Commit `9467ed29d6`

9467ed29d693e590e8e037c8858eeb793f21f029

Verified · cmc

cmc <hello@cleberg.net> · 2026-09-28 07:31 UTC

runner egress: remove the rule when it blocks the runner's poll

Ref #260

Layout: unified · split

deploy/gitbay-runner-egress.nft +4 −3

 #   127.0.0.1:22      the forge over loopback, for the runner. Builds do
 #                     not reach loopback at all: the runner starts them
 #                     with pasta's gateway mapping off (--no-map-gw).
-#   loopback :53      the host's resolver, which pasta forwards a
+#   loopback :53      the host's resolver, for when the host's nameserver
-#                     build's DNS to when the host's nameserver is a
+#                     is a loopback address. That pasta forwards a
-#                     loopback address.
+#                     build's DNS there is to be confirmed from inside a
+#                     build by runbook R3, not assumed.
 #   public 22/80/443  the forge, as anyone on the internet reaches it.
 # Everything else is rejected: the admin sshd on 2222 on every address,
 # and any service bound to loopback. -isolation none builds run as the

deploy/gitbay-runner-egress.service +4 −1

 # Reload re-reads the file and replaces the table in one transaction; it
 # does not restart the runner, which a restart of this unit would
 # (Requires= propagates restarts). `make deploy-runner` reloads.
+#
+# Stop uses destroy, which succeeds when the table is already gone (a
+# flush ruleset removes it); delete would fail and leave the unit failed.
 [Unit]
 Description=Host egress rule for CI builds
 After=nftables.service ufw.service
 RemainAfterExit=yes
 ExecStart=/usr/sbin/nft -f /etc/gitbay-runner/egress.nft
 ExecReload=/usr/sbin/nft -f /etc/gitbay-runner/egress.nft
-ExecStop=/usr/sbin/nft delete table inet gitbay_runner
+ExecStop=/usr/sbin/nft destroy table inet gitbay_runner
 [Install]
 WantedBy=multi-user.target

deploy/runner-egress-check.sh +14 −7

 public=$(hostname -I | awk '{print $1}')
 probe() {
-    su -s /bin/bash "$RUNNER_USER" -c "timeout 5 bash -c 'exec 3<>/dev/tcp/$1/$2'" 2>/dev/null
+    su -s /bin/bash "$RUNNER_USER" -c "timeout 5 bash -c 'exec 3<>/dev/tcp/$1/$2'" </dev/null 2>/dev/null
 }
 nft list table inet gitbay_runner >/dev/null
-for dest in 127.0.0.1:22 "$public:22"; do
+# The runner polls 127.0.0.1:22. If the rule blocks that, the running
-    if ! probe "${dest%:*}" "${dest##*:}"; then
+# runner is already cut off, so remove the table: CI keeps polling as it
-        echo "$RUNNER_USER cannot reach $dest: the egress rule would stop the runner" >&2
+# did before the deploy, and the exit still stops make before the restart.
-        exit 1
+if ! probe 127.0.0.1 22; then
-    fi
+    nft destroy table inet gitbay_runner
-done
+    echo "$RUNNER_USER cannot reach 127.0.0.1:22 with the egress rule loaded;" >&2
+    echo "removed table inet gitbay_runner so the runner keeps polling. Fix the rule and deploy again." >&2
+    exit 1
+fi
+if ! probe "$public" 22; then
+    echo "$RUNNER_USER cannot reach $public:22: builds would not reach the forge" >&2
+    exit 1
+fi
 for dest in 127.0.0.1:2222 "$public:2222"; do
     if probe "${dest%:*}" "${dest##*:}"; then
         echo "$RUNNER_USER reaches $dest: the egress rule is not in force" >&2

Commit 9467ed29d6