L0GYKAL/the-rules
1
0
Fork 0
Code Issues Pull requests 5 Projects Releases Packages Wiki Activity Actions

ci: define strict Caddy Layer-4 spoke contract #114

Open
L0GYKAL wants to merge 7 commits from feat/minecraft-l4-contract into main
pull from: feat/minecraft-l4-contract
merge into: L0GYKAL:main
Conversation 1 Commits 7 Files changed 11 +293 -17
L0GYKAL commented 2026-10-12 05:48:20 +02:00
Owner
Copy link

Adds a closed requires.caddy_l4 declaration for raw TCP/UDP ingress.

  • exact protocol/listener/upstream/exposure fields
  • current gateway restricted to tailnet exposure
  • gateway-private membership required
  • malformed, duplicate, public, and unknown declarations fail closed
  • Hub renders declarations; spokes cannot inject global Caddy config

Required by the Minecraft Java spoke.

Adds a closed `requires.caddy_l4` declaration for raw TCP/UDP ingress. - exact protocol/listener/upstream/exposure fields - current gateway restricted to tailnet exposure - `gateway-private` membership required - malformed, duplicate, public, and unknown declarations fail closed - Hub renders declarations; spokes cannot inject global Caddy config Required by the Minecraft Java spoke.
ci: define strict Caddy layer 4 spoke contract
All checks were successful
lint / lint (pull_request) Successful in 44s
Details
lint / release-gate (pull_request) Successful in 1s
Details
3ba934e093
fix(ci): reject undeclared multi-platform pulls
All checks were successful
lint / lint (pull_request) Successful in 49s
Details
lint / release-gate (pull_request) Successful in 0s
Details
d80a88781e
L0GYKAL commented 2026-10-12 06:13:32 +02:00
Author
Owner
Copy link

Follow-up d80a887 tightens ADR-0032 admission after Minecraft debug CI exposed a deterministic gap: a pinned multi-platform index passed static admission even though the canonical skopeo copy --all fetches every architecture while the manifest described only one platform. The validator now requires the root to be the selected platform manifest, with a regression fixture. Local full lint and resource/conformance suites pass.

Follow-up d80a887 tightens ADR-0032 admission after Minecraft debug CI exposed a deterministic gap: a pinned multi-platform index passed static admission even though the canonical `skopeo copy --all` fetches every architecture while the manifest described only one platform. The validator now requires the root to be the selected platform manifest, with a regression fixture. Local full lint and resource/conformance suites pass.
fix(ci): reject unauthenticated rules submodule URLs
Some checks failed
lint / lint (pull_request) Failing after 50s
Details
lint / release-gate (pull_request) Failing after 0s
Details
fbdd52550b
test(ci): keep k3s fixture on canonical rules URL
All checks were successful
lint / lint (pull_request) Successful in 47s
Details
lint / release-gate (pull_request) Successful in 0s
Details
ffbb097da9
fix(network): require dedicated layer4 ingress
All checks were successful
lint / lint (pull_request) Successful in 49s
Details
lint / release-gate (pull_request) Successful in 1s
Details
fc254f03ef
feat(ci): bind layer-4 routes to backend networks
All checks were successful
lint / lint (pull_request) Successful in 52s
Details
lint / release-gate (pull_request) Successful in 0s
Details
6e3aa78441
feat(ci): account shared OCI bindings once
All checks were successful
lint / lint (pull_request) Successful in 48s
Details
lint / release-gate (pull_request) Successful in 0s
Details
98f01844a3
All checks were successful
lint / lint (pull_request) Successful in 48s
Details
lint / release-gate (pull_request) Successful in 0s
Required
Details
This pull request can be merged automatically.
This branch is out-of-date with the base branch
You are not authorized to merge this pull request.
View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.
git fetch -u origin feat/minecraft-l4-contract:feat/minecraft-l4-contract
git switch feat/minecraft-l4-contract
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
L0GYKAL/the-rules!114
No description provided.