Merge pull request 'feat/arm-cross-compilation' (#259) from feat/arm-cross-compilation into master

Reviewed-on: #259

.cargo/config.toml

@@ -3,3 +3,6 @@ rustflags = ["-C", "link-arg=/STACK:8000000"]
 
 [target.x86_64-pc-windows-gnu]
 rustflags = ["-C", "link-arg=-Wl,--stack,8000000"]
+
+[target.aarch64-unknown-linux-gnu]
+linker = "aarch64-linux-gnu-gcc"

.gitea/workflows/arm-agents.yaml

@@ -0,0 +1,78 @@
+name: Build ARM agent binaries
+on:
+  push:
+    tags:
+      - 'v*'
+      - 'snapshot-*'
+  workflow_dispatch:
+
+jobs:
+  build_arm_agents:
+    container:
+      image: hub.nationtech.io/harmony/harmony_composer:latest
+    runs-on: docker
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+        with:
+          submodules: 'recursive'
+          fetch-depth: 1
+
+      - name: Install ARM cross-compilation toolchain
+        run: |
+          apt-get update -qq
+          apt-get install -y -qq gcc-aarch64-linux-gnu
+          rustup target add aarch64-unknown-linux-gnu
+
+      - name: Build agent crates for aarch64
+        run: |
+          cargo build --release --target aarch64-unknown-linux-gnu \
+            -p harmony_agent \
+            -p harmony_inventory_agent
+
+      - name: Install jq
+        run: apt-get install -y -qq jq
+
+      - name: Get or create release
+        run: |
+          TAG_NAME="${GITHUB_REF_NAME}"
+
+          # Try to get existing release
+          RELEASE_ID=$(curl -s -X GET \
+            -H "Authorization: token ${{ secrets.GITEATOKEN }}" \
+            "https://git.nationtech.io/api/v1/repos/nationtech/harmony/releases/tags/${TAG_NAME}" \
+            | jq -r '.id // empty')
+
+          if [ -z "$RELEASE_ID" ]; then
+            # Create new release
+            RESPONSE=$(curl -s -X POST \
+              -H "Authorization: token ${{ secrets.GITEATOKEN }}" \
+              -H "Content-Type: application/json" \
+              -d "{
+                \"tag_name\": \"${TAG_NAME}\",
+                \"name\": \"${TAG_NAME}\",
+                \"body\": \"Release ${TAG_NAME}\",
+                \"draft\": false,
+                \"prerelease\": true
+              }" \
+              "https://git.nationtech.io/api/v1/repos/nationtech/harmony/releases")
+            RELEASE_ID=$(echo "$RESPONSE" | jq -r '.id')
+          fi
+
+          echo "RELEASE_ID=$RELEASE_ID" >> $GITHUB_ENV
+
+      - name: Upload harmony_agent ARM binary
+        run: |
+          curl -X POST \
+            -H "Authorization: token ${{ secrets.GITEATOKEN }}" \
+            -H "Content-Type: application/octet-stream" \
+            --data-binary "@target/aarch64-unknown-linux-gnu/release/harmony_agent" \
+            "https://git.nationtech.io/api/v1/repos/nationtech/harmony/releases/${{ env.RELEASE_ID }}/assets?name=harmony_agent-aarch64-linux"
+
+      - name: Upload harmony_inventory_agent ARM binary
+        run: |
+          curl -X POST \
+            -H "Authorization: token ${{ secrets.GITEATOKEN }}" \
+            -H "Content-Type: application/octet-stream" \
+            --data-binary "@target/aarch64-unknown-linux-gnu/release/harmony_inventory_agent" \
+            "https://git.nationtech.io/api/v1/repos/nationtech/harmony/releases/${{ env.RELEASE_ID }}/assets?name=harmony_inventory_agent-aarch64-linux"

