services/dashboards
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

phase: 28_gateway_agent_proxy

Browse Source 
**Phase 28 final pass — complete, 100 % green.** All five tasks were already `complete/`; this pass verified the criteria, re-ran the live half, and did the docs pass.

- Gate `bash .agents/validate.sh` **rc=0**: `1650 passed, 15 skipped`, coverage **98.97 %** (floor 94), `ruff` clean, `pyright` **0 errors**, `node --check` clean, hygiene clean (`/tmp/validate-done.log`).
- Live: `pytest -m live --live` **11 passed**; `./scripts/dev-server.sh status` nine sources `ok`; mTLS re-read of `gateway` → agent **1.2.0**, all three sections `available: true`, 6/6 frontends routed, 11 nginx servers + `$targetBackend`, **19** listeners, no core errors (`data/logs/28-finalpass-live.out`); installed agent file byte-identical to this tree (`b0e9ebf1b718…`).
- Criteria: 1 ✅ pytest/coverage · 2 ✅ three sections over a captured tree, `false`/`null` + one `errors` line each elsewhere with `cpu`/`mem`/`disk_io`/`system` intact · 3 ✅ `AGENT_VERSION` 1.2.0 + SCHEMA names all three · 4 ✅ six fixtures verbatim, capture refuses a bad read, 116 socket address columns hold no globally routable endpoint · 5 ✅ gateway runs 1.2.0 and answers over mTLS (transcript `data/logs/28-task05-rollout.md`, `28-finalpass-live.out`) · 6 ✅ validate · 7 ✅ additive: HEAD's 1.1.0 and this 1.2.0 `collect()`ed over one `--root` are key-for-key equal plus the three new sections, `--no-proxy` equal exactly (`data/logs/verify-28-final.py` → 41 PASS, `28-final-verify.out`).
- Docs fixed (README/AGENTS/Containerfile, all re-green): README's opening said "Four dashboards" above a five-row table and said the new sections are "stored in the snapshot" (they are in the **agent's** document — no `/api` payload, no `sample` row, nothing charts them until phase 29); `Containerfile`'s header still said "three dashboards"; AGENTS's coverage figure (98.94 → **98.97 %**), invariant 6 gained the captured-socket-table identifier rule, the agent bullet gained "phase 28 stops at the wire", and the fleet record names the stash-and-compare control plus the volatile listener count. Full record: `data/logs/NOTES-28-final.md`.
- Deviations: none functional; no git index/history touched, phase files untouched (`PLAN.md` and `complete/` unchanged). `uv pip list --outdated` still lists 4 packages (fastapi 0.153→0.161 etc.) — advisory only, dependencies untouched by this phase, left for a deliberate pass.
- Next pending phase: `.agents/phases/todo/29_gateway_dashboard_page/` (the page that consumes these three sections).
This commit is contained in:
ducoterra
2026-10-22 20:24:01 -04:00
parent 5d37444fb0
commit 44d61d3ab9
45 changed files with 4759 additions and 42 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/fixtures/gateway_haproxy.cfg
