| 1 | import type { Env } from "../env.js"; |
| 2 | import { quotasFor } from "./quotas.js"; |
| 3 | |
| 4 | /** |
| 5 | * How much of the internet hosted compute (Actions jobs on hosted runners, agent sandboxes and web |
| 6 | * terminals) reaches, set by EGRESS: |
| 7 | * |
| 8 | * - open (the default): everything. |
| 9 | * - web: HTTP and HTTPS (ports 80 and 443) and DNS only. The container starts without internet |
| 10 | * access, which leaves the platform only those ports and DNS to Cloudflare's resolvers; requests to |
| 11 | * every host (allowedHosts "*") then go out through the Worker (ContainerProxy, exported in |
| 12 | * index.ts). HTTPS is intercepted with a CA the platform puts in the container, which the runner |
| 13 | * agent trusts at start (containers/runner/src/egress.ts). SMTP, SSH and other ports are refused. |
| 14 | * |
| 15 | * As with quotas, the account that owns the repository decides, and accounts run by a site |
| 16 | * administrator stay open, so the instance's own Deploy and live tests keep their egress. |
| 17 | * Self-hosted runners are not affected. |
| 18 | */ |
| 19 | export type Egress = "open" | "web"; |
| 20 | |
| 21 | export async function egressFor(env: Env, accountId: string): Promise<Egress> { |
| 22 | if (env.EGRESS !== "web") return "open"; |
| 23 | return (await quotasFor(env, accountId)).exempt ? "open" : "web"; |
| 24 | } |
| 25 | |
| 26 | /** What a hosted container is started with under a policy (runner/containers.ts). */ |
| 27 | export function egressStart(egress: Egress): { enableInternet: boolean; interceptHttps: boolean; allowedHosts?: string[]; envVars: Record<string, string> } { |
| 28 | if (egress === "open") return { enableInternet: true, interceptHttps: false, envVars: {} }; |
| 29 | return { enableInternet: false, interceptHttps: true, allowedHosts: ["*"], envVars: { DIFFINERY_EGRESS: "web" } }; |
| 30 | } |