Cargo.lock

@@ -3640,7 +3640,6 @@ dependencies = [
  "cidr",
  "env_logger",
  "getrandom 0.3.4",
- "harmony",
  "harmony_macros",
  "harmony_types",
  "log",

build/cross-arm.sh

@@ -0,0 +1,43 @@
+#!/bin/sh
+set -e
+
+cd "$(dirname "$0")/.."
+
+# Cross-compile agent crates for aarch64 (Raspberry Pi)
+#
+# Prerequisites (Debian/Ubuntu):
+#   sudo apt install gcc-aarch64-linux-gnu
+#   rustup target add aarch64-unknown-linux-gnu
+#
+# Prerequisites (Arch Linux):
+#   sudo pacman -S aarch64-linux-gnu-gcc
+#   rustup target add aarch64-unknown-linux-gnu
+
+TARGET="aarch64-unknown-linux-gnu"
+
+echo "=== Cross-compiling for $TARGET ==="
+
+# Check prerequisites
+if ! rustup target list --installed | grep -q "$TARGET"; then
+    echo "ERROR: Rust target $TARGET not installed. Run: rustup target add $TARGET"
+    exit 1
+fi
+
+if ! command -v aarch64-linux-gnu-gcc > /dev/null 2>&1; then
+    echo "ERROR: aarch64-linux-gnu-gcc not found. Install the cross-compilation toolchain."
+    echo "  Debian/Ubuntu: sudo apt install gcc-aarch64-linux-gnu"
+    echo "  Arch Linux:    sudo pacman -S aarch64-linux-gnu-gcc"
+    exit 1
+fi
+
+echo "--- Building harmony_agent ---"
+cargo build --release --target "$TARGET" -p harmony_agent
+
+echo "--- Building harmony_inventory_agent ---"
+cargo build --release --target "$TARGET" -p harmony_inventory_agent
+
+echo ""
+echo "=== Build complete ==="
+echo "Binaries:"
+echo "  target/$TARGET/release/harmony_agent"
+echo "  target/$TARGET/release/harmony_inventory_agent"

examples/opnsense_vm_integration/src/main.rs

@@ -600,7 +600,6 @@ fn build_all_scores() -> Result<Vec<Box<dyn Score<OPNSenseFirewall>>>, Box<dyn s
             },
         ],
         private_services: vec![],
-        wan_firewall_ports: vec![],
     };
 
     let dhcp_score = DhcpScore::new(

examples/tui/src/main.rs

@@ -69,6 +69,5 @@ fn build_large_score() -> LoadBalancerScore {
             lb_service.clone(),
             lb_service.clone(),
         ],
-        wan_firewall_ports: vec![],
     }
 }

harmony/src/domain/topology/firewall_pair.rs

@@ -15,7 +15,7 @@ use async_trait::async_trait;
 use harmony_types::firewall::VipMode;
 use harmony_types::id::Id;
 use harmony_types::net::{IpAddress, MacAddress};
-use log::info;
+use log::{info, warn};
 use serde::Serialize;
 
 use crate::config::secret::{OPNSenseApiCredentials, OPNSenseFirewallCredentials};
@@ -176,8 +176,24 @@ impl DhcpServer for FirewallPairTopology {
     }
 
     async fn list_static_mappings(&self) -> Vec<(MacAddress, IpAddress)> {
-        // Return primary's view — both should be identical
-        self.primary.list_static_mappings().await
+        let primary_mappings = self.primary.list_static_mappings().await;
+        let backup_mappings = self.backup.list_static_mappings().await;
+
+        let primary_set: std::collections::HashSet<_> = primary_mappings.iter().collect();
+        let backup_set: std::collections::HashSet<_> = backup_mappings.iter().collect();
+
+        let only_primary: Vec<_> = primary_set.difference(&backup_set).collect();
+        let only_backup: Vec<_> = backup_set.difference(&primary_set).collect();
+
+        if !only_primary.is_empty() || !only_backup.is_empty() {
+            warn!(
+                "DHCP static mapping mismatch between primary and backup firewalls! \
+                 Only on primary: {:?}, Only on backup: {:?}",
+                only_primary, only_backup
+            );
+        }
+
+        primary_mappings
     }
 
     /// Returns the primary firewall's IP. In a CARP setup, callers

harmony/src/domain/topology/ha_cluster.rs

@@ -489,6 +489,9 @@ impl LoadBalancer for DummyInfra {
     async fn reload_restart(&self) -> Result<(), ExecutorError> {
         unimplemented!("{}", UNIMPLEMENTED_DUMMY_INFRA)
     }
+    async fn ensure_wan_access(&self, _port: u16) -> Result<(), ExecutorError> {
+        unimplemented!("{}", UNIMPLEMENTED_DUMMY_INFRA)
+    }
 }
 
