fix(infra): Tailscale ACL exit consume rules, DGX Spark network integration, provisioning tag fix - #1277
Merged
Conversation
Contributor
|
Caution Review failedThe pull request is closed. ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (8)
📝 WalkthroughWalkthroughThis PR integrates a new Changes
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~25 minutes Possibly related PRs
Poem
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 82f722490a
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
…ration, provisioning tag fix P0 infrastructure fixes addressing 5 of 8 DGX Spark integration gaps. Changes: - tailscale-acl-policy.json: +4 ACL rules (exit node consume, DGX Spark inference, GPU-to-mesh egress, spark→pmoves response, spark→lab debug) - pinokio-network-inventory.yaml: +5 nodes (dgx-spark, kvm2, kvm4-1, kvm4-2, jetson-orin) with full Tailscale IPs, roles, tags, and GPU specs - Makefile: include nvidia-dgx-spark.mk for GPU build targets - hostinger-kvm-setup.sh: tag:exit-node → tag:exit (matches ACL policy definition) - hardening-tracker.md: CHIT crypto claims corrected from 'Full' to 'None' with F-20 ref - tier-architecture.md: DGX Spark added to topology diagram - agnotes2.md: DGX Spark AGNOTE entry added - flare-model-namespace.yaml: dgx-spark added to 3 model enum nodes Resolves DGX Spark integration gaps: G1 (ACL), G2 (inventory), G5 (Makefile) Refs: DGX Spark TAC tree (pmoves/configs/tac_trees/dgx-spark.tac.yaml)
…consume (codex) Two review threads from codex on PR #1277: 1) **[P1] Preserve default make goal when adding DGX include** `include pmoves/mk/nvidia-dgx-spark.mk` ahead of any target in the top-level Makefile changed the default goal to the first target of the included file (`spark-ssh`). Bare `make` would attempt an SSH session instead of the prior `update-service-docs` behaviour, breaking local/CI callers. Pin `.DEFAULT_GOAL := update-service-docs` before the include so the original default is preserved. 2) **[P2] Remove partner/guest from exit-node consume ACL** The exit-node consume rule in `tailscale-acl-policy.json` added `tag:partner` and `tag:guest` as sources for `autogroup:internet:*`. That grants both restricted roles full exit-node internet egress, which is a privilege escalation vs the documented role matrix in `pmoves/docs/operations/RUSTDESK_SELF_HOSTED.md` (partner: 3030, 8080, 8081 only; guest: 8081 only). Reverting the source list to `tag:pmoves` + `tag:lab` and pinning the intent in the rule comment so future edits don't silently re-widen. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
POWERFULMOVES
force-pushed
the
fix/infra-dgx-spark-p0
branch
from
April 18, 2026 01:50
82f7224 to
7be0678
Compare
This was referenced Apr 18, 2026
Closed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
P0 infrastructure fixes addressing 5 of 8 DGX Spark integration gaps identified in the full-stack optimization blueprint.
Changes (8 files, +269 / -44)
Network Security
Network Inventory
Build System
Provisioning Fix
Documentation Corrections
Conflict Analysis
All previously conflicting PRs (#1261, #1262, #1270, #1272) merged into main before this branch was created. Zero file overlaps remain.
Refs
Summary by CodeRabbit
New Features
Chores