Move over gocached

cmd/gocached/gocached.go

@@ -0,0 +1,147 @@
+// Copyright (c) Tailscale Inc & AUTHORS
+// SPDX-License-Identifier: BSD-3-Clause
+
+// The gocached command is a small example binary showing how to use
+// the gocached library package.
+package main
+
+import (
+	"context"
+	"flag"
+	"fmt"
+	"log"
+	"net"
+	"net/http"
+	"os"
+	"strings"
+	"time"
+
+	"github.com/bradfitz/parentdeath"
+	"github.com/tailscale/tb/gocache/gocached"
+	_ "modernc.org/sqlite"
+)
+
+var (
+	dir         = flag.String("cache-dir", "", "cache directory, if empty defaults to <UserCacheDir>/gocached")
+	sqliteDir   = flag.String("sqlite-dir", "", "directory for the SQLite metadata database; if empty, defaults to the cache directory")
+	hotDir      = flag.String("hot-dir", "", "if non-empty, enable storage tiering with this directory as a fast tier (e.g. local NVMe) holding a bounded copy of recently used blobs; the cache directory remains the source of truth")
+	hotCapacity = flag.Int("hot-capacity-gb", 600, "maximum size of the hot tier directory in GiB; only used with --hot-dir")
+	putSpoolCap = flag.Int("put-spool-gb", 0, "capacity in GiB of the put queue's spooled lane: accepted PUT bytes waiting on local disk (the hot tier's filesystem, with --hot-dir) for a copy into the cache directory; 0 means one eighth of that filesystem's size")
+	verbose     = flag.Bool("verbose", false, "be verbose")
+	listen      = flag.String("listen", ":31364", "listen address for the build-facing HTTP server")
+	debugListen = flag.String("debug-listen", "", "if non-empty, listen address for the debug HTTP server (pprof, metrics, etc)")
+
+	maxSize = flag.Int("max-size-gb", 50, "maximum size of the cache in GiB; 0 means no limit")
+	maxAge  = flag.Int("max-age-days", 60, "maximum age of objects in the cache in days; 0 means no limit")
+
+	globalGeneration = flag.Int("global-generation", 1, "generation number of the global namespace; incrementing it effectively wipes the global namespace, with the old generation's objects aging out via normal LRU eviction")
+
+	shardPrefixLen = flag.Int("shard-prefix-len", 2, "number of SHA256 hex characters per usage-stats shard key (valid 1..4); total shards = 16^n. Defaults to 2 (256 shards). Increase if a single shard's stats scan becomes too slow on a large DB")
+
+	jwtIssuer = flag.String("jwt-issuer", "", "the issuer to trust JWTs from; if set, all requests will require auth, and must set at least one -jwt-claim")
+	// See example GitHub token claims for what can be available:
+	// https://docs.github.com/en/actions/concepts/security/openid-connect
+	jwtClaims       = make(jwtClaimValue)
+	globalJWTClaims = make(jwtClaimValue)
+)
+
+type jwtClaimValue map[string]string
+
+func (v jwtClaimValue) String() string {
+	return fmt.Sprintf("%v", map[string]string(v))
+}
+
+func (v jwtClaimValue) Set(s string) error {
+	claim, value, ok := strings.Cut(s, "=")
+	if !ok || claim == "" || value == "" {
+		return fmt.Errorf("bad claim %q, want x=y", s)
+	}
+	v[claim] = value
+	return nil
+}
+
+func main() {
+	flag.Var(&jwtClaims, "jwt-claim", "a claim in the form x=y that any JWT presented must have to start a session; may be specified more than once")
+	flag.Var(&globalJWTClaims, "global-jwt-claim", "an additional claim in the form x=y that a JWT must have to allow writing to the cache's global namespace; may be specified more than once")
+	flag.Parse()
+
+	parentdeath.Monitor(func() {
+		log.Printf("gocached: parent process died, exiting")
+		os.Exit(0)
+	})
+
+	opts := []gocached.ServerOption{
+		gocached.WithDir(*dir),
+		gocached.WithSQLiteDir(*sqliteDir),
+		gocached.WithVerbose(*verbose),
+		gocached.WithMaxSize(int64(*maxSize) << 30),
+		gocached.WithMaxAge(time.Duration(*maxAge) * 24 * time.Hour),
+		gocached.WithShardPrefixLen(*shardPrefixLen),
+		gocached.WithGlobalGeneration(*globalGeneration),
+	}
+
+	if *hotDir != "" {
+		if *hotCapacity <= 0 {
+			log.Fatal("--hot-capacity-gb must be positive when --hot-dir is set")
+		}
+		opts = append(opts,
+			gocached.WithHotDir(*hotDir),
+			gocached.WithHotCapacity(int64(*hotCapacity)<<30),
+		)
+	}
+	if *putSpoolCap > 0 {
+		opts = append(opts, gocached.WithPutSpoolCapacity(int64(*putSpoolCap)<<30))
+	}
+
+	if *jwtIssuer != "" {
+		if len(jwtClaims) == 0 {
+			log.Fatal("must specify --jwt-claim at least once when --jwt-issuer is set")
+		}
+
+		opts = append(opts,
+			gocached.WithJWTAuth(*jwtIssuer),
+			gocached.WithNamespaceMapping(func(ctx context.Context, claims map[string]any) (*gocached.NamespaceGrant, error) {
+				var ns gocached.Namespace
+				for k, want := range jwtClaims {
+					if got := claims[k]; got != want {
+						return nil, fmt.Errorf("claim %q = %v, want %v", k, got, want)
+					}
+					if ns != "" {
+						ns += ","
+					}
+					ns += gocached.Namespace(fmt.Sprintf("%s=%s", k, want))
+				}
+				for k, want := range globalJWTClaims {
+					if got := claims[k]; got != want {
+						return &gocached.NamespaceGrant{
+							WriteNamespace:     &ns,
+							ExtraReadNamespace: &ns,
+						}, nil
+					}
+				}
+				return &gocached.NamespaceGrant{
+					WriteNamespace:     new(gocached.GlobalNamespace),
+					ExtraReadNamespace: &ns,
+				}, nil
+			}),
+		)
+	}
+
+	srv, err := gocached.NewServer(opts...)
+	if err != nil {
+		log.Fatalf("starting gocached: %v", err)
+	}
+
+	if *debugListen != "" {
+		debugLn, err := net.Listen("tcp", *debugListen)
+		if err != nil {
+			log.Fatalf("debug listen: %v", err)
+		}
+		go func() {
+			log.Fatal(http.Serve(debugLn, http.HandlerFunc(srv.ServeHTTPDebug)))
+		}()
+	}
+
+	log.Printf("gocached: listening on %s ...", *listen)
+	log.Fatal(http.ListenAndServe(*listen, srv))
+}

