feat(pipeline): keycloak-session-store 25편·virtualization 59편을 S3→S5→S6 으로 돌린다

기록 84편을 계약 에이전트로 다시 썼다. 기존 71편(kss 25 · virt 46)과, 계약에만 있고 안 쓰여 있던 새 글감 13편이다. 원장 84개를 열어 단계마다 스킬 영수증과 관문 종료 코드를 적었고 verify-pipeline-run.py 가 error 0 으로 닫는다. SSOT 결함 둘을 고쳤다. - kss 의 `약 58일` 이 반입 중 `약 59일` 로 바뀌어 있었다. 원 증거 파일이 「남은 일수: 88일 … 실제 갱신까지 약 58일」로 산수를 직접 적는다. D-4a 쪽 `약 59일` 은 강제 갱신 뒤(`VALID: 89 days`)라 맞는 값이라 그대로 뒀다. - virt §198 의 `11.6GB` 는 §178 의 원 측정 `Mem: 11648`(MiB)과 어긋나는데 원 가이드의 표기 그대로라 고치지 않고 쓰이는 자리에 대조를 적었다. 기록의 수치 오류 셋을 고쳤다 — CASE 요약의 「게스트 셋에 8240MB」(5120+3120 은 둘이다), k3s 편이 같은 것을 여섯·일곱·여덟로 세던 것, no-docker 편의 「셋을 더 든다」(§281 의 표는 네 행이고 디스크 행이 빠져 있었다). 계약을 셋 고쳤다. - kss 의 sourceRepository 리비전이 cdac9b8 이었는데 그 커밋에는 docs/guides/** 28개가 아예 없다. 9465582b 로 바꾸고, 반입한 바이트가 어느 커밋과도 같지 않다는 것을 측정값과 함께 적었다 — 반입은 커밋이 아니라 그 시점의 작업 트리에서 떠 온 것이다(kss 297/306 · virt 12/14 가 작업 트리와 같고, 200 커밋을 거슬러 전수 대조했을 때 가장 가까운 커밋도 28개가 어긋났다). - virt 계약이 「2026-09-11 재배분」이라고 적는데 SSOT 는 재배분 날짜를 적지 않고 재배분 뒤 값은 이미 2026-09-10 측정에 찍혀 있다. - kss 후보 대장이 지나친 절 아홉에 처분을 적었다(warn 9 → 0). 새 글감은 0건이고 넷은 앵커가 h3 슬러그의 접두가 아니라 중간 토막이라 검사기가 못 본 것이었다. style_profile.mjs 의 결함 둘을 고쳤다 — frontmatter 가 문장으로 세어져 (실측 398자짜리 「문장」 하나) 평균 길이를 기준 안으로 밀어 올리고 있었고, engPerSent 의 분자는 목록을 포함한 글에서, 분모는 목록을 걷어낸 글에서 세고 있었다(Question 기록에서 11.94 → 3.86). verify-pipeline.py 전 항목 PASS · error 0 · unittest 334건 OK. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
2026-09-17 11:01:55 +09:00
parent d473609e0a
commit 2109f726fe
574 changed files with 159654 additions and 1551 deletions
@@ -0,0 +1,31 @@
+#!/usr/sbin/nft -f
+# Forward the tailnet entry point to the edge guest.
+#
+# This is the ONLY lab traffic rule the physical host carries. Everything else
+# that used to live here — nginx config, certificates, certbot, the deploy hook
+# — now lives on kc-lab-edge and is destroyed with it.
+#
+# DNAT only, never SNAT. The guests' default route is the host, so replies come
+# back through here and conntrack reverses the translation on its own. Adding a
+# masquerade would rewrite the source and the edge would see 192.168.122.1 for
+# every client — which would silently invalidate the X-Forwarded-For contract
+# that this lab measures.
+#
+# PREROUTING nat runs before the routing decision, so this wins over any local
+# socket on :80/:443. That makes the cutover atomic and the rollback a single
+# `nft delete table ip lab_edge`.
+
+table ip lab_edge
+delete table ip lab_edge
+
+table ip lab_edge {
+    chain prerouting {
+        type nat hook prerouting priority dstnat; policy accept;
+        iifname "tailscale0" tcp dport { 80, 443 } dnat to 192.168.122.10
+    }
+
+    # No forward chain here on purpose. libvirt's guest_input chain ends in
+    # `oif virbr0 ... reject`, and an accept in an earlier base chain does NOT
+    # stop a later chain from rejecting — that is nftables, not iptables. The
+    # hole is punched inside libvirt's own chain by the unit's ExecStartPost.
