Merge pull request #14 from dash14/refactor/move-js-processing-into-container

Move rule conversion and log reporting into Docker container

Author: dash14

Makefile

@@ -29,8 +29,8 @@ run_restrict_mode: ## Start in restrict mode
 	@echo "Starting buildcage in RESTRICT mode..."
 	@COMPOSE_FILE=$(COMPOSE_FILE) \
 	  PROXY_MODE=restrict \
-	  ALLOWED_HTTP_RULES="$$(node setup/convert-rules.mjs "$${ALLOWED_HTTP_RULES:-}")" \
-	  ALLOWED_HTTPS_RULES="$$(node setup/convert-rules.mjs "$${ALLOWED_HTTPS_RULES:-github.com:443 registry.npmjs.org:443 api.github.com:443 objects.githubusercontent.com:443 httpbin.org:443 deb.debian.org:80 *.githubusercontent.com:443}")" \
+	  ALLOWED_HTTP_RULES="$${ALLOWED_HTTP_RULES:-}" \
+	  ALLOWED_HTTPS_RULES="$${ALLOWED_HTTPS_RULES:-github.com:443 registry.npmjs.org:443 api.github.com:443 objects.githubusercontent.com:443 httpbin.org:443 deb.debian.org:80 *.githubusercontent.com:443}" \
 	  docker compose up -d --wait --build
 	@docker buildx rm buildcage 2>/dev/null || true
 	@echo "Creating buildx builder..."
@@ -67,8 +67,17 @@ test_audit_mode: ## Run audit mode tests
 	@$(MAKE) clean
 
 .PHONY: test_unit
-test_unit: ## Run unit tests
-	@node --test setup/lib/rules.test.mjs
+test_unit: test_legacy test_qjs ## Run unit tests
+
+.PHONY: test_legacy
+test_legacy: ## Run legacy rules unit tests
+	@node --test setup/lib/legacy-rules.test.mjs
+
+.PHONY: test_qjs
+test_qjs: ## Run unit tests in Docker
+	@docker build -t buildcage-qjs-test docker
+	@docker run --rm --entrypoint qjs buildcage-qjs-test /opt/buildcage/tools/lib/rules.test.mjs
+	@docker run --rm --entrypoint qjs buildcage-qjs-test /opt/buildcage/tools/lib/log-parser.test.mjs
 
 .PHONY: test_audit_example
 run_audit_example: ## Run audit mode example tests

compose.test.yml

@@ -3,8 +3,8 @@ services:
   builder:
     environment:
       - EXTERNAL_RESOLVER=10.200.0.53
-      - ALLOWED_HTTPS_RULES=^allowed\.example\.com:(443|8443)$$ ^[^.]+\.wildcard\.example\.com:(443|8443)$$
-      - ALLOWED_HTTP_RULES=^allowed\.example\.com:(80|8080)$$ ^[^.]+\.wildcard\.example\.com:(80|8080)$$
+      - ALLOWED_HTTPS_RULES=allowed.example.com:443 allowed.example.com:8443 *.wildcard.example.com:443 *.wildcard.example.com:8443
+      - ALLOWED_HTTP_RULES=allowed.example.com:80 allowed.example.com:8080 *.wildcard.example.com:80 *.wildcard.example.com:8080
     networks:
       default:
       test-net:

docker/Dockerfile

@@ -24,7 +24,8 @@ RUN apk add --no-cache \
       haproxy \
       dnsmasq \
       iptables \
-      curl
+      curl \
+      quickjs
 
 # s6-overlay
 ARG S6_OVERLAY_VERSION
@@ -55,15 +56,19 @@ COPY files/cni.conflist   /etc/buildkit/cni.conflist
 COPY files/dnsmasq.conf /etc/dnsmasq.conf
 
 # HAProxy
-RUN mkdir -p /etc/haproxy/rules
+RUN mkdir -p /etc/haproxy/rules /var/log/haproxy
 COPY files/haproxy.cfg.template /etc/haproxy/haproxy.cfg.template
 
+# Tools (QuickJS scripts)
+COPY files/tools/ /opt/buildcage/tools/
+
 # s6 service definitions and init scripts
 COPY files/s6-rc.d/ /etc/s6-overlay/s6-rc.d/
 COPY files/s6-scripts/ /etc/s6-overlay/scripts/
 RUN chmod +x /etc/s6-overlay/scripts/* && \
     chmod +x /etc/s6-overlay/s6-rc.d/dnsmasq/run && \
-    chmod +x /etc/s6-overlay/s6-rc.d/haproxy/run
+    chmod +x /etc/s6-overlay/s6-rc.d/haproxy/run && \
+    chmod +x /etc/s6-overlay/s6-rc.d/haproxy-log/run
 
 ENTRYPOINT ["/init"]
 CMD ["buildkitd", "--oci-worker-net=cni", "--addr", "tcp://0.0.0.0:1234"]

docker/files/s6-rc.d/haproxy-log/consumer-for

@@ -0,0 +1 @@
+haproxy

…er/files/s6-rc.d/user/contents.d/haproxy …/s6-rc.d/haproxy-log/dependencies.d/basedocker/files/s6-rc.d/user/contents.d/haproxy renamed to docker/files/s6-rc.d/haproxy-log/dependencies.d/base docker/files/s6-rc.d/user/contents.d/haproxy renamed to docker/files/s6-rc.d/haproxy-log/dependencies.d/base

@@ -0,0 +1 @@
+haproxy-pipeline

docker/files/s6-rc.d/haproxy-log/pipeline-name

@@ -0,0 +1,2 @@
+#!/command/execlineb -P
+s6-log 1 /var/log/haproxy

docker/files/s6-rc.d/haproxy-log/run

@@ -0,0 +1 @@
+longrun

docker/files/s6-rc.d/haproxy-log/type

@@ -0,0 +1 @@
+haproxy-log

docker/files/s6-rc.d/haproxy/producer-for

@@ -1,2 +1,3 @@
 #!/command/with-contenv sh
+exec 2>&1
 exec haproxy -f /etc/haproxy/haproxy.cfg -db