Vendored
+57
View File
@@ -0,0 +1,57 @@
# Verbatim /etc/haproxy/haproxy.cfg from gateway-ops, read read-only over the ssh key by
# ./scripts/capture-gateway-config.sh (AGENTS.md invariant 7: verify against the
# deployed upstream, never guess its shape).
# Nothing here is rewritten: it is this fleet's ingress map, and the domains in it are
# the data — an inbound name and the target it routes to are what these config sections
# exist to report. Key material appears only as the file paths the proxy reads.
defaults
log stdout local0 info
mode tcp
option tcplog
timeout connect 10s
timeout client 30s
timeout server 30s
timeout tunnel 3600s
default-server init-addr last,libc,none
frontend haproxy-22
bind :::22 v4v6
default_backend gitea-2222
frontend haproxy-2000
bind :::2000 v4v6
default_backend sec-gitea-2000
frontend haproxy-5201
bind :::5201 v4v6
default_backend iperf3-5201
frontend haproxy-8080
bind :::8080 v4v6
default_backend unifi-external-8080
frontend haproxy-25565
bind :::25565 v4v6
default_backend testcraft-25565
frontend haproxy-25566
bind :::25566 v4v6
default_backend nimcraft-25566
backend gitea-2222
server gitea reeseapps-gitea.reeselink.com:2222 check inter 5s
backend sec-gitea-2000
server sec-gitea stackexpected-gitea.reeselink.com:2222 check inter 5s
backend iperf3-5201
server iperf3 web.reeselink.com:5201 check inter 5s
backend unifi-external-8080
server unifi unifi-external.reeselink.com:8080 check inter 5s
backend testcraft-25565
server mc1 minecraft.reeselink.com:25565 check inter 5s
backend nimcraft-25566
server mc2 minecraft.reeselink.com:25566 check inter 5s
tests/fixtures/gateway_nginx_conf_d_http.conf
Vendored
+214
View File
@@ -0,0 +1,214 @@
# Verbatim /etc/nginx/conf.d/http.conf from gateway-ops, read read-only over the ssh key by
# ./scripts/capture-gateway-config.sh (AGENTS.md invariant 7: verify against the
# deployed upstream, never guess its shape).
# Nothing here is rewritten: it is this fleet's ingress map, and the domains in it are
# the data — an inbound name and the target it routes to are what these config sections
# exist to report. Key material appears only as the file paths the proxy reads.
server {
listen 4443 ssl proxy_protocol;
listen [::]:4443 ssl proxy_protocol;
server_name nextcloud.reeseapps.com;
client_max_body_size 0;
ssl_certificate /etc/letsencrypt/live/nextcloud.reeseapps.com/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/nextcloud.reeseapps.com/privkey.pem;
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
add_header X-Content-Type-Options "nosniff" always;
add_header X-Frame-Options "SAMEORIGIN" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
location / {
proxy_pass http://nextcloud.reeselink.com:11000;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection $connection_upgrade;
}
}
server {
listen 8443 ssl;
listen [::]:8443 ssl;
server_name nextcloud.reeseapps.com;
client_max_body_size 0;
ssl_certificate /etc/letsencrypt/live/nextcloud.reeseapps.com/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/nextcloud.reeseapps.com/privkey.pem;
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
add_header X-Content-Type-Options "nosniff" always;
add_header X-Frame-Options "SAMEORIGIN" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
location / {
proxy_pass http://nextcloud.reeselink.com:11001;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection $connection_upgrade;
}
}
server {
listen 4443 ssl proxy_protocol;
listen [::]:4443 ssl proxy_protocol;
server_name gitea.reeseapps.com;
client_max_body_size 0;
ssl_certificate /etc/letsencrypt/live/gitea.reeseapps.com/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/gitea.reeseapps.com/privkey.pem;
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
add_header X-Content-Type-Options "nosniff" always;
add_header X-Frame-Options "SAMEORIGIN" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
location / {
proxy_pass http://gitea.reeselink.com:3000;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection $connection_upgrade;
}
}
server {
listen 4443 ssl proxy_protocol;
listen [::]:4443 ssl proxy_protocol;
server_name jellyfin.reeseapps.com;
client_max_body_size 0;
ssl_certificate /etc/letsencrypt/live/jellyfin.reeseapps.com/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/jellyfin.reeseapps.com/privkey.pem;
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
add_header X-Content-Type-Options "nosniff" always;