+}
@@ -0,0 +1,21 @@
+[Unit]
+Description=Lab edge DNAT (tailnet :80/:443 -> kc-lab-edge)
+After=network-online.target libvirtd.service
+Wants=network-online.target
+
+[Service]
+Type=oneshot
+RemainAfterExit=yes
+ExecStart=/usr/sbin/nft -f /etc/nftables.d/lab-edge-dnat.nft
+
+# libvirt's own guest_input chain ends in `oif virbr0 ... reject`, and nftables
+# does NOT let an accept in an earlier base chain override a reject in a later
+# one. So the hole has to be punched inside libvirt's chain, at the top.
+# `-` because libvirt_network only exists once the virtual network is up; if it
+# is missing the DNAT still loads and this can be re-applied with a restart.
+ExecStartPost=-/usr/sbin/nft insert rule ip libvirt_network guest_input oif virbr0 ip daddr 192.168.122.10 tcp dport {80,443} ct state new counter accept
+
+ExecStop=/usr/sbin/nft delete table ip lab_edge
+
+[Install]
+WantedBy=multi-user.target
@@ -0,0 +1,61 @@
+# Lab entry point. Deployed on the lab host as
+#   /etc/nginx/sites-available/keycloak-lab
+# and symlinked from sites-enabled/.
+#
+# Arch does not ship the Debian sites-available convention, so nginx.conf needs
+#   include /etc/nginx/sites-enabled/*;
+# inside its http { } block before this file has any effect.
+#
+# This is the outer of two L7 hops. It terminates TLS and hands plain HTTP to
+# the Traefik instance running on each k3s node.
+
+upstream k3s_traefik {
+    # Sticky-session switch. Keycloak recommends affinity on AUTH_SESSION_ID;
+    # ip_hash is the cheap stand-in for a single-browser lab. Leaving it off is
+    # the interesting case: Infinispan still routes correctly, only slower.
+    # ip_hash;
+    server 192.168.122.11:80;
+    server 192.168.122.12:80;
+}
+
+server {
+    listen 80 default_server;
+    server_name _;
+    return 301 https://$host$request_uri;
+}
+
+server {
+    # The http2 parameter of listen, not the separate `http2 on;` directive:
+    # that directive needs nginx >= 1.25.1 and the edge guest is Debian 12
+    # (nginx 1.22). This form works on both and is what the lab actually runs.
+    listen 443 ssl http2 default_server;
+    server_name _;
+
+    # Lineage is named after the FIRST -d, so a wildcard cert issued as
+    #   -d hyeonworks.com -d '*.hyeonworks.com'
+    # lands in live/hyeonworks.com/, not live/auth.hyeonworks.com/.
+    # fullchain.pem, never cert.pem: omitting the intermediates passes on
+    # desktop browsers and fails on mobile and curl.
+    ssl_certificate     /etc/letsencrypt/live/hyeonworks.com/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/hyeonworks.com/privkey.pem;
+    ssl_protocols       TLSv1.2 TLSv1.3;
+
+    location / {
+        proxy_pass http://k3s_traefik;
+        proxy_http_version 1.1;
+
+        proxy_set_header Host              $host;
+        proxy_set_header X-Forwarded-Host  $host;
+        proxy_set_header X-Forwarded-Proto https;
+        proxy_set_header X-Forwarded-Port  443;
+
+        # $remote_addr, not $proxy_add_x_forwarded_for. This is the trust
+        # boundary: a client-supplied X-Forwarded-For must be discarded, not
+        # extended, or nothing downstream can rely on the value.
+        proxy_set_header X-Forwarded-For   $remote_addr;
+        proxy_set_header X-Real-IP         $remote_addr;
+
+        proxy_read_timeout 3600s;
+        proxy_send_timeout 3600s;
+    }
+}
@@ -0,0 +1,12 @@
+#!/bin/sh
+# certbot deploy hook. Install as
+#   /etc/letsencrypt/renewal-hooks/deploy/reload-nginx.sh   (chmod +x)
+#
+# deploy/ runs only when a certificate was actually renewed (RENEWED_LINEAGE is
+# set). post/ would run twice a day whether or not anything changed, reloading
+# nginx for nothing.
+#
+# Without this, D-4 measured the failure exactly: the renewal succeeds, the
+# timer reports SUCCESS, and the old certificate keeps being served for 38m25s
+# — with no error anywhere.
+nginx -t && nginx -s reload