caoer115/infra-rules
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity
No description
48 commits 3 branches 24 tags 400 KiB
  • TypeScript 100%
Find a file
Exact
Zitao Xiong 9549e2888f
All checks were successful
ci/woodpecker/push/mirror Pipeline was successful
Details
mirror.yml: forge-sync image 42ea2597 — a rewritten working branch follows the forge (forge-sync 358c7b5)
2026-11-03 21:27:44 -05:00
.claude/skills skills: use-mesh-rules project skill — consumer/maintainer SOP, machine truth split to gitignored SKILL.local.md 2026-08-14 07:52:24 -04:00
.woodpecker mirror.yml: forge-sync image 42ea2597 — a rewritten working branch follows the forge (forge-sync 358c7b5) 2026-11-03 21:27:44 -05:00
fixtures Merge remote-tracking branch 'github/main' 2026-08-23 10:30:37 -04:00
skills/use-mesh-rules surge: peer names get a DOMAIN rule at the policy their address already has 2026-08-23 18:40:25 -04:00
src surge: peer names get a DOMAIN rule at the policy their address already has 2026-08-23 18:40:25 -04:00
test surge: peer names get a DOMAIN rule at the policy their address already has 2026-08-23 18:40:25 -04:00
.gitignore skills: use-mesh-rules project skill — consumer/maintainer SOP, machine truth split to gitignored SKILL.local.md 2026-08-14 07:52:24 -04:00
bun.lock U5: probe exporter — checks → OTLP protobuf → local VM 2026-08-13 12:47:06 -04:00
package.json gate: merge main 2026-08-13 12:48:32 -04:00
README.md publish cloudflare: upsert rendered records into a zone — DNS-only, owned by comment infra-rules:<view>, diff-before-apply, --dry-run, idempotent; CLI repeatable flags 2026-08-22 17:22:12 -04:00
tsconfig.json U1: entity schemas — nine zod v4 entities + registry envelope 2026-08-13 12:01:28 -04:00

README.md

infra-rules

Org-agnostic infrastructure registry + rules engine. Bun + TypeScript + zod v4.

One schema for hosts, networks, meshes, views, resolvers, policies, services, routing intents, route targets and proxy exits; renderers that turn that registry into the config each consumer needs (probe manifests, sing-box dnsRules and routeRules, DNS records, Surge dconf), a Cloudflare publisher for the rendered records, and a probe exporter that pushes reachability metrics to VictoriaMetrics.

A service is host-backed (host, answer computed per mesh/network view) or a static answer (answer: {type: "A"|"CNAME", value}, served only in public-scoped views). records/<view>.json carries type per record; publish cloudflare --zone <zone> --records <file>... [--dry-run] upserts those files into a zone — DNS-only records tagged infra-rules:<view>, the only records it will ever delete; token from $CF_API_TOKEN.

Routing intents stay abstract in the registry (range → policy). Each render target declares its mesh membership explicitly — a member routes a mesh's space over its own path into that overlay; a non-member detours through proxy groups. Membership is data, never inferred from addresses.

Status

v0 — under construction. Consumers pin a tag: bun add github:caoer/infra-rules#v0.Y.Z. Current: v0.11.0 (public views, static A/CNAME answers, publish cloudflare).

Repo discipline

This repository is public. It contains no real fleet data: no live CIDRs, no credentials, no exit IPs. A leak-guard test (test/no-real-data.test.ts) enforces that mechanically over fixtures/, test/golden/, src/ and this README — an address outside the synthetic bands fails the suite wherever it is written, comments included.