Feat/web apps hosting

.github/workflows/prerelease.yml

@@ -149,6 +149,7 @@ jobs:
           - failover-controller
           - sdn-controller
           - object-storage
+          - site-builder
           - csfx-migrate
         arch:
           - amd64
@@ -220,7 +221,7 @@ jobs:
         run: |
           VERSION="${{ needs.version.outputs.version }}"
           CP_BINS=""
-          for svc in api-gateway registry scheduler volume-manager failover-controller sdn-controller object-storage csfx-migrate; do
+          for svc in api-gateway registry scheduler volume-manager failover-controller sdn-controller object-storage site-builder csfx-migrate; do
             for arch in amd64 arm64; do
               CP_BINS="${CP_BINS} csfx-cp-${svc}-${arch} csfx-cp-${svc}-${arch}.sha256"
             done
@@ -422,6 +423,16 @@ jobs:
                     sha256 = "$(get_cp_sha256 csfx-cp-object-storage-arm64)";
                   };
                 };
+                site-builder = {
+                  amd64 = {
+                    url    = "${RELEASE_BASE}/csfx-cp-site-builder-amd64";
+                    sha256 = "$(get_cp_sha256 csfx-cp-site-builder-amd64)";
+                  };
+                  arm64 = {
+                    url    = "${RELEASE_BASE}/csfx-cp-site-builder-arm64";
+                    sha256 = "$(get_cp_sha256 csfx-cp-site-builder-arm64)";
+                  };
+                };
                 csfx-updater = {
                   amd64 = {
                     url    = "${RELEASE_BASE}/csfx-updater-amd64";

.github/workflows/release-build.yml

@@ -144,6 +144,7 @@ jobs:
           - failover-controller
           - sdn-controller
           - object-storage
+          - site-builder
           - csfx-migrate
         arch:
           - amd64
@@ -217,7 +218,7 @@ jobs:
           TAG="v${VERSION}"
 
           CP_BINS=""
-          for svc in api-gateway registry scheduler volume-manager failover-controller sdn-controller object-storage csfx-migrate; do
+          for svc in api-gateway registry scheduler volume-manager failover-controller sdn-controller object-storage site-builder csfx-migrate; do
             for arch in amd64 arm64; do
               CP_BINS="${CP_BINS} csfx-cp-${svc}-${arch} csfx-cp-${svc}-${arch}.sha256"
             done
@@ -416,6 +417,16 @@ jobs:
                     sha256 = "$(get_cp_sha256 csfx-cp-object-storage-arm64)";
                   };
                 };
+                site-builder = {
+                  amd64 = {
+                    url    = "${RELEASE_BASE}/csfx-cp-site-builder-amd64";
+                    sha256 = "$(get_cp_sha256 csfx-cp-site-builder-amd64)";
+                  };
+                  arm64 = {
+                    url    = "${RELEASE_BASE}/csfx-cp-site-builder-arm64";
+                    sha256 = "$(get_cp_sha256 csfx-cp-site-builder-arm64)";
+                  };
+                };
                 csfx-updater = {
                   amd64 = {
                     url    = "${RELEASE_BASE}/csfx-updater-amd64";

Cargo.toml

@@ -12,6 +12,7 @@ members = [
     "control-plane/volume-manager",
     "control-plane/object-storage",
     "control-plane/registry",
+    "control-plane/site-builder",
     "control-plane/shared/entity",
     "control-plane/shared/migration",
     "control-plane/shared/shared",

Dockerfile

@@ -7,6 +7,7 @@ RUN apt-get update && apt-get install -y \
     libssl-dev \
     libpq-dev \
     curl \
+    git \
     protobuf-compiler \
     && rm -rf /var/lib/apt/lists/*
 
@@ -28,6 +29,7 @@ COPY control-plane/sdn-controller/Cargo.toml ./control-plane/sdn-controller/
 COPY control-plane/volume-manager/Cargo.toml ./control-plane/volume-manager/
 COPY control-plane/object-storage/Cargo.toml ./control-plane/object-storage/
 COPY control-plane/registry/Cargo.toml ./control-plane/registry/
+COPY control-plane/site-builder/Cargo.toml ./control-plane/site-builder/
 COPY control-plane/shared/entity/Cargo.toml ./control-plane/shared/entity/
 COPY control-plane/shared/migration/Cargo.toml ./control-plane/shared/migration/
 COPY control-plane/shared/shared/Cargo.toml ./control-plane/shared/shared/
@@ -42,6 +44,7 @@ RUN mkdir -p agent/src \
     control-plane/volume-manager/src \
     control-plane/object-storage/src \
     control-plane/registry/src \
+    control-plane/site-builder/src \
     control-plane/shared/entity/src \
     control-plane/shared/migration/src \
     control-plane/shared/shared/src \
@@ -55,6 +58,8 @@ RUN mkdir -p agent/src \
     && echo "fn main() {}" > control-plane/volume-manager/src/main.rs \
     && echo "fn main() {}" > control-plane/object-storage/src/main.rs \
     && echo "fn main() {}" > control-plane/registry/src/main.rs \
+    && echo "fn main() {}" > control-plane/site-builder/src/main.rs \
+    && echo "pub fn lib() {}" > control-plane/site-builder/src/lib.rs \
     && echo "fn main() {}" > control-plane/csfx-migrate/src/main.rs \
     && echo "fn main() {}" > control-plane/csfx-updater/src/main.rs \
     && echo "pub fn lib() {}" > control-plane/shared/entity/src/lib.rs \

