl -sk --max-time 15 'https://1.1.1.1/cdn-cgi/trace' 2>/dev/null | grep -oP '^ip=\K.*' || true)
echo "node=$NODE netns=$NETNS ifaces=$WG/$VETH egress=${EGRESS:-unknown}"