 #[async_trait]

harmony/src/domain/topology/load_balancer.rs

@@ -37,11 +37,9 @@ pub trait LoadBalancer: Send + Sync {
     /// from the WAN interface. Used by load balancers that need to receive
     /// external traffic (e.g., OKD ingress on ports 80/443).
     ///
-    /// Default implementation is a no-op for topologies that don't manage
-    /// firewall rules (e.g., cloud environments with security groups).
-    async fn ensure_wan_access(&self, _port: u16) -> Result<(), ExecutorError> {
-        Ok(())
-    }
+    /// Topologies that don't manage firewall rules (e.g., cloud environments
+    /// with security groups) should return `Ok(())`.
+    async fn ensure_wan_access(&self, port: u16) -> Result<(), ExecutorError>;
 }
 
 #[derive(Debug, PartialEq, Clone, Serialize)]

harmony/src/infra/opnsense/load_balancer.rs

@@ -111,12 +111,16 @@ impl LoadBalancer for OPNSenseFirewall {
 }
 
 fn haproxy_service_to_harmony(svc: &HaproxyService) -> Option<LoadBalancerService> {
-    let listening_port = svc.bind.parse().unwrap_or_else(|_| {
-        panic!(
-            "HAProxy frontend address should be a valid SocketAddr, got {}",
-            svc.bind
-        )
-    });
+    let listening_port = match svc.bind.parse() {
+        Ok(addr) => addr,
+        Err(e) => {
+            warn!(
+                "Skipping HAProxy service: bind address '{}' is not a valid SocketAddr: {e}",
+                svc.bind
+            );
+            return None;
+        }
+    };
 
     let backend_servers: Vec<BackendServer> = svc
         .servers

harmony/src/modules/kvm/executor.rs

@@ -10,6 +10,7 @@ use virt::sys;
 use super::error::KvmError;
 use super::types::{CdromConfig, NetworkConfig, VmConfig, VmInterface, VmStatus};
 use super::xml;
+use harmony_types::net::MacAddress;
 
 /// A handle to a libvirt hypervisor.
 ///
@@ -374,14 +375,15 @@ impl KvmExecutor {
     pub async fn set_interface_link(
         &self,
         vm_name: &str,
-        mac: &str,
+        mac: &MacAddress,
         up: bool,
     ) -> Result<(), KvmError> {
         let state = if up { "up" } else { "down" };
-        info!("Setting {vm_name} interface {mac} link {state}");
+        let mac_str = mac.to_string();
+        info!("Setting {vm_name} interface {mac_str} link {state}");
 
         let output = tokio::process::Command::new("virsh")
-            .args(["-c", &self.uri, "domif-setlink", vm_name, mac, state])
+            .args(["-c", &self.uri, "domif-setlink", vm_name, &mac_str, state])
             .output()
             .await?;
 
@@ -420,11 +422,18 @@ impl KvmExecutor {
             // virsh domiflist columns: Interface, Type, Source, Model, MAC
             let parts: Vec<&str> = line.split_whitespace().collect();
             if parts.len() >= 5 {
+                let mac = match MacAddress::try_from(parts[4].to_string()) {
+                    Ok(m) => m,
+                    Err(e) => {
+                        warn!("Skipping interface with invalid MAC '{}': {e}", parts[4]);
+                        continue;
+                    }
+                };
                 interfaces.push(VmInterface {
                     interface_type: parts[1].to_string(),
                     source: parts[2].to_string(),
                     model: parts[3].to_string(),
-                    mac: parts[4].to_string(),
+                    mac,
                 });
             }
         }

harmony/src/modules/kvm/types.rs

@@ -1,3 +1,4 @@
+use harmony_types::net::MacAddress;
 use serde::{Deserialize, Serialize};
 
 /// Information about a VM's network interface, as reported by `virsh domiflist`.
@@ -10,7 +11,7 @@ pub struct VmInterface {
     /// Device model (e.g. "virtio")
     pub model: String,
     /// MAC address
-    pub mac: String,
+    pub mac: MacAddress,
 }
 