add_header X-Frame-Options "SAMEORIGIN" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
location / {
proxy_pass http://jellyfin.reeselink.com:8096;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection $connection_upgrade;
}
}
server {
listen 8443 ssl;
listen [::]:8443 ssl;
server_name alicia-ai-terminology.reeseapps.com;
ssl_certificate /etc/letsencrypt/live/alicia-ai-terminology.reeseapps.com/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/alicia-ai-terminology.reeseapps.com/privkey.pem;
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
add_header X-Content-Type-Options "nosniff" always;
add_header X-Frame-Options "SAMEORIGIN" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
location / {
proxy_pass http://127.0.0.1:8081;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection $connection_upgrade;
}
}
server {
listen 4443 ssl proxy_protocol;
listen [::]:4443 ssl proxy_protocol;
server_name connors-legos.reeseapps.com;
ssl_certificate /etc/letsencrypt/live/connors-legos.reeseapps.com/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/connors-legos.reeseapps.com/privkey.pem;
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
add_header X-Content-Type-Options "nosniff" always;
add_header X-Frame-Options "SAMEORIGIN" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
location / {
proxy_pass http://bricktracker.reeselink.com:3333;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection $connection_upgrade;
}
}
server {
listen 4443 ssl proxy_protocol;
listen [::]:4443 ssl proxy_protocol;
server_name keycloak.reeseapps.com;
client_max_body_size 0;
ssl_certificate /etc/letsencrypt/live/keycloak.reeseapps.com/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/keycloak.reeseapps.com/privkey.pem;
location / {
proxy_pass http://keycloak.reeselink.com:8080;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection $connection_upgrade;
}
}
server {
listen 8443 ssl;
listen [::]:8443 ssl;
server_name admin.keycloak.reeseapps.com;
client_max_body_size 0;
ssl_certificate /etc/letsencrypt/live/admin.keycloak.reeseapps.com/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/admin.keycloak.reeseapps.com/privkey.pem;
location / {
proxy_pass http://keycloak.reeselink.com:8080;
proxy_set_header Host $host:$server_port;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header X-Forwarded-Port $server_port;
proxy_set_header X-Forwarded-Host $host:$server_port;
}
}
server {
listen 4443 ssl proxy_protocol;
listen [::]:4443 ssl proxy_protocol;
server_name emmaleaf.reeseapps.com;
client_max_body_size 10m;
ssl_certificate /etc/letsencrypt/live/emmaleaf.reeseapps.com/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/emmaleaf.reeseapps.com/privkey.pem;
location / {
proxy_pass http://emmaleaf.reeselink.com:80;
proxy_ssl_verify off;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection $connection_upgrade;
}
}
tests/fixtures/gateway_nginx_main.conf
Vendored
+63
View File
@@ -0,0 +1,63 @@
# Verbatim /etc/nginx/nginx.conf from gateway-ops, read read-only over the ssh key by
# ./scripts/capture-gateway-config.sh (AGENTS.md invariant 7: verify against the
# deployed upstream, never guess its shape).
# Nothing here is rewritten: it is this fleet's ingress map, and the domains in it are
# the data — an inbound name and the target it routes to are what these config sections
# exist to report. Key material appears only as the file paths the proxy reads.
user nginx;
worker_processes auto;
error_log /var/log/nginx/error.log notice;
pid /run/nginx.pid;
events {
worker_connections 1024;
}
stream {
include /etc/nginx/stream.d/*.conf;
}
http {
real_ip_header proxy_protocol;
set_real_ip_from 127.0.0.1;
set_real_ip_from 10.0.0.0/8;
include /etc/nginx/mime.types;
default_type application/octet-stream;
log_format detailed '$remote_addr:$remote_port [$time_local] "$server_name" "$request" '
'$status "$body_bytes_sent" "$http_referer" "$http_user_agent" '
'$request_time "$upstream_addr" "$upstream_response_time" '
'$ssl_protocol/$ssl_cipher';
access_log /var/log/nginx/access.log detailed;
sendfile on;
tcp_nopush on;
tcp_nodelay on;
keepalive_timeout 65;
gzip on;
server_tokens off;
ssl_protocols TLSv1.2 TLSv1.3;
ssl_session_cache shared:SSL:10m;
ssl_session_timeout 1d;
map $http_upgrade $connection_upgrade {
default upgrade;
'' close;
}
server {
listen 80;
listen [::]:80;
server_name _;
return 301 https://$host$request_uri;
}
include /etc/nginx/conf.d/*.conf;
