fabric-vpn

Instructions

When invoked, generate code for VPN and tunneling on FABRIC. Two main capabilities:

1. Tailscale — Zero-trust mesh VPN for direct access to FABRIC nodes from your laptop
2. SSH Tunnels — Port forwarding through FABRIC's bastion host for accessing services

Help the user choose the right approach and generate complete setup code.

Patterns

Tailscale Mesh VPN

from fabrictestbed_extensions.fablib.fablib import FablibManager

fablib = FablibManager()

slice = fablib.new_slice(name="tailscale-experiment")

node1 = slice.add_node(name="node1", site="TACC", cores=4, ram=16, disk=50)
node1.add_fabnet()

node2 = slice.add_node(name="node2", site="UCSD", cores=4, ram=16, disk=50)
node2.add_fabnet()

slice.submit()

# Tailscale auth key from https://login.tailscale.com/admin/settings/keys
ts_key = "tskey-auth-XXXXXXXX"

# Install and start Tailscale on all nodes
for node in slice.get_nodes():
    node.execute(
        f"curl -fsSL https://tailscale.com/install.sh | sh && "
        f"sudo tailscale up --authkey {ts_key}"
    )

# Verify Tailscale status
for node in slice.get_nodes():
    stdout, _ = node.execute("tailscale status")
    print(f"{node.get_name()}:\n{stdout}")

# Access services directly from your laptop via Tailscale hostname
# Example: Start a file browser on node1
node1 = slice.get_node(name="node1")
node1.execute(
    "docker run -d --name filebrowser -p 8989:8989 "
    f"-v /home/{node1.get_username()}:/data "
    "-e FB_ROOT=/data -e FB_PORT=8989 -e FB_NOAUTH=noauth "
    "filebrowser/filebrowser"
)

# From your laptop (connected to same Tailscale network):
# http://node1:8989

# IMPORTANT: Logout before deleting slice
for node in slice.get_nodes():
    node.execute("sudo tailscale logout")

slice.delete()

SSH Tunnels for Service Access

slice = fablib.new_slice(name="tunnel-experiment")

node = slice.add_node(
    name="service-node",
    site=fablib.get_random_site(),
    cores=4,
    ram=16,
    disk=100,
    image="docker_rocky_8",
)

# Enable Docker
node.add_post_boot_upload_directory('node_tools', '.')
node.add_post_boot_execute('node_tools/enable_docker.sh {{ _self_.image }}')

slice.submit()