 /// Specifies how a KVM host is accessed.
@@ -95,7 +96,7 @@ pub struct NetworkRef {
     pub name: String,
     /// Optional fixed MAC address for this interface. When `None`, libvirt
     /// assigns one automatically.
-    pub mac: Option<String>,
+    pub mac: Option<MacAddress>,
 }
 
 impl NetworkRef {
@@ -106,8 +107,8 @@ impl NetworkRef {
         }
     }
 
-    pub fn with_mac(mut self, mac: impl Into<String>) -> Self {
-        self.mac = Some(mac.into());
+    pub fn with_mac(mut self, mac: MacAddress) -> Self {
+        self.mac = Some(mac);
         self
     }
 }
@@ -260,7 +261,7 @@ impl VmConfigBuilder {
 #[derive(Debug, Clone, Serialize, Deserialize)]
 pub struct DhcpHost {
     /// MAC address (e.g. `"52:54:00:00:50:01"`).
-    pub mac: String,
+    pub mac: MacAddress,
     /// IP to assign (e.g. `"10.50.0.2"`).
     pub ip: String,
     /// Optional hostname.
@@ -356,12 +357,12 @@ impl NetworkConfigBuilder {
     /// Add a static DHCP host entry (MAC → fixed IP).
     pub fn dhcp_host(
         mut self,
-        mac: impl Into<String>,
+        mac: MacAddress,
         ip: impl Into<String>,
         name: Option<String>,
     ) -> Self {
         self.dhcp_hosts.push(DhcpHost {
-            mac: mac.into(),
+            mac,
             ip: ip.into(),
             name,
         });

harmony/src/modules/kvm/xml.rs

@@ -136,7 +136,7 @@ fn nic_devices(vm: &VmConfig) -> String {
         .map(|net| {
             let mac_line = net
                 .mac
-                .as_deref()
+                .as_ref()
                 .map(|m| format!("\n      <mac address='{m}'/>"))
                 .unwrap_or_default();
             format!(
@@ -221,6 +221,7 @@ mod tests {
     use crate::modules::kvm::types::{
         BootDevice, ForwardMode, NetworkConfig, NetworkRef, VmConfig,
     };
+    use harmony_types::net::MacAddress;
 
     // ── Domain XML ──────────────────────────────────────────────────────
 
@@ -284,12 +285,13 @@ mod tests {
 
     #[test]
     fn domain_xml_nic_with_mac_address() {
+        let mac: MacAddress = "52:54:00:aa:bb:cc".to_string().try_into().unwrap();
         let vm = VmConfig::builder("mac-test")
-            .network(NetworkRef::named("mynet").with_mac("52:54:00:AA:BB:CC"))
+            .network(NetworkRef::named("mynet").with_mac(mac))
             .build();
 
         let xml = domain_xml(&vm, "/tmp");
-        assert!(xml.contains("mac address='52:54:00:AA:BB:CC'"));
+        assert!(xml.contains("mac address='52:54:00:aa:bb:cc'"));
     }
 
     #[test]
@@ -454,14 +456,11 @@ mod tests {
 
     #[test]
     fn network_xml_with_dhcp_host() {
+        let mac: MacAddress = "52:54:00:00:50:01".to_string().try_into().unwrap();
         let cfg = NetworkConfig::builder("hostnet")
             .subnet("10.50.0.1", 24)
             .dhcp_range("10.50.0.100", "10.50.0.200")
-            .dhcp_host(
-                "52:54:00:00:50:01",
-                "10.50.0.2",
-                Some("opnsense".to_string()),
-            )
+            .dhcp_host(mac, "10.50.0.2", Some("opnsense".to_string()))
             .build();
 
         let xml = network_xml(&cfg);

harmony/src/modules/load_balancer.rs

@@ -19,12 +19,6 @@ pub struct LoadBalancerScore {
     // (listen_interface, LoadBalancerService) tuples or something like that
     // I am not sure what to use as listen_interface, should it be interface name, ip address,
     // uuid?
-    /// TCP ports that must be open for inbound WAN traffic.
-    ///
-    /// The load balancer interpret will call `ensure_wan_access` for each port
-    /// before configuring services, so that the load balancer is reachable
-    /// from outside the LAN.
-    pub wan_firewall_ports: Vec<u16>,
 }
 
 impl<T: Topology + LoadBalancer> Score<T> for LoadBalancerScore {
@@ -66,11 +60,6 @@ impl<T: Topology + LoadBalancer> Interpret<T> for LoadBalancerInterpret {
             load_balancer.ensure_initialized().await?
         );
 