}
tests/fixtures/gateway_nginx_stream_d_stream.conf
Vendored
+40
View File
@@ -0,0 +1,40 @@
# Verbatim /etc/nginx/stream.d/stream.conf from gateway-ops, read read-only over the ssh key by
# ./scripts/capture-gateway-config.sh (AGENTS.md invariant 7: verify against the
# deployed upstream, never guess its shape).
# Nothing here is rewritten: it is this fleet's ingress map, and the domains in it are
# the data — an inbound name and the target it routes to are what these config sections
# exist to report. Key material appears only as the file paths the proxy reads.
map $ssl_preread_server_name $targetBackend {
default 127.0.0.1:4443;
homepage.reeseapps.com reeseapps-homepage.reeselink.com:443;
ntfy.reeseapps.com reeseapps-ntfy.reeselink.com:443;
gitea.reeseapps.com reeseapps-gitea.reeselink.com:443;
aipi.reeseapps.com reeseapps-litellm.reeselink.com:443;
chatreesept.reeseapps.com reeseapps-openwebui.reeselink.com:443;
keycloak.reeseapps.com reeseapps-keycloak.reeselink.com:443;
forgejo.reeseapps.com reeseapps-forgejo.reeselink.com:443;
brain.reeseapps.com reeseapps-brain-of-reese.reeselink.com:443;
brain-of-code.reeseapps.com reeseapps-brain-of-code.reeselink.com:443;
immich.reeseapps.com reeseapps-immich.reeselink.com:443;
stackexpected.com stackexpected.reeselink.com:443;
gitea.stackexpected.com stackexpected-gitea.reeselink.com:443;
keycloak.stackexpected.com stackexpected-keycloak.reeselink.com:443;
nextcloud.stackexpected.com stackexpected-nextcloud.reeselink.com:443;
hedgedoc.stackexpected.com stackexpected-hedgedoc.reeselink.com:443;
wellsfamilycounseling.reeseapps.com wfc.reeselink.com:443;
}
server {
listen 443;
listen [::]:443;
proxy_connect_timeout 1800s;
proxy_timeout 1800s;
proxy_protocol on;
proxy_pass $targetBackend;
ssl_preread on;
resolver 10.1.0.1;
}
tests/fixtures/gateway_proc_net_tcp.txt
Vendored
+58
View File
@@ -0,0 +1,58 @@
# Verbatim /proc/net/tcp from gateway-ops, read read-only over the ssh key by
# ./scripts/capture-gateway-config.sh (AGENTS.md invariant 7: verify against the
# deployed upstream, never guess its shape).
# One line per TCP socket, in the kernel's own spelling. The only edit is the repo's
# identifier rule (invariant 6, the drive-serial scrub in capture-fixtures.sh): a
# globally routable address became a documentation one (RFC 5737 / RFC 3849), because a
# global IPv6 here is EUI-64 and a visitor's address is not ours to publish. Every port,
# state, queue, uid, inode and column width is verbatim, as are the loopback, private
# and wildcard addresses the gateway's own frontends use.
# Volatile by nature: a proxy in service has a different connection set every second, so
# a diff here on re-capture is expected. The tests assert shape, the two states the agent
# keeps, and the ports the captured configs claim to bind — never a particular row.
sl local_address rem_address st tx_queue rx_queue tr tm->when retrnsmt uid timeout inode
