joshsiv-mulga 253334a5f5 fix(ipsec): enable openvswitch-ipsec at provision time, drop daemon write ...

Provisioning now runs `systemctl enable --now openvswitch-ipsec.service`
alongside openvswitch-switch and ovn-controller. The spinifex-daemon
process drops its `enable --now` shell-out and only polls is-active.

Sudoers gains one read-only line:
  spinifex-daemon ALL=(root) NOPASSWD: /usr/bin/systemctl is-active openvswitch-ipsec.service

This mirrors the existing vpcd ovn-controller is-active precedent and
removes the daemon's need for systemd-write capability. Aligns with
least-privilege service account pattern: provision enables services,
daemon only reads status.

If the unit is inactive at runtime, the daemon refuses to flip
ipsec_encapsulation=true (silent-drop guard from mulga-siv-136) and
surfaces a clear error pointing at scripts/setup-ovn.sh.

2026-05-25 13:23:39 +10:00

..

ansible

feat(ansible): require --external-pool, drop NAT, forward EXTRA_VARS

2026-05-25 09:33:53 +10:00

demo

feat: Updated GPU-Passthrough - AMD support, GPU images, /demo folder (#217)

2026-05-13 11:07:13 +10:00

iac

chore: bump debian and ubuntu images

2026-05-20 09:48:26 +10:00

images

refactor: strip legacy lb-alpine AMI build path post-microvm-merge

2026-05-19 22:02:00 +10:00

build-microvm-image.sh

ci: prune rootless docker + trap container leaks in microvm build

2026-05-22 16:52:38 +10:00

build-system-image.sh

feat: flip images to UEFI default (#237)

2026-05-20 12:34:51 +10:00

check-coverage.sh

feat: daemon and vm tests (#218)

2026-05-13 11:46:20 +10:00

clone-deps.sh

feat: extract helpers (#109)

2026-04-02 10:25:01 +11:00

create-multi-node.sh

feat: formation join token (#141)

2026-04-15 16:55:55 +10:00

dev-install.sh

feat: spx admin images remove (#239)

2026-05-20 16:20:09 +10:00

dev-setup.sh

feat: privilege separation (#114)

2026-04-07 16:22:19 +10:00

diff-coverage.sh

chore: fix diff-coverage

2026-05-13 09:00:17 +10:00

disk-performance.sh

Latest changes

2026-01-27 08:17:06 +10:00

launch-gpu.sh

feat: Updated GPU-Passthrough - AMD support, GPU images, /demo folder (#217)

2026-05-13 11:07:13 +10:00

reset-dev-env.sh

refactor(vpcd): remove macvlan bridge mode

2026-05-24 21:08:52 +10:00

run-bench.sh

feat: ubuntu 26.04 image

2026-05-05 09:32:29 +10:00

run-instance.sh

feat: ubuntu 26.04 image

2026-05-05 09:32:29 +10:00

setup-ovn.sh

fix(ipsec): enable openvswitch-ipsec at provision time, drop daemon write

2026-05-25 13:23:39 +10:00

setup.sh

fix(ipsec): enable openvswitch-ipsec at provision time, drop daemon write

2026-05-25 13:23:39 +10:00

smoke-test.sh

feat: flip images to UEFI default (#237)

2026-05-20 12:34:51 +10:00

start-dev.sh

feat(predastore): aes 256 encryption at rest

2026-05-12 16:06:16 +10:00

start-multi-node.sh

feat: fix silent failures across spinifex (P2 audit H-25 through H-43)

2026-03-19 13:37:41 +10:00

start-then-terminate-pending.sh

feat: ubuntu 26.04 image

2026-05-05 09:32:29 +10:00

stop-dev.sh

feat: veth pair bridge — link Linux bridge to OVS without conversion

2026-03-25 10:01:37 +10:00

test-ddil-phase1.sh

feat(daemon): DDIL Tier 1 — daemon-local-autonomy phase 1 (#204)

2026-05-10 10:08:12 +10:00

workload-performance.sh

chore: use go 1.26.3

2026-05-08 09:21:12 +10:00