mirror of
https://github.com/NVIDIA/OpenShell.git
synced 2026-10-15 05:09:44 +08:00
Drew Newberry
17ce738bfb
* fix(ci): repair post-merge release canary Signed-off-by: Drew Newberry <anewberry@nvidia.com> * fix(packaging): bootstrap canary runtime prerequisites Signed-off-by: Drew Newberry <anewberry@nvidia.com> * ci(canary): collect macOS VM diagnostics Signed-off-by: Drew Newberry <anewberry@nvidia.com> * ci(canary): pin libkrun-compatible macOS runner Signed-off-by: Drew Newberry <anewberry@nvidia.com> * ci(canary): limit macOS smoke test to package startup Signed-off-by: Drew Newberry <anewberry@nvidia.com> * refactor(compute)!: remove gateway callback listeners Run Docker supervisors on host networking so they use the operator-configured primary gateway endpoint. Remove the unused compute-driver callback listener negotiation and listener-scoped routing machinery. BREAKING CHANGE: The ComputeDriver API no longer exposes GetGatewayListenerRequirements or GatewayListenerRequirement. External drivers must regenerate bindings and connect supervisors to the configured primary gateway endpoint. Signed-off-by: Drew Newberry <anewberry@nvidia.com> * refactor(docker): use sandbox runtime image in launcher Signed-off-by: Drew Newberry <anewberry@nvidia.com> * test(podman): exercise production endpoint selection Signed-off-by: Drew Newberry <anewberry@nvidia.com> * fix(e2e): route supervisors to reachable gateways Signed-off-by: Drew Newberry <anewberry@nvidia.com> * test(e2e): align Podman endpoint fixtures Signed-off-by: Drew Newberry <anewberry@nvidia.com> * fix(docker): preserve host aliases for supervisors Signed-off-by: Drew Newberry <anewberry@nvidia.com> * fix(docker): align sandbox host gateway pin Signed-off-by: Drew Newberry <anewberry@nvidia.com> * fix(e2e): address Docker fixtures by bridge IP Signed-off-by: Drew Newberry <anewberry@nvidia.com> * test(e2e): serialize sandbox lifecycle cases Signed-off-by: Drew Newberry <anewberry@nvidia.com> * fix(e2e): host Docker TCP fixture with gateway Signed-off-by: Drew Newberry <anewberry@nvidia.com> * fix(e2e): use loopback for host-network supervisor Signed-off-by: Drew Newberry <anewberry@nvidia.com> --------- Signed-off-by: Drew Newberry <anewberry@nvidia.com>
87 lines
3.2 KiB
Bash
Executable File
87 lines
3.2 KiB
Bash
Executable File
#!/bin/sh
|
|
# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
|
|
# SPDX-License-Identifier: Apache-2.0
|
|
|
|
# Snap wrapper for openshell-gateway. Sets snap-specific defaults:
|
|
# - OPENSHELL_DB_URL -> sqlite:$SNAP_COMMON/gateway.db (overridable)
|
|
# - OPENSHELL_DISABLE_TLS -> true
|
|
# It bootstraps package-managed credentials and validates, but never creates or
|
|
# rewrites, an operator-provided config before starting the gateway.
|
|
|
|
set -eu
|
|
|
|
CANONICAL_CONFIG_FILE="${SNAP_COMMON}/gateway.toml"
|
|
export OPENSHELL_DB_URL="${OPENSHELL_DB_URL:-sqlite:${SNAP_COMMON}/gateway.db?mode=rwc}"
|
|
export OPENSHELL_DISABLE_TLS="${OPENSHELL_DISABLE_TLS:-true}"
|
|
export OPENSHELL_LOCAL_TLS_DIR="${OPENSHELL_LOCAL_TLS_DIR:-${SNAP_COMMON}/tls}"
|
|
|
|
# Mirror clap's CLI-over-environment precedence so preflight always inspects
|
|
# the same file the daemon will load. Reject ambiguous duplicate selectors
|
|
# before either command runs.
|
|
cli_config=""
|
|
config_seen=false
|
|
expect_config_path=false
|
|
options_done=false
|
|
for argument in "$@"; do
|
|
if [ "$options_done" = true ]; then
|
|
continue
|
|
fi
|
|
if [ "$expect_config_path" = true ]; then
|
|
case "$argument" in
|
|
-*)
|
|
echo "openshell-gateway: --config requires a nonempty path" >&2
|
|
exit 2
|
|
;;
|
|
esac
|
|
if [ "$config_seen" = true ]; then
|
|
echo "openshell-gateway: duplicate --config option" >&2
|
|
exit 2
|
|
fi
|
|
cli_config=$argument
|
|
config_seen=true
|
|
expect_config_path=false
|
|
continue
|
|
fi
|
|
case "$argument" in
|
|
--)
|
|
options_done=true
|
|
;;
|
|
--config)
|
|
expect_config_path=true
|
|
;;
|
|
--config=*)
|
|
if [ "$config_seen" = true ]; then
|
|
echo "openshell-gateway: duplicate --config option" >&2
|
|
exit 2
|
|
fi
|
|
cli_config=${argument#--config=}
|
|
config_seen=true
|
|
;;
|
|
esac
|
|
done
|
|
if [ "$expect_config_path" = true ] || { [ "$config_seen" = true ] && [ -z "$cli_config" ]; }; then
|
|
echo "openshell-gateway: --config requires a nonempty path" >&2
|
|
exit 2
|
|
fi
|
|
|
|
# Docker sandboxes require gateway-minted, launch-scoped credentials for the
|
|
# supervisor. Generate the local JWT bundle alongside the otherwise-unused TLS
|
|
# material; generate-certs is idempotent and preserves an existing bundle.
|
|
"${SNAP}/bin/openshell-gateway" generate-certs \
|
|
--output-dir "$OPENSHELL_LOCAL_TLS_DIR" \
|
|
--server-san host.openshell.internal
|
|
|
|
if [ "$config_seen" = true ]; then
|
|
"${SNAP}/bin/openshell-gateway" config preflight -- "$@"
|
|
exec "${SNAP}/bin/openshell-gateway" "$@"
|
|
elif [ -n "${OPENSHELL_GATEWAY_CONFIG:-}" ]; then
|
|
"${SNAP}/bin/openshell-gateway" config preflight -- "$@"
|
|
exec "${SNAP}/bin/openshell-gateway" "$@"
|
|
elif [ -e "$CANONICAL_CONFIG_FILE" ] || [ -L "$CANONICAL_CONFIG_FILE" ]; then
|
|
"${SNAP}/bin/openshell-gateway" config preflight -- --config "$CANONICAL_CONFIG_FILE" "$@"
|
|
exec "${SNAP}/bin/openshell-gateway" --config "$CANONICAL_CONFIG_FILE" "$@"
|
|
else
|
|
"${SNAP}/bin/openshell-gateway" config preflight -- "$@"
|
|
exec "${SNAP}/bin/openshell-gateway" "$@"
|
|
fi
|