novox/mesh-catalog
8
0
Fork 0
Code Issues Pull Requests 4 Actions Packages Projects Releases Wiki Activity

Feature 57 (config and provisioning): modules declare config and provisions, their files rendered from templates; synced with main (issues of feature 57, 874)

Browse Source
This commit is contained in:
mesh-tools
2026-10-16 07:37:43 +00:00
parent 1a2c917abf
commit 9652b2d5ce
771 changed files with 52063 additions and 1774 deletions
Download Patch File Download Diff File Expand all files Collapse all files
modules/docker/cmd/docker-tools/logrotation_test.go
+16 -15
View File
@@ -11,14 +11,15 @@ import (
"testing"
)
// The container runtime's log rotation is a preference (novox/hq issue 452).
// The container runtime's log rotation is two config values with defaults (novox/hq issue 452, ADR 0348 §4).
type manifestForLogs struct {
Settings map[string]struct {
Kind string `json:"kind"`
Default any `json:"default"`
Why string `json:"why"`
} `json:"settings"`
Config map[string]struct {
Type string `json:"type"`
Description string `json:"description"`
Default any `json:"default"`
Trusted bool `json:"trusted"`
} `json:"config"`
Resources []map[string]any `json:"resources"`
}
@@ -44,16 +45,16 @@ func resourceByID(m manifestForLogs, id string) (map[string]any, int) {
return nil, -1
}
// filled is a file's content as the controller fills it from the settings' defaults alone: each
// ${setting:<key>} replaced by the default as text, the way the controller writes a value into a file.
// filled is a file's content as the controller fills it from the config values' defaults alone: each
// ${config:<key>} replaced by the default as text, the way the controller writes a value into a file.
func filled(t *testing.T, m manifestForLogs, content string) string {
t.Helper()
ref := regexp.MustCompile(`\$\{setting:([a-z0-9][a-z0-9_.-]*)\}`)
ref := regexp.MustCompile(`\$\{config:([a-z0-9][a-z0-9_.-]*)\}`)
var missing []string
out := ref.ReplaceAllStringFunc(content, func(s string) string {
key := ref.FindStringSubmatch(s)[1]
d, ok := m.Settings[key]
if !ok || d.Kind != "preference" {
d, ok := m.Config[key]
if !ok || d.Default == nil || d.Description == "" || !d.Trusted {
missing = append(missing, key)
return s
}
@@ -77,7 +78,7 @@ func TestTheDefaultLogRotationIsTheOneTheHandSetMachineHas(t *testing.T) {
t.Fatal("no daemon resource")
}
var keys map[string]any
if err := json.Unmarshal([]byte(filled(t, m, daemon["content"].(string))), &keys); err != nil {
if err := json.Unmarshal([]byte(filled(t, m, templateText(t, daemon))), &keys); err != nil {
t.Fatalf("daemon.json's keys with the defaults are not JSON: %v", err)
}
if keys["log-driver"] != "json-file" {
@@ -125,7 +126,7 @@ func TestTheLogRotationIsCheckedBeforeDaemonJSONIsWritten(t *testing.T) {
t.Errorf("log-rotation says trusted %v, want true", conf["trusted"])
}
// The step reads the very values daemon.json takes: the same keys, filled the same way.
values, err := parseLogRotation(filled(t, m, conf["content"].(string)))
values, err := parseLogRotation(filled(t, m, templateText(t, conf)))
if err != nil {
t.Fatalf("the defaults are refused: %v", err)
}
@@ -133,8 +134,8 @@ func TestTheLogRotationIsCheckedBeforeDaemonJSONIsWritten(t *testing.T) {
t.Errorf("defaults read as %+v", values)
}
daemon, _ := resourceByID(m, "daemon")
for _, key := range []string{"${setting:log-max-size}", "${setting:log-max-file}"} {
if !strings.Contains(daemon["content"].(string), key) || !strings.Contains(conf["content"].(string), key) {
for _, key := range []string{"${config:log-max-size}", "${config:log-max-file}"} {
if !strings.Contains(templateText(t, daemon), key) || !strings.Contains(templateText(t, conf), key) {
t.Errorf("%s is not in both daemon and log-rotation", key)
}
}
modules/docker/cmd/docker-tools/templates_test.go
+64
View File
@@ -0,0 +1,64 @@
package main
import (
"encoding/json"
"os"
"path/filepath"
"testing"
)
// The module's directory, where its manifest and its files/ are.
const moduleDir = "../.."
// templateText is the text a file resource places on the machine: its template's, in the module's files/
// (novox/hq ADR 0349 §2). A resource that names no template, or a template that is not there, fails the test.
func templateText(t *testing.T, r map[string]any) string {
t.Helper()
name, _ := r["template"].(string)
if name == "" {
t.Fatalf("resource %v names no template", r["id"])
}
raw, err := os.ReadFile(filepath.Join(moduleDir, filepath.FromSlash(name)))
if err != nil {
t.Fatalf("resource %v names %s: %v", r["id"], name, err)
}
return string(raw)
}
// No file resource carries its text inline: each names its template in files/, and the build packs files/
// into the one archive the controller reads the templates back from (novox/hq ADR 0349 §2).
func TestEveryFileTakesItsTextFromATemplate(t *testing.T) {
raw, err := os.ReadFile(filepath.Join(moduleDir, "module.json"))
if err != nil {
t.Fatal(err)
}
var m struct {
Resources []map[string]any `json:"resources"`
Build struct {
Artifacts []map