Module validate 

Checks a spec for mistakes the generators would turn into broken files. Every problem names the field it’s about (machines.web.networks.dmz) and says what to do, so an author (human or AI) can fix it without reading the generators.

validate runs one validator per section of the spec, in a fixed order (the order of the problems is part of the output): the top level, constraints, cloud services, networks, reach rules, inputs and secrets, machines (with their settings, volumes and ports, then their own process), provisioning and the controller, tools, link impairment, the message, groups, checks and targets.

Structs

Cidr

An IPv4 block, parsed from a.b.c.d/len and written back the same way (Display, FromStr).

Cidr6

An IPv6 /64 block, parsed from prefix::/64 and written back the same way (Display, FromStr).

Problem

One thing wrong with a lowered spec: the field’s path and what to do about it. The plan places it at the field the author wrote, as a crate::syntax::Problem.

Constants

CONTAINER_SYSCTLS

The sysctls a container can set: those the kernel keeps per network or IPC namespace.

DOCKER_BLOCK

Where the Docker target keeps its networks: 172.16.0.0/12 and 192.168.0.0/16 clash with Docker’s own pools, Docker Desktop’s network and home LANs.

IPV6_PREFIX

The prefix length of every IPv6 block: a LAN’s, the one SLAAC and the clouds’ subnets use.

PRIVATE

The private ranges a network can use (RFC 1918).

Functions

docker_cidrs

Each network’s block on the Docker target: its docker.cidr when set; its cidr when it’s inside 10.0.0.0/8 or outside the environment (external, bridged); otherwise moved there automatically, keeping its size (so each machine keeps its last octet): 192.168.X.0 -> 10.192.X.0, 172.N.X.0 -> 10.N.X.0, or the next free block when that one is taken. Validated specs only: a network whose block doesn’t parse is left out (validation reports it).

starts_after

The machines a machine starts after: its depends_on, then the gateways of its networks.

validate

Checks the spec itself (no file system access). See validate_files for paths.

validate_files

Checks that every path the spec mentions exists in the project folder.