0: 00000000:20FB 00000000:0000 0A 00000000:00000000 00:00000000 00000000 0 0 9978 1 0000000000000000 100 0 0 10 0
1: 00000000:08AE 00000000:0000 0A 00000000:00000000 00:00000000 00000000 0 0 7797 1 0000000000000000 100 0 0 10 0
2: 00000000:0050 00000000:0000 0A 00000000:00000000 00:00000000 00000000 0 0 9974 1 0000000000000000 100 0 0 10 0
3: 00000000:01BB 00000000:0000 0A 00000000:00000000 00:00000000 00000000 0 0 9972 1 0000000000000000 100 0 0 10 0
4: 00000000:115B 00000000:0000 0A 00000000:00000000 00:00000000 00000000 0 0 9976 1 0000000000000000 100 0 0 10 0
5: 1B01010A:23A0 00000000:0000 0A 00000000:00000000 00:00000000 00000000 994 0 9479 1 0000000000000000 100 0 0 10 0
6: 1B01010A:BE2A B001010A:01BB 06 00000000:00000000 03:000013F5 00000000 0 0 0 3 0000000000000000
7: 0100007F:115B 0100007F:818C 01 00000000:00000000 00:00000000 00000000 101 0 62860 1 0000000000000000 20 4 30 10 -1
8: 1B01010A:BE2E B001010A:01BB 06 00000000:00000000 03:00001407 00000000 0 0 0 3 0000000000000000
9: 1B01010A:23A0 0204A8C0:C626 06 00000000:00000000 03:00000820 00000000 0 0 0 3 0000000000000000
10: 0100007F:115B 0100007F:C096 01 00000000:00000000 00:00000000 00000000 101 0 49558 1 0000000000000000 20 4 26 10 -1
11: 0100007F:115B 0100007F:B502 06 00000000:00000000 03:00000841 00000000 0 0 0 3 0000000000000000
12: 1B01010A:8290 A401010A:01BB 01 00000000:00000000 00:00000000 00000000 101 0 11850 1 0000000000000000 20 4 28 10 -1
13: 1B01010A:01BB 017100CB:90FA 01 00000000:00000000 00:00000000 00000000 101 0 21476 1 0000000000000000 35 4 31 10 -1
14: 1B01010A:23A0 0204A8C0:992E 06 00000000:00000000 03:00000C0A 00000000 0 0 0 3 0000000000000000
15: 1B01010A:CB4C B001010A:01BB 06 00000000:00000000 03:00000ECB 00000000 0 0 0 3 0000000000000000
16: 1B01010A:9C42 2700010A:01BB 06 00000000:00000000 03:00001259 00000000 0 0 0 3 0000000000000000
17: 1B01010A:01BB 0100010A:B2AC 01 00000000:00000000 00:00000000 00000000 101 0 77631 1 0000000000000000 20 4 31 10 -1
18: 1B01010A:01BB E600020A:BBE8 06 00000000:00000000 03:00000992 00000000 0 0 0 3 0000000000000000
19: 0100007F:C99E 0100007F:115B 06 00000000:00000000 03:000016BE 00000000 0 0 0 3 0000000000000000
20: 1B01010A:C1FE 2700010A:01BB 06 00000000:00000000 03:00000662 00000000 0 0 0 3 0000000000000000
21: 1B01010A:01BB E600020A:B5C4 06 00000000:00000000 03:000005EE 00000000 0 0 0 3 0000000000000000
22: 1B01010A:840E B001010A:01BB 01 00000000:00000000 00:00000000 00000000 101 0 21477 1 0000000000000000 20 4 30 10 -1
23: 1B01010A:D22A 4E01010A:01BB 01 00000000:00000000 00:00000000 00000000 101 0 77632 1 0000000000000000 21 4 30 10 -1
24: 1B01010A:01BB 017100CB:956A 01 00000000:00000000 00:00000000 00000000 101 0 62858 1 0000000000000000 29 4 30 10 -1
25: 0100007F:115B 0100007F:B4F6 06 00000000:00000000 03:000005ED 00000000 0 0 0 3 0000000000000000
26: 1B01010A:23A0 0204A8C0:8EE6 06 00000000:00000000 03:00001408 00000000 0 0 0 3 0000000000000000
27: 1B01010A:01BB EC01010A:94DE 01 00000000:00000000 00:00000000 00000000 101 0 11849 1 0000000000000000 20 4 31 10 -1
28: 0100007F:818C 0100007F:115B 01 00000000:00000000 00:00000000 00000000 101 0 62859 1 0000000000000000 21 4 24 10 -1
29: 1B01010A:23A0 0204A8C0:D5DE 06 00000000:00000000 03:0000020F 00000000 0 0 0 3 0000000000000000
30: 0100007F:115B 0100007F:B4F8 06 00000000:00000000 03:000005F6 00000000 0 0 0 3 0000000000000000
31: 1B01010A:A828 7600010A:63DD 06 00000000:00000000 03:00000F7F 00000000 0 0 0 3 0000000000000000
32: 0100007F:C096 0100007F:115B 01 00000000:00000000 00:00000000 00000000 101 0 49557 1 0000000000000000 20 4 24 10 -1
33: 1B01010A:D444 FE00010A:2AF8 01 00000000:00000000 00:00000000 00000000 101 0 49559 1 0000000000000000 20 4 30 10 -1
34: 1B01010A:9032 B001010A:01BB 01 00000000:00000000 00:00000000 00000000 101 0 11954 1 0000000000000000 20 4 30 10 -1
35: 1B01010A:977E 2700010A:01BB 06 00000000:00000000 03:00000C72 00000000 0 0 0 3 0000000000000000
36: 0100007F:115B 0100007F:B4EA 06 00000000:00000000 03:000005F0 00000000 0 0 0 3 0000000000000000
