Validation

Validation

Validation lives in the topology layer, not the compiler. A teamserver no redirector fronts, a host in a no-egress subnet that still needs packages, a host with no management path: these light up live in the canvas, and the compiler refuses to run on an invalid topology.

Every finding carries a machine-readable code and prose written for a person. The code lets tooling react; the prose says what to do.

Each finding is an error, a warning, or info. The compiler refuses to run on any error. A warning does not block the export, but is worth reading before you deploy. An info finding is a notice that never blocks an export: the export is fine, it may just not be what you expect, for example CAP005, a Windows 10 or 11 host on GCP or AWS, which boots Windows Server 2022 there. The canvas counts and lists info findings apart from warnings. A finding about one field is shown next to that field in the Inspector, and a finding about the whole topology opens Topology settings (the Inspector with nothing selected).

Findings

The families you meet most often are below. The full list, with the text for every code, is in docs/validation.md. The other families cover naming (NAM), networks and segments (NET), domains (DOM), referential integrity (REF), cardinality (CAR), provider capability (CAP), the range model (RNG), trusts (TRU), access rights (ACL), services (SVC), hardening (HRD), the jumpbox (JMP), auto-stop (STP), VPN access (VPN), peering (PEER), endpoint kinds (END), collectors (LOG), and fronting (FRT).

Schema (SCH)

• SCH001 (error): a value the topology schema rejects, such as a malformed CIDR, address, prefix, URI prefix, or header name, or an unknown option. A value like that used to compile and then fail in Terraform or Ansible; now it stops the export with a message that names the field and gives an example, and the Inspector marks the field.

Redirectors (RDR)

• RDR001 (error): a redirector has no domain, or its domain is still a placeholder. A domain has to be registered and pointed at the box by hand. Supply one you control.
• RDR002 (warning): decoy_video is on but no decoy_asset_pack is set, so the hero falls back to a still. The page is fine; the warning stops the setting from looking applied when it is not.

Management path (MGT)

Keeps every managed host reachable. Offense topologies only; a defense range's jumpbox and hosts sit on an isolated lab subnet and are exempt.

• MGT001 (error): a host has no management path. Nothing manages its segment or network, and it is not directly reachable. The jumpbox, and any host that already holds a public address, are exempt.

Exposure (EXP)

Exposure is a ceiling: a host cannot be more reachable than its segment allows.

• EXP001 (error): a jumpbox or redirector with no public address, because its segment forbids one or its own public_address is false.
• EXP002 (error): a teamserver, collector, or operator holding a public address. Public addresses belong only on redirectors and jumpboxes.
• EXP003 (error): a host in a segment with egress: none that still needs a package installed. Nothing installs offline.
• EXP005 (error): a host asking for a public address in a segment whose exposure permits none, which would read as exposed and deploy as unreachable.

Boot and ordering

• ORD001 (error): a cycle in the play order derived from the edges. It means the topology is wrong, not the ordering logic.

Compiling a shipped example

Shipped examples that carry a redirector arrive one field short on purpose (see RDR001). Pass a domain you control:

redstackpro compile <blueprint> --hostname <your domain> -o export

Use a domain you registered. A hostname containing example, change-me, changeme, or your-domain is treated as a placeholder and still raises RDR001.