diff --git a/fifa17-recon/docker/fifa17-python/client_arm.sh b/fifa17-recon/docker/fifa17-python/client_arm.sh index 9b39700..4b63525 100644 --- a/fifa17-recon/docker/fifa17-python/client_arm.sh +++ b/fifa17-recon/docker/fifa17-python/client_arm.sh @@ -20,12 +20,12 @@ # after these first redirected contacts the game is handed for every # later hop (Blaze main, roster, UTAS, telemetry) and dials the server directly. # -# Usage: sudo OPENFUT_SERVER=10.10.0.120 ./client_arm.sh +# Usage: sudo OPENFUT_SERVER=203.0.113.10 ./client_arm.sh # (re-run after every reboot; the sysctl/iptables state is volatile) # ============================================================================ set -euo pipefail -SERVER="${OPENFUT_SERVER:?set OPENFUT_SERVER to the backend host IP, e.g. 10.10.0.120}" +SERVER="${OPENFUT_SERVER:?set OPENFUT_SERVER to the backend host IP, e.g. 203.0.113.10}" GOS_EA_IP="159.153.51.20" # winter15.gosredirector.ea.com (hardcoded in FIFA17) if [ "$(id -u)" -ne 0 ]; then diff --git a/fifa17-recon/docker/fifa17-python/docker-compose.yml b/fifa17-recon/docker/fifa17-python/docker-compose.yml index c30ce33..0785f05 100644 --- a/fifa17-recon/docker/fifa17-python/docker-compose.yml +++ b/fifa17-recon/docker/fifa17-python/docker-compose.yml @@ -24,7 +24,7 @@ services: OPENFUT_BIND: "${OPENFUT_BIND:-0.0.0.0}" # Address advertised to the client for the next hop. MUST be this host's # LAN IP as seen from the game machine (105). Required (see .env.example). - OPENFUT_ADVERTISE: "${OPENFUT_ADVERTISE:?set OPENFUT_ADVERTISE in .env to this host's LAN IP, e.g. 10.10.0.120}" + OPENFUT_ADVERTISE: "${OPENFUT_ADVERTISE:?set OPENFUT_ADVERTISE in .env to this host's LAN IP, e.g. 203.0.113.10}" # POW content advertises port 8080 by default, which collides with the # openfut-core publish on this host. Remap it to 8085 on the host and # advertise the remapped endpoint. diff --git a/fifa17-recon/docker/fifa17-python/entrypoint.sh b/fifa17-recon/docker/fifa17-python/entrypoint.sh index 95dd112..faf8caf 100644 --- a/fifa17-recon/docker/fifa17-python/entrypoint.sh +++ b/fifa17-recon/docker/fifa17-python/entrypoint.sh @@ -11,13 +11,13 @@ # Address behaviour is driven by two env vars (see each responder): # OPENFUT_BIND bind address for every listener (container: 0.0.0.0) # OPENFUT_ADVERTISE address handed to the client for the next hop -# (the server's LAN IP, e.g. 10.10.0.120) +# (the server's LAN IP, e.g. 203.0.113.10) # ============================================================================ set -uo pipefail cd "$(dirname "$(readlink -f "$0")")/tools" BIND="${OPENFUT_BIND:-0.0.0.0}" -ADV="${OPENFUT_ADVERTISE:?OPENFUT_ADVERTISE must be set to the server LAN IP (e.g. 10.10.0.120)}" +ADV="${OPENFUT_ADVERTISE:?OPENFUT_ADVERTISE must be set to the server LAN IP (e.g. 203.0.113.10)}" export OPENFUT_BIND="$BIND" export OPENFUT_ADVERTISE="$ADV" # POW keys advertised by blaze must also point at the server, not loopback. diff --git a/scripts/check-no-lab-addresses.sh b/scripts/check-no-lab-addresses.sh new file mode 100755 index 0000000..719eb57 --- /dev/null +++ b/scripts/check-no-lab-addresses.sh @@ -0,0 +1,43 @@ +#!