agent/src/client.rs

@@ -137,6 +137,12 @@ pub struct ResourceGroupMember {
     pub guest_ip: String,
 }
 
+#[derive(Debug, Deserialize, Clone)]
+pub struct SiteService {
+    pub service_name: String,
+    pub address: String,
+}
+
 #[derive(Debug, Clone, serde::Deserialize)]
 pub struct VpnPeer {
     pub client_public_key: String,
@@ -168,6 +174,8 @@ pub struct MasterBundle {
     pub openbao_seal_key: String,
     pub openbao_role_id: String,
     pub openbao_secret_id: String,
+    #[serde(default)]
+    pub site_secret: Option<String>,
     pub etcd_name: String,
     pub etcd_initial_cluster: String,
     #[serde(default)]
@@ -486,6 +494,38 @@ impl ApiClient {
             .context("Failed to parse resource group members response")
     }
 
+    pub async fn fetch_resource_group_site_services(
+        &self,
+        api_key: &str,
+        resource_group_id: &str,
+    ) -> Result<Vec<SiteService>> {
+        let url = format!(
+            "{}/api/resource-groups/{}/site-services",
+            self.gateway_url, resource_group_id
+        );
+
+        let resp = self
+            .client
+            .get(&url)
+            .header("X-API-Key", api_key)
+            .send()
+            .await
+            .context("Failed to fetch resource group site services")?;
+
+        if !resp.status().is_success() {
+            let status = resp.status();
+            anyhow::bail!(
+                "Failed to fetch resource group site services status={} {}",
+                status,
+                resp.text().await.unwrap_or_default()
+            );
+        }
+
+        resp.json::<Vec<SiteService>>()
+            .await
+            .context("Failed to parse resource group site services response")
+    }
+
     pub async fn fetch_resource_group_peers(
         &self,
         api_key: &str,

agent/src/firecracker/mod.rs

@@ -1,3 +1,4 @@
 pub mod api;
 pub mod rootfs;
 pub mod runtime;
+pub mod site_registry;

agent/src/firecracker/rootfs.rs

@@ -15,6 +15,9 @@ use std::time::{Duration, Instant};
 use tokio::process::Command;
 use tracing::{debug, info};
 
+use super::site_registry::{SiteRegistry, SITE_IMAGE_HOST};
+
+const DOCKER_HUB_REGISTRY: &str = "docker.io";
 const CONTAINER_BUNDLE_DIR: &str = "csfx-bundle";
 const CONTAINER_ROOTFS_DIR: &str = "rootfs";
 
@@ -59,26 +62,61 @@ fn store_digest(reference: &str, digest: &str) {
         .insert(reference.to_string(), (digest.to_string(), Instant::now()));
 }
 
-pub struct RootfsBuilder {
-    client: Client,
-    registry_mirror: Option<String>,
+fn resolve_reference(
+    image: &str,
+    mirror: Option<&str>,
+    site_registry: Option<&SiteRegistry>,
+) -> Result<Reference> {
+    let reference: Reference = image.parse().context("Invalid image reference")?;
+    if reference.registry() == SITE_IMAGE_HOST {
+        let site_registry =
+            site_registry.context("Site registry endpoint is not configured on this node")?;
+        return site_registry.resolve(&reference);
+    }
+    let Some(mirror) = mirror else {
+        return Ok(reference);
+    };
+    if reference.registry() != DOCKER_HUB_REGISTRY {
+        return Ok(reference);
+    }
+
+    let tag_or_digest = match (reference.tag(), reference.digest()) {
+        (_, Some(digest)) => format!("@{digest}"),
+        (Some(tag), None) => format!(":{tag}"),
+        (None, None) => String::new(),
+    };
+    let mirrored = format!("{mirror}/{}{tag_or_digest}", reference.repository());
+    mirrored.parse().context("Invalid mirrored image reference")
 }
 
-impl Default for RootfsBuilder {
-    fn default() -> Self {
-        Self::new()
+fn auth_for(reference: &Reference, site_registry: Option<&SiteRegistry>) -> RegistryAuth {
+    match site_registry {
+        Some(site) if reference.registry() == site.endpoint() => site.auth(),
+        _ => RegistryAuth::Anonymous,
     }
 }
 