cmd/gocached/gocached_test.go

@@ -0,0 +1,59 @@
+// Copyright (c) Tailscale Inc & AUTHORS
+// SPDX-License-Identifier: BSD-3-Clause
+
+package main
+
+import (
+	"testing"
+
+	"github.com/google/go-cmp/cmp"
+)
+
+func TestJWTClaimFlag(t *testing.T) {
+	for name, tc := range map[string]struct {
+		input []string
+		want  jwtClaimValue
+	}{
+		"single_claim": {
+			input: []string{"role=builder"},
+			want:  jwtClaimValue{"role": "builder"},
+		},
+		"multiple_claims": {
+			input: []string{"env=prod", "team=devops"},
+			want:  jwtClaimValue{"env": "prod", "team": "devops"},
+		},
+		"duplicate_keys": {
+			input: []string{"key=value1", "key=value2"},
+			want:  jwtClaimValue{"key": "value2"},
+		},
+		"value_with_equals": {
+			input: []string{"data=a=b=c"},
+			want:  jwtClaimValue{"data": "a=b=c"},
+		},
+	} {
+		t.Run(name, func(t *testing.T) {
+			claim := make(jwtClaimValue)
+			for _, v := range tc.input {
+				if err := claim.Set(v); err != nil {
+					t.Fatalf("Set failed: %v", err)
+				}
+			}
+			if diff := cmp.Diff(claim, tc.want); diff != "" {
+				t.Errorf("jwtClaimValue mismatch (-got +want):\n%s", diff)
+			}
+		})
+	}
+}
+
+func TestInvalidJWTClaimFlags(t *testing.T) {
+	for _, s := range []string{
+		"invalidclaim",
+		"=nokey",
+		"novalue=",
+	} {
+		claim := make(jwtClaimValue)
+		if err := claim.Set(s); err == nil {
+			t.Fatalf("Set with invalid claim %q did not return error", s)
+		}
+	}
+}