/usr/bin/env bash +# Tripwire: fail if a deployment-lab address appears in tracked source. +# +# Cheap insurance, not the real check. The semantic tests in +# `openfut-adapter-fifa17/tests/deployment_config.rs` are what actually prove +# the configuration propagates — they use two RFC 5737 TEST-NET addresses and +# deliberately set bind != advertise. This grep only stops the lab's own subnet +# from creeping back into source months from now, when the reasoning behind the +# audit has been forgotten. +# +# Deployment configuration is expected to contain real addresses; it lives in +# gitignored files (docker .env) and is therefore never scanned here. +set -uo pipefail +cd "$(dirname "$(readlink -f "$0")")/.." + +# The lab subnet. Override for a different deployment. +PATTERN="${OPENFUT_LAB_SUBNET_RE:-10\.10\.0\.[0-9]+}" + +# Historical records may legitimately state what a past deployment actually was; +# rewriting them would falsify the record. Allowlisted BY PATH, never by pattern. +ALLOW='^fifa17-recon/docs/BASELINE-python-2026-08-10\.md$' + +hits="$(git ls-files -z | xargs -0 grep -lE "$PATTERN" 2>/dev/null | grep -vE "$ALLOW" || true)" + +if [[ -z "$hits" ]]; then + echo "OK: no lab addresses in tracked source" + exit 0 +fi + +echo "FAIL: lab address(es) found in tracked source:" >&2 +for f in $hits; do + echo " $f" >&2 + grep -nE "$PATTERN" "$f" | sed 's/^/ /' >&2 +done +cat >&2 <<'MSG' + +Deployment addresses belong in gitignored configuration, not in source. +Use an RFC 5737 TEST-NET address in examples and tests: + 192.0.2.0/24 198.51.100.0/24 203.0.113.0/24 +If this is a historical record that must state a real past deployment, add its +path to ALLOW in this script and say why. +MSG +exit 1 diff --git a/scripts/registry.sh b/scripts/registry.sh new file mode 100755 index 0000000..02696b1 --- /dev/null +++ b/scripts/registry.sh @@ -0,0 +1,69 @@ +#!/usr/bin/env bash +# OpenFUT container registry helper. +# +# Usage: +# ./scripts/registry.sh login # docker login to the Gitea registry +# ./scripts/registry.sh build # build core + bridge images +# ./scripts/registry.sh push # push both images +# ./scripts/registry.sh release # build + push +# ./scripts/registry.sh pull # pull both images +# +# Config comes from .env (falls back to defaults matching docker-compose.yml). +# For login, set GITEA_USER and GITEA_TOKEN in the environment (a Gitea +# personal access token with package:write scope), or you'll be prompted. +set -euo pipefail + +cd "$(dirname "$0")/.." + +# Load .env if present (without clobbering already-exported vars). +if [[ -f .env ]]; then + set -a; # shellcheck disable=SC1091 + source .env; set +a +fi + +REGISTRY="${REGISTRY:-git.aleshym.co}" +NAMESPACE="${NAMESPACE:-openfut}" +TAG="${TAG:-latest}" + +CORE_IMAGE="${REGISTRY}/${NAMESPACE}/openfut-core:${TAG}" +BRIDGE_IMAGE="${REGISTRY}/${NAMESPACE}/openfut-bridge:${TAG}" + +log() { printf '\033[1;36m==>\033[0m %s\n' "$*"; } + +cmd_login() { + if [[ -n "${GITEA_USER:-}" && -n "${GITEA_TOKEN:-}" ]]; then + log "Logging in to ${REGISTRY} as ${GITEA_USER} (token)" + printf '%s' "${GITEA_TOKEN}" | docker login "${REGISTRY}" -u "${GITEA_USER}" --password-stdin + else + log "Logging in to ${REGISTRY} (interactive; set GITEA_USER/GITEA_TOKEN to automate)" + docker login "${REGISTRY}" + fi +} + +cmd_build() { + log "Building ${CORE_IMAGE}" + docker build -t "${CORE_IMAGE}" ./openfut-core + log "Building ${BRIDGE_IMAGE}" + docker build -t "${BRIDGE_IMAGE}" ./openfut-bridge +} + +cmd_push() { + log "Pushing ${CORE_IMAGE}" + docker push "${CORE_IMAGE}" + log "Pushing ${BRIDGE_IMAGE}" + docker push "${BRIDGE_IMAGE}" +} + +cmd_pull() { + docker pull "${CORE_IMAGE}" + docker pull "${BRIDGE_IMAGE}" +} + +case "${1:-}" in + login) cmd_login ;; + build) cmd_build ;; + push) cmd_push ;; + pull) cmd_pull ;; + release) cmd_build; cmd_push ;; + *) echo "Usage: $0 {login|build|push|pull|release}" >&2; exit 2 ;; +esac