p2p

tasks/validate.yml

@@ -11,6 +11,7 @@
       - wikideck_namespace | length <= 63
       - wikideck_image_pull_policy in ['Always', 'IfNotPresent', 'Never']
       - wikideck_wait_timeout | string is match('^[1-9][0-9]*$')
+      - wikideck_startup_probe_failure_threshold is integer and wikideck_startup_probe_failure_threshold > 0
       - wikideck_resources is mapping
       - wikideck_resources.requests is defined and wikideck_resources.requests is mapping
       - wikideck_resources.limits is defined and wikideck_resources.limits is mapping
@@ -29,7 +30,7 @@
       - wikideck_public_origin | length == 0 or wikideck_public_origin is match('^https://[a-z0-9.-]+(:[0-9]+)?$')
       - wikideck_ingress_enabled is boolean
       - wikideck_network_policy_enabled is boolean
-      - wikideck_offline is boolean
+      - wikideck_allow_private_peers is boolean
       - wikideck_create_namespace is boolean
       - wikideck_wait is boolean
     fail_msg: >-
@@ -64,6 +65,56 @@
     - wikideck_network_policy_ingress_from
     - wikideck_network_policy_dns_to
     - wikideck_network_policy_https_to
+    - wikideck_network_policy_https_ports
+    - wikideck_network_policy_peer_egress
+    - wikideck_peers
+
+- name: Validate the static peer allowlist
+  ansible.builtin.assert:
+    that:
+      - wikideck_peers | length <= 16
+    fail_msg: Wikideck supports at most 16 configured peer origins.
+
+- name: Validate peer origins without credentials or paths
+  ansible.builtin.assert:
+    that:
+      - item is string
+      - item | length <= 2048
+      - item is match('^https?://([a-zA-Z0-9]([a-zA-Z0-9.-]*[a-zA-Z0-9])?|\[[0-9a-fA-F:]+\])(:[0-9]{1,5})?$')
+      - wikideck_allow_private_peers or item is match('^https://')
+    fail_msg: >-
+      Peers must be HTTPS origins without credentials, paths, commas, queries or
+      fragments. Private/HTTP test peers require wikideck_allow_private_peers=true.
+      Wikideck additionally validates ports and public DNS/IP addresses at runtime.
+  loop: "{{ wikideck_peers }}"
+
+- name: Validate public peer egress ports
+  ansible.builtin.assert:
+    that:
+      - item is integer and item > 0 and item <= 65535
+    fail_msg: HTTPS egress ports must be integers in the range 1..65535.
+  loop: "{{ wikideck_network_policy_https_ports }}"
+
+- name: Validate explicit peer egress rules
+  ansible.builtin.assert:
+    that:
+      - item is mapping
+      - item.to is defined and item.to is sequence and item.to is not string and item.to is not mapping
+      - item.to | length > 0
+      - item.ports is defined and item.ports is sequence and item.ports is not string and item.ports is not mapping
+      - item.ports | length > 0
+    fail_msg: Peer egress rules require explicit nonempty to and ports lists.
+  loop: "{{ wikideck_network_policy_peer_egress }}"
+
+- name: Validate explicit peer egress TCP ports
+  ansible.builtin.assert:
+    that:
+      - item is mapping
+      - item.protocol | default('TCP') == 'TCP'
+      - item.port is defined and item.port is integer and item.port > 0 and item.port <= 65535
+      - item.endPort is not defined
+    fail_msg: Peer egress ports must be individual numeric TCP ports in the range 1..65535.
+  loop: "{{ wikideck_network_policy_peer_egress | map(attribute='ports') | flatten }}"
 
 - name: Require explicit network policy peers
   ansible.builtin.assert:
@@ -73,5 +124,6 @@
     fail_msg: Use an explicit podSelector, namespaceSelector, or ipBlock rather than an empty peer.
   loop: >-
     {{ wikideck_network_policy_ingress_from + wikideck_network_policy_dns_to
-       + wikideck_network_policy_https_to }}
+       + wikideck_network_policy_https_to
+       + (wikideck_network_policy_peer_egress | map(attribute='to') | flatten) }}
   when: wikideck_network_policy_enabled | bool