feat: backport isolated VPN services to stable - #101
Merged
Merged
Conversation
Signed-off-by: Tiberiu Socaci <tsocaci@makeitfuture.com> (cherry picked from commit b218c6f) Signed-off-by: Tiberiu Socaci <tsocaci@makeitfuture.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds optional per-channel OpenVPN/MySQL services to stable installations. Only a dedicated rootless VPN container receives TUN and NET_ADMIN; ordinary agent containers retain their current permissions. Operators configure the service using a validated profile and selected channel-secret references, then manage it with
npm run vpn.This backports only the VPN change from #100 onto main. It does not promote the other beta features. The helper and dedicated image are identical to the tested beta implementation. Existing installed services refresh their private helper closure with
install-unitafter upgrading.Validation on candidate
9ec410f: full regression with coverage passed (2,537 passes, zero failures, 12 explicit skips); static checks, tracked-file secret scan, dedicated security coverage and DCO passed; production audit passed the high/critical gate (one existing moderate advisory); eight Python checks passed. Live pre-upgrade Claude and Codex container smoke both passed. Rootless kernel isolation passed on both operator installations, including tunnel-loss database blocking and extractor confinement. CI passed on Node 22.13 and 24, including hygiene and DCO.Stable deployment to the operator installation completed using the transactional updater: backup, full local regression, daemon health, Slack reconnect, and both configured engine smoke probes passed. The installed VPN helper matches the stable checkout byte-for-byte.
All required channel-secret names are present. A provider connection was attempted, but OpenVPN rejected the server certificate because it lacks the Key Usage extension (VERIFY KU ERROR). The VPN service was disabled, its containers were cleaned up, and no SQL was executed. Host routes and public egress address remained unchanged. Provider authentication/SQL and credential-rotation/reboot acceptance remain blocked on a compatible server certificate; deployment does not claim a successful provider connection. Private QA registry recording is pending the requesting user's personal-account selection.