37: 1B01010A:08AE 0204A8C0:8290 01 00000048:00000000 01:00000017 00000000 0 0 86478 4 0000000000000000 24 8 15 10 -1
38: 1B01010A:9ED0 2700010A:01BB 06 00000000:00000000 03:0000170F 00000000 0 0 0 3 0000000000000000
39: 1B01010A:0050 027100CB:843E 01 0000018C:00000000 01:00000E57 00000007 101 0 84306 2 0000000000000000 4864 4 31 1 7
40: 1B01010A:CB5C B001010A:01BB 06 00000000:00000000 03:00000ED6 00000000 0 0 0 3 0000000000000000
41: 1B01010A:9776 2700010A:01BB 06 00000000:00000000 03:00000875 00000000 0 0 0 3 0000000000000000
42: 1B01010A:C59C FE00010A:2AF8 01 00000000:00000000 00:00000000 00000000 101 0 62861 1 0000000000000000 21 4 30 10 -1
43: 1B01010A:9154 2700010A:01BB 06 00000000:00000000 03:00001572 00000000 0 0 0 3 0000000000000000
44: 1B01010A:23A0 0204A8C0:9C42 06 00000000:00000000 03:00000FF3 00000000 0 0 0 3 0000000000000000
tests/fixtures/gateway_proc_net_tcp6.txt
Vendored
+26
View File
@@ -0,0 +1,26 @@
# Verbatim /proc/net/tcp6 from gateway-ops, read read-only over the ssh key by
# ./scripts/capture-gateway-config.sh (AGENTS.md invariant 7: verify against the
# deployed upstream, never guess its shape).
# One line per TCP socket, in the kernel's own spelling. The only edit is the repo's
# identifier rule (invariant 6, the drive-serial scrub in capture-fixtures.sh): a
# globally routable address became a documentation one (RFC 5737 / RFC 3849), because a
# global IPv6 here is EUI-64 and a visitor's address is not ours to publish. Every port,
# state, queue, uid, inode and column width is verbatim, as are the loopback, private
# and wildcard addresses the gateway's own frontends use.
# Volatile by nature: a proxy in service has a different connection set every second, so
# a diff here on re-capture is expected. The tests assert shape, the two states the agent
# keeps, and the ports the captured configs claim to bind — never a particular row.
sl local_address remote_address st tx_queue rx_queue tr tm->when retrnsmt uid timeout inode
0: 00000000000000000000000000000000:20FB 00000000000000000000000000000000:0000 0A 00000000:00000000 00:00000000 00000000 0 0 9979 1 0000000000000000 100 0 0 10 0
1: 00000000000000000000000000000000:08AE 00000000000000000000000000000000:0000 0A 00000000:00000000 00:00000000 00000000 0 0 7799 1 0000000000000000 100 0 0 10 0
2: 00000000000000000000000000000000:1451 00000000000000000000000000000000:0000 0A 00000000:00000000 00:00000000 00000000 99 0 9181 1 0000000000000000 100 0 0 10 0
3: 00000000000000000000000000000000:0050 00000000000000000000000000000000:0000 0A 00000000:00000000 00:00000000 00000000 0 0 9975 1 0000000000000000 100 0 0 10 0
4: 00000000000000000000000000000000:0016 00000000000000000000000000000000:0000 0A 00000000:00000000 00:00000000 00000000 99 0 9179 1 0000000000000000 100 0 0 10 0
5: 00000000000000000000000000000000:01BB 00000000000000000000000000000000:0000 0A 00000000:00000000 00:00000000 00000000 0 0 9973 1 0000000000000000 100 0 0 10 0
6: 00000000000000000000000000000000:115B 00000000000000000000000000000000:0000 0A 00000000:00000000 00:00000000 00000000 0 0 9977 1 0000000000000000 100 0 0 10 0
7: 00000000000000000000000000000000:63DE 00000000000000000000000000000000:0000 0A 00000000:00000000 00:00000000 00000000 99 0 9184 1 0000000000000000 100 0 0 10 0
8: 00000000000000000000000000000000:63DD 00000000000000000000000000000000:0000 0A 00000000:00000000 00:00000000 00000000 99 0 9183 1 0000000000000000 100 0 0 10 0
9: 00000000000000000000000000000000:07D0 00000000000000000000000000000000:0000 0A 00000000:00000000 00:00000000 00000000 99 0 9180 1 0000000000000000 100 0 0 10 0
10: 00000000000000000000000000000000:1F90 00000000000000000000000000000000:0000 0A 00000000:00000000 00:00000000 00000000 99 0 9182 1 0000000000000000 100 0 0 10 0
11: B80D0120000000000000000001000000:01BB 2377D3FDF349E0970000000003000000:C0AC 01 00000000:00000000 00:00000000 00000000 101 0 49556 1 0000000000000000 80 4 26 10 -1
12: B80D0120000000000000000001000000:01BB 2377D3FDF349E0970000000003000000:A120 01 00000000:00000000 00:00000000 00000000 101 0 11953 1 0000000000000000 59 4 30 7 7