feat(vyos): manage gateway with pyinfra

.github/workflows/ci.yml

@@ -0,0 +1,52 @@
+name: CI
+
+on:
+  pull_request:
+    branches:
+      - master
+  push:
+    branches:
+      - master
+
+permissions: {}
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  check:
+    name: Static checks
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    permissions:
+      contents: read
+    steps:
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+
+      - name: Setup mise
+        uses: jdx/mise-action@7e36c90d9ab29c415a2384db3006f3ec8a8cc654 # v4.2.4
+        with:
+          version: 2026.6.14
+          cache: true
+
+      - name: Resolve uv cache directory
+        id: uv-cache
+        run: echo "dir=$(uv cache dir)" >> "$GITHUB_OUTPUT"
+
+      - name: Cache uv downloads
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        with:
+          path: ${{ steps.uv-cache.outputs.dir }}
+          key: ${{ runner.os }}-uv-network-${{ hashFiles('uv.lock') }}
+          restore-keys: |
+            ${{ runner.os }}-uv-network-
+
+      - name: Run static checks
+        run: moon ci network:check --summary minimal
+        env:
+          NETWORKING_ROOT: ${{ github.workspace }}

.gitignore

@@ -10,6 +10,11 @@ mise.local.toml
 __pycache__/
 *.py[cod]
 .venv/
+.mypy_cache/
+.pytest_cache/
+.ruff_cache/
+.coverage
+
 
 # Tailscale gitops-pusher etag cache
 version-cache.json

.moon/toolchains.yml

@@ -0,0 +1,3 @@
+# Tool versions (Python, uv, moon) are managed by mise (mise.toml + mise.lock);
+# moon runs every task against `system` binaries that mise puts on PATH.
+{}

.moon/workspace.yml

@@ -0,0 +1,12 @@
+projects:
+  sources:
+    network: '.'
+
+defaultProject: 'network'
+
+vcs:
+  defaultBranch: 'master'
+  provider: 'github'
+
+pipeline:
+  installDependencies: false

.python-version

@@ -0,0 +1 @@
+3.14.7

moon.yml

@@ -0,0 +1,110 @@
+language: 'python'
+layer: 'application'
+stack: 'backend'
+tags:
+  - 'network'
+  - 'vyos'
+  - 'uv'
+
+project:
+  title: 'Lab2 network'
+  description: 'Static validation and operator tooling for the lab2 gw01 VyOS gateway.'
+  owner: 'GilmanLab'
+  maintainers:
+    - 'josh'
+
+toolchains:
+  default: 'system'
+
+fileGroups:
+  pySources:
+    - 'src/**/*.py'
+    - 'tests/**/*.py'
+    - 'pyproject.toml'
+    - 'uv.lock'
+    - '.python-version'
+    - 'mise.toml'
+    - 'mise.lock'
+  configs:
+    - 'vyos/gw01/config.boot.tmpl'
+    - 'vyos/gw01/assets/**/*'
+
+workspace:
+  inheritedTasks:
+    include: []
+
+tasks:
+  lock:
+    command: 'uv lock --check'
+    inputs:
+      - 'pyproject.toml'
+      - 'uv.lock'
+    options:
+      cache: false
+
+  format:
+    script: 'uv run --locked ruff format --check . && uv run --locked ruff check --select I .'
+    inputs:
+      - '@group(pySources)'
+    options:
+      cache: false
+
+  lint:
+    command: 'uv run --locked ruff check .'
+    inputs:
+      - '@group(pySources)'
+    options:
+      cache: false
+
+  typecheck:
+    command: 'uv run --locked mypy'
+    inputs:
+      - '@group(pySources)'
+    options:
+      cache: false
+
+  test:
+    command: 'uv run --locked pytest'
+    inputs:
+      - '@group(pySources)'
+    options:
+      cache: false
+
+  vyos-validate:
+    command: 'uv run --locked python -m networking_vyos validate'
+    inputs:
+      - '@group(pySources)'
+      - '@group(configs)'
+    options:
+      cache: false
+      runInCI: true
+
+  vyos-facts:
+    command: 'uv run --locked python -m networking_vyos facts'
+    inputs:
+      - '@group(pySources)'
+    options:
+      cache: false
+      runInCI: false
+
+  vyos-sync:
+    command: 'uv run --locked python -m networking_vyos sync'
+    inputs:
+      - '@group(pySources)'
+      - '@group(configs)'
+    options:
+      cache: false
+      runInCI: false
+
+  check:
+    deps:
+      - 'network:lock'
+      - 'network:format'
+      - 'network:lint'
+      - 'network:typecheck'
+      - 'network:test'
+      - 'network:vyos-validate'
+    inputs: []
+    options:
+      cache: false
+      runInCI: true

pyproject.toml

@@ -0,0 +1,70 @@
+[project]
+name = "networking-vyos"
+version = "0.0.0"
+description = "GitOps tooling for the lab2 gw01 VyOS gateway."
+requires-python = ">=3.14"
+dependencies = [
+    "pyinfra-vyos==0.1.0",
+]
+
+[build-system]
+requires = ["hatchling"]
+build-backend = "hatchling.build"
+
+[dependency-groups]
+dev = [
+    "mypy>=2.3.0",
+    "pytest>=9.1.1",
+    "ruff>=0.16.2",
+]
+
+[tool.uv]
+package = true
+
+[tool.pytest.ini_options]
+testpaths = ["tests"]
+
+[tool.ruff]
+line-length = 100
+target-version = "py314"
+
+[tool.ruff.lint]
+select = [
+    "B",
+    "E4",
+    "E7",
+    "E9",
+    "F",
+    "I",
+    "RUF",
+    "SIM",
+    "UP",
+]
+
+[tool.ruff.format]
+docstring-code-format = true
+line-ending = "lf"
+
+[tool.mypy]
+python_version = "3.14"
+files = ["src"]
+check_untyped_defs = true
+disallow_incomplete_defs = true
+disallow_untyped_defs = true
+extra_checks = true
+no_implicit_optional = true
+pretty = true
+show_error_codes = true
+strict_equality = true
+warn_redundant_casts = true
+warn_unreachable = true
+warn_unused_configs = true
+warn_unused_ignores = true
+
+[[tool.mypy.overrides]]
+module = [
+    "pyinfra",
+    "pyinfra.*",
+]
+ignore_missing_imports = true
+

src/networking_vyos/__init__.py

@@ -0,0 +1,7 @@
+"""Operator tooling for the lab2 gw01 VyOS gateway."""
+
+from __future__ import annotations
+
+__all__ = ["__version__"]
+
+__version__ = "0.0.0"

src/networking_vyos/__main__.py

@@ -0,0 +1,7 @@
+"""``python -m networking_vyos`` entry point."""
+
+from __future__ import annotations
+
+from networking_vyos.cli import main
+
+raise SystemExit(main())