go.mod

@@ -3,31 +3,51 @@ module github.com/tailscale/tb
 go 1.27.1
 
 require (
+	github.com/bradfitz/parentdeath v0.0.0-20260315043412-764506aeb900
 	github.com/cespare/xxhash/v2 v2.3.0
+	github.com/go-jose/go-jose/v4 v4.1.3
+	github.com/golang-jwt/jwt/v5 v5.3.1
+	github.com/google/go-cmp v0.7.0
+	github.com/pierrec/lz4/v4 v4.1.26
+	github.com/prometheus/client_golang v1.24.1
+	github.com/prometheus/client_model v0.6.3
+	golang.org/x/sync v0.23.0
+	modernc.org/sqlite v1.51.0
 	tailscale.com v1.103.0-pre.0.20260920011920-7d96cf5a62ef
 )
 
 require (
 	filippo.io/edwards25519 v1.2.0 // indirect
 	github.com/akutz/memconn v0.1.0 // indirect
+	github.com/beorn7/perks v1.0.1 // indirect
 	github.com/coder/websocket v1.8.15 // indirect
 	github.com/dblohm7/wingoes v0.0.0-20260526185140-fb298caac7ca // indirect
+	github.com/dustin/go-humanize v1.0.1 // indirect
 	github.com/fxamacker/cbor/v2 v2.9.3 // indirect
 	github.com/go-json-experiment/json v0.0.0-20260820222146-c27c302e5fc3 // indirect
-	github.com/google/go-cmp v0.7.0 // indirect
+	github.com/google/uuid v1.6.0 // indirect
 	github.com/hdevalence/ed25519consensus v0.2.0 // indirect
 	github.com/jsimonetti/rtnetlink v1.4.2 // indirect
+	github.com/mattn/go-isatty v0.0.24 // indirect
 	github.com/mdlayher/netlink v1.11.2 // indirect
 	github.com/mdlayher/socket v0.7.0 // indirect
 	github.com/mitchellh/go-ps v1.0.0 // indirect
+	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
+	github.com/ncruces/go-strftime v1.0.0 // indirect
+	github.com/prometheus/common v0.71.0 // indirect
+	github.com/prometheus/procfs v0.21.1 // indirect
+	github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec // indirect
 	github.com/tailscale/go-winio v0.0.0-20231025203758-c4f33415bf55 // indirect
 	github.com/x448/float16 v0.8.4 // indirect
 	go4.org/mem v0.0.0-20240501181205-ae6ca9944745 // indirect
 	go4.org/netipx v0.0.0-20260823151212-3075585bcbeb // indirect
 	golang.org/x/crypto v0.57.0 // indirect
 	golang.org/x/exp v0.0.0-20260908205506-85c1c2202aba // indirect
 	golang.org/x/net v0.59.0 // indirect
-	golang.org/x/sync v0.23.0 // indirect
 	golang.org/x/sys v0.48.0 // indirect
 	golang.zx2c4.com/wireguard/windows v1.0.1 // indirect
+	google.golang.org/protobuf v1.36.12 // indirect
+	modernc.org/libc v1.72.3 // indirect
+	modernc.org/mathutil v1.7.1 // indirect
+	modernc.org/memory v1.11.0 // indirect
 )