1import { getKlusterCtx } from '../k8sF/ctxF/klusterCtxF.mts'
2import { execFileThrow } from '../../serverF/childProcF/spawnF.mts'
3import { getMyCfExtIp, getCfExtIpViaDomain, cfCdnTraceUrl, parseCfCdnTrace } from '../../serverF/cfIpF.mts'
4import { getExtIpWithFallbacks } from '../../serverF/extIpFallbacksAI.mts'
5import { assertDefined } from '../../sharedF/assertsF/assertDefinedF.mts'
6import { isDevPc } from '../../sharedF/isDevPcF.mts'
7import { chalkYellow } from '../../serverF/libChalkF.mts'
8
9export const getHarvKlustExtIp = async (props: Record<string, unknown>) => {
10  const {accessByIp} = getKlusterCtx(props)
11  assertDefined(accessByIp)
12  if (accessByIp != 'internetip') return accessByIp
13  const ip = await getExtIpWithFallbacks([getMyCfExtIp, getCfExtIpViaDomain])
14  if (!isDevPc) return ip
15  const ctx = getKlusterCtx() as Record<string, any>
16  const nodeHostname = ctx.sshNodeHostname || ctx.nodeHostname
17  // the node's own egress is the authoritative cluster IP (correct regardless of which network the dev PC is on, e.g. applying across a VPN). The dev-PC egress is only a fallback when SSH to the node is unavailable (initial PXE bring-up before the ssh key is deployed).
18  try {
19    const {stdout: cloudflareRet} = await execFileThrow({
20      isQuiet: true,
21      cmdA: [`ssh`, `rancher@${nodeHostname}`, `curl ${cfCdnTraceUrl}`],
22    })
23    const {ip: nodeExtIp} = parseCfCdnTrace(String(cloudflareRet))
24    if (nodeExtIp != ip) console.warn(chalkYellow(`applying to ${ctx.cluster_name} from a different network (devPcIp=${ip}, nodeIp=${nodeExtIp}); using node's IP`))
25    return nodeExtIp
26  } catch {
27    return ip
28  }
29}
30