gregandClaude Opus 5.5
e9ff989246
Only games whose folder changed are boot-tested (against the previous
main commit, or against main on branches; manual runs pick games). Each
one is deployed by the node-agent's real deploy code on a dedicated
game-test runner, in a network that can reach the internet but not the
LAN. Publishing to the panel runs only if they all booted.
- boottest-payload builds the DEPLOY_SERVER message the panel would send
- readyPattern/failPatterns in game.yaml; readyExample in test.yaml is
checked against the pattern during validation
- secrets in test.yaml come from CI; a game missing one is skipped
- Minecraft gets a ready pattern; Dragonwilds needs DRAGONWILDS_OWNER_ID
- RUNNER.md + scripts/runner: runner, isolated network, systemd unit
Also fixes newline values ("\n" separators/footers) that yaml.v3 wrote
as "" on import, which would have broken ARK and Dragonwilds config
files once synced, and adds a round-trip test for the importer.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
31 lines
1.4 KiB
Bash
Executable File
31 lines
1.4 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# Creates the gbr-boottest Docker network and blocks it from private networks, so boot-tested game
|
|
# servers can download what they need from the internet but never reach the LAN or the host.
|
|
# Safe to re-run; the systemd unit in this folder runs it after every Docker start.
|
|
set -euo pipefail
|
|
|
|
NETWORK=gbr-boottest
|
|
SUBNET=172.30.99.0/24
|
|
|
|
if ! docker network inspect "$NETWORK" > /dev/null 2>&1; then
|
|
docker network create --driver bridge --subnet "$SUBNET" \
|
|
-o com.docker.network.bridge.name=br-gbrboot "$NETWORK"
|
|
fi
|
|
|
|
# DOCKER-USER is evaluated before Docker's own forwarding rules. Rebuild our rules from scratch.
|
|
iptables -N GBR-BOOTTEST 2>/dev/null || iptables -F GBR-BOOTTEST
|
|
iptables -C DOCKER-USER -s "$SUBNET" -j GBR-BOOTTEST 2>/dev/null \
|
|
|| iptables -I DOCKER-USER -s "$SUBNET" -j GBR-BOOTTEST
|
|
|
|
# Replies to connections the container opened (downloads) are fine
|
|
iptables -A GBR-BOOTTEST -m conntrack --ctstate ESTABLISHED,RELATED -j RETURN
|
|
for net in 10.0.0.0/8 172.16.0.0/12 192.168.0.0/16 100.64.0.0/10 169.254.0.0/16; do
|
|
iptables -A GBR-BOOTTEST -d "$net" -j DROP
|
|
done
|
|
iptables -A GBR-BOOTTEST -j RETURN
|
|
|
|
# The host itself (SSH, the Docker API, anything listening) is reached via INPUT, not FORWARD
|
|
iptables -C INPUT -i br-gbrboot -j DROP 2>/dev/null || iptables -I INPUT -i br-gbrboot -j DROP
|
|
|
|
echo "gbr-boottest ready: $SUBNET, private networks and host blocked"
|