[1/n] create a nexus-lockstep service (#8983)

First step of #8902. It's enough work to get Nexus to stand up another
HTTP service that this is worth its own PR ahead of moving APIs out of
nexus-internal and into nexus-lockstep.

Author: iliana

Cargo.lock

@@ -16,6 +16,7 @@ members = [
     "clients/gateway-client",
     "clients/installinator-client",
     "clients/nexus-client",
+    "clients/nexus-lockstep-client",
     "clients/ntp-admin-client",
     "clients/oxide-client",
     "clients/oximeter-client",
@@ -89,6 +90,7 @@ members = [
     "nexus/external-api",
     "nexus/internal-api",
     "nexus/inventory",
+    "nexus/lockstep-api",
     "nexus/macros-common",
     "nexus/metrics-producer-gc",
     "nexus/mgs-updates",
@@ -174,6 +176,7 @@ default-members = [
     "clients/gateway-client",
     "clients/installinator-client",
     "clients/nexus-client",
+    "clients/nexus-lockstep-client",
     "clients/ntp-admin-client",
     "clients/oxide-client",
     "clients/oximeter-client",
@@ -249,6 +252,7 @@ default-members = [
     "nexus/external-api",
     "nexus/internal-api",
     "nexus/inventory",
+    "nexus/lockstep-api",
     "nexus/macros-common",
     "nexus/metrics-producer-gc",
     "nexus/mgs-updates",
@@ -545,6 +549,8 @@ nexus-defaults = { path = "nexus/defaults" }
 nexus-external-api = { path = "nexus/external-api" }
 nexus-inventory = { path = "nexus/inventory" }
 nexus-internal-api = { path = "nexus/internal-api" }
+nexus-lockstep-api = { path = "nexus/lockstep-api" }
+nexus-lockstep-client = { path = "clients/nexus-lockstep-client" }
 nexus-macros-common = { path = "nexus/macros-common" }
 nexus-metrics-producer-gc = { path = "nexus/metrics-producer-gc" }
 nexus-mgs-updates = { path = "nexus/mgs-updates" }

Cargo.toml

@@ -0,0 +1,20 @@
+[package]
+name = "nexus-lockstep-client"
+version = "0.1.0"
+edition = "2024"
+license = "MPL-2.0"
+
+[lints]
+workspace = true
+
+[dependencies]
+chrono.workspace = true
+futures.workspace = true
+omicron-workspace-hack.workspace = true
+progenitor.workspace = true
+regress.workspace = true
+reqwest.workspace = true
+schemars.workspace = true
+serde.workspace = true
+slog.workspace = true
+uuid.workspace = true

clients/nexus-lockstep-client/Cargo.toml

@@ -0,0 +1,24 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at https://mozilla.org/MPL/2.0/.
+
+//! Interface for making API requests to the Oxide control plane at large from
+//! callers that update in lockstep with Nexus itself (e.g. rack initialization,
+//! tests and debugging)
+
+progenitor::generate_api!(
+    spec = "../../openapi/nexus-lockstep.json",
+    interface = Positional,
+    derives = [schemars::JsonSchema],
+    inner_type = slog::Logger,
+    pre_hook = (|log: &slog::Logger, request: &reqwest::Request| {
+        slog::debug!(log, "client request";
+            "method" => %request.method(),
+            "uri" => %request.url(),
+            "body" => ?&request.body(),
+        );
+    }),
+    post_hook = (|log: &slog::Logger, result: &Result<_, _>| {
+        slog::debug!(log, "client response"; "result" => ?result);
+    }),
+);

clients/nexus-lockstep-client/src/lib.rs

@@ -53,6 +53,7 @@ pub const BOOTSTRAP_ARTIFACT_PORT: u16 = 12227;
 pub const CRUCIBLE_PANTRY_PORT: u16 = 17000;
 pub const TFPORTD_PORT: u16 = 12231;
 pub const NEXUS_INTERNAL_PORT: u16 = 12221;
+pub const NEXUS_LOCKSTEP_PORT: u16 = 12232;
 