+pub struct RootfsBuilder {
+    client: Client,
+    registry_mirror: Option<String>,
+    site_registry: Option<SiteRegistry>,
+}
+
 impl RootfsBuilder {
-    pub fn new() -> Self {
+    pub fn new(site_registry: Option<SiteRegistry>) -> Self {
         let registry_mirror = std::env::var("CSFX_REGISTRY_MIRROR")
             .ok()
             .filter(|value| !value.is_empty());
 
-        let protocol = match &registry_mirror {
-            Some(mirror) => ClientProtocol::HttpsExcept(vec![mirror.clone()]),
-            None => ClientProtocol::Https,
+        let insecure_hosts: Vec<String> = registry_mirror
+            .iter()
+            .cloned()
+            .chain(site_registry.iter().map(|site| site.endpoint().to_string()))
+            .collect();
+        let protocol = if insecure_hosts.is_empty() {
+            ClientProtocol::Https
+        } else {
+            ClientProtocol::HttpsExcept(insecure_hosts)
         };
 
         Self {
@@ -88,24 +126,10 @@ impl RootfsBuilder {
                 ..Default::default()
             }),
             registry_mirror,
+            site_registry,
         }
     }
 
-    fn resolve_reference(&self, image: &str) -> Result<Reference> {
-        let reference: Reference = image.parse().context("Invalid image reference")?;
-        let Some(mirror) = &self.registry_mirror else {
-            return Ok(reference);
-        };
-
-        let tag_or_digest = match (reference.tag(), reference.digest()) {
-            (_, Some(digest)) => format!("@{digest}"),
-            (Some(tag), None) => format!(":{tag}"),
-            (None, None) => String::new(),
-        };
-        let mirrored = format!("{mirror}/{}{tag_or_digest}", reference.repository());
-        mirrored.parse().context("Invalid mirrored image reference")
-    }
-
     async fn resolve_digest(&self, reference: &Reference, auth: &RegistryAuth) -> Result<String> {
         if let Some(digest) = reference.digest() {
             return Ok(digest.to_string());
@@ -124,8 +148,12 @@ impl RootfsBuilder {
     }
 
     pub async fn ensure_rootfs(&self, image: &str) -> Result<PathBuf> {
-        let reference = self.resolve_reference(image)?;
-        let auth = RegistryAuth::Anonymous;
+        let reference = resolve_reference(
+            image,
+            self.registry_mirror.as_deref(),
+            self.site_registry.as_ref(),
+        )?;
+        let auth = auth_for(&reference, self.site_registry.as_ref());
         let digest = self.resolve_digest(&reference, &auth).await?;
 
         let guest_init_version = guest_init_binary_version().await?;
@@ -538,6 +566,45 @@ mod tests {
     use super::*;
     use std::io::Write;
 
+    #[test]
+    fn docker_hub_images_are_routed_through_the_mirror() {
+        let reference = resolve_reference("nginx:1.27", Some("localhost:5050"), None).unwrap();
+        assert_eq!(reference.registry(), "localhost:5050");
+        assert_eq!(reference.repository(), "library/nginx");
+        assert_eq!(reference.tag(), Some("1.27"));
+    }
+
+    #[test]
+    fn site_images_resolve_to_the_site_registry_even_with_a_mirror() {
+        let site = SiteRegistry::from_gateway("https://10.0.0.5:8000", "key").unwrap();
+        let image = "sites.csfx.invalid/abc:12345678";
+        let reference = resolve_reference(image, Some("localhost:5050"), Some(&site)).unwrap();
+        assert_eq!(reference.whole(), "10.0.0.5:5060/abc:12345678");
+        assert!(matches!(
+            auth_for(&reference, Some(&site)),
+            RegistryAuth::Basic(user, _) if user == "agent"
+        ));
+        assert!(resolve_reference(image, None, None).is_err());
+    }
+
+    #[test]
+    fn credentials_are_never_sent_to_other_registries() {
+        let site = SiteRegistry::from_gateway("https://10.0.0.5:8000", "key").unwrap();
+        let other: Reference = "ghcr.io/org/app:1".parse().unwrap();
+        assert!(matches!(
+            auth_for(&other, Some(&site)),
+            RegistryAuth::Anonymous
+        ));
+    }
+
+    #[test]
+    fn other_registries_bypass_the_mirror() {
+        let image = "ghcr.io/csfx-cloud/csfx-site-builder:1";
+        let reference = resolve_reference(image, Some("localhost:5050"), None).unwrap();
+        assert_eq!(reference.registry(), "ghcr.io");
+        assert_eq!(reference.whole(), image);
+    }
+
     fn layer_header(path: &str, entry_type: tar::EntryType, size: u64, mode: u32) -> tar::Header {
         let mut header = tar::Header::new_gnu();
         header.set_path(path).unwrap();