-        for port in &self.score.wan_firewall_ports {
-            info!("Ensuring WAN access for port {port}");
-            load_balancer.ensure_wan_access(*port).await?;
-        }
-
         for service in self.score.public_services.iter() {
             info!("Ensuring service exists {service:?}");
 

harmony/src/modules/okd/bootstrap_02_bootstrap.rs

@@ -350,13 +350,20 @@ impl OKDSetup02BootstrapInterpret {
         &self,
         inventory: &Inventory,
     ) -> Result<(), InterpretError> {
-        info!("[Stage 02/Bootstrap] Waiting for bootstrap to complete...");
+        let timeout_minutes: u64 = std::env::var("HARMONY_OKD_BOOTSTRAP_TIMEOUT_MINUTES")
+            .ok()
+            .and_then(|v| v.parse().ok())
+            .unwrap_or(90);
+
+        info!(
+            "[Stage 02/Bootstrap] Waiting for bootstrap to complete (timeout: {timeout_minutes}m)..."
+        );
         info!("[Stage 02/Bootstrap] Running: openshift-install wait-for bootstrap-complete");
 
         let okd_installation_path =
             format!("./data/okd/installation_files_{}", inventory.location.name);
 
-        let output = Command::new("./data/okd/bin/openshift-install")
+        let child = Command::new("./data/okd/bin/openshift-install")
             .args([
                 "wait-for",
                 "bootstrap-complete",
@@ -364,8 +371,17 @@ impl OKDSetup02BootstrapInterpret {
                 &okd_installation_path,
                 "--log-level=info",
             ])
-            .output()
+            .output();
+
+        let timeout = std::time::Duration::from_secs(timeout_minutes * 60);
+        let output = tokio::time::timeout(timeout, child)
             .await
+            .map_err(|_| {
+                InterpretError::new(format!(
+                    "[Stage 02/Bootstrap] bootstrap-complete timed out after {timeout_minutes} minutes. \
+                     Set HARMONY_OKD_BOOTSTRAP_TIMEOUT_MINUTES to increase the timeout and retry."
+                ))
+            })?
             .map_err(|e| {
                 InterpretError::new(format!(
                     "[Stage 02/Bootstrap] Failed to run openshift-install wait-for bootstrap-complete: {e}"

harmony/src/modules/okd/bootstrap_load_balancer.rs

@@ -56,7 +56,6 @@ impl OKDBootstrapLoadBalancerScore {
             load_balancer_score: LoadBalancerScore {
                 public_services: vec![],
                 private_services,
-                wan_firewall_ports: vec![80, 443],
             },
         }
     }

harmony/src/modules/okd/load_balancer.rs

@@ -114,7 +114,6 @@ impl OKDLoadBalancerScore {
             load_balancer_score: LoadBalancerScore {
                 public_services,
                 private_services,
-                wan_firewall_ports: vec![80, 443],
             },
         }
     }
@@ -339,13 +338,6 @@ mod tests {
         assert_eq!(private_service_22623.backend_servers.len(), 3);
     }
 
-    #[test]
-    fn test_wan_firewall_ports_include_http_and_https() {
-        let topology = create_test_topology();
-        let score = OKDLoadBalancerScore::new(&topology);
-        assert_eq!(score.load_balancer_score.wan_firewall_ports, vec![80, 443]);
-    }
-
     #[test]
     fn test_all_backend_servers_have_correct_port() {
         let topology = create_test_topology();

harmony_agent/Cargo.toml

@@ -6,7 +6,6 @@ readme.workspace = true
 license.workspace = true
 
 [dependencies]
-harmony = { path = "../harmony" }
 # harmony_cli = { path = "../harmony_cli" }
 harmony_types = { path = "../harmony_types" }
 harmony_macros = { path = "../harmony_macros" }