 /// The port on which Nexus exposes its external API on the underlay network.
 ///

common/src/address.rs

@@ -339,6 +339,15 @@ server_package_name = "nexus-internal-api"
 versioned_how = "client"
 versioned_how_reason = "Circular dependencies between Nexus and other services"
 
+[[apis]]
+client_package_name = "nexus-lockstep-client"
+label = "Nexus Internal Lockstep API"
+server_package_name = "nexus-lockstep-api"
+# nexus-lockstep-client has to be client-versioned because it's got a cyclic
+# dependency with sled-agent-client, which is server-versioned.
+versioned_how = "client"
+versioned_how_reason = "Circular dependencies between Nexus and other services"
+
 [[apis]]
 client_package_name = "oxide-client"
 label = "External API"

dev-tools/ls-apis/api-manifest.toml

@@ -70,6 +70,8 @@ Nexus Internal API (client: nexus-client)
     consumed by: oximeter-collector (omicron/oximeter/collector) via 1 path
     consumed by: propolis-server (propolis/bin/propolis-server) via 3 paths
 
+Nexus Internal Lockstep API (client: nexus-lockstep-client)
+
 NTP Admin (client: ntp-admin-client)
     consumed by: omicron-nexus (omicron/nexus) via 2 paths
     consumed by: omicron-sled-agent (omicron/sled-agent) via 2 paths

dev-tools/ls-apis/tests/api_dependencies.out

@@ -108,6 +108,10 @@ impl RunAllArgs {
             "omicron-dev: nexus internal API:     {:?}",
             cptestctx.server.get_http_server_internal_address().await,
         );
+        println!(
+            "omicron-dev: nexus lockstep API:     {:?}",
+            cptestctx.server.get_http_server_lockstep_address().await,
+        );
         println!(
             "omicron-dev: cockroachdb pid:        {}",
             cptestctx.database.pid(),

dev-tools/omicron-dev/src/main.rs

@@ -18,15 +18,16 @@ cockroach-admin-api.workspace = true
 debug-ignore.workspace = true
 dns-server-api.workspace = true
 dropshot.workspace = true
-hex.workspace = true
 fs-err.workspace = true
 gateway-api.workspace = true
+hex.workspace = true
 indent_write.workspace = true
 installinator-api.workspace = true
 itertools.workspace = true
+newtype_derive.workspace = true
 nexus-external-api.workspace = true
 nexus-internal-api.workspace = true
-newtype_derive.workspace = true
+nexus-lockstep-api.workspace = true
 ntp-admin-api.workspace = true
 omicron-workspace-hack.workspace = true
 openapi-lint.workspace = true
@@ -41,9 +42,9 @@ sha2.workspace = true
 similar.workspace = true
 sled-agent-api.workspace = true
 slog-error-chain.workspace = true
+supports-color.workspace = true
 textwrap.workspace = true
 thiserror.workspace = true
-supports-color.workspace = true
 wicketd-api.workspace = true
 
 [dev-dependencies]

dev-tools/openapi-manager/Cargo.toml

@@ -13,6 +13,7 @@ use gateway_api::gateway_api_mod;
 use installinator_api::installinator_api_mod;
 use nexus_external_api::nexus_external_api_mod;
 use nexus_internal_api::nexus_internal_api_mod;
+use nexus_lockstep_api::nexus_lockstep_api_mod;
 use ntp_admin_api::ntp_admin_api_mod;
 use oximeter_api::oximeter_api_mod;
 use repo_depot_api::repo_depot_api_mod;
@@ -136,6 +137,15 @@ pub fn all_apis() -> Vec<ManagedApiConfig> {
             ident: "nexus-internal",
             extra_validation: None,
         },
+        ManagedApiConfig {
+            title: "Nexus lockstep API",
+            versions: Versions::new_lockstep(semver::Version::new(0, 0, 1)),
+            description: "Nexus lockstep internal API",
+            boundary: ApiBoundary::Internal,
+            api_description: nexus_lockstep_api_mod::stub_api_description,
+            ident: "nexus-lockstep",
+            extra_validation: None,
+        },
         ManagedApiConfig {
             title: "NTP Admin API",
             versions: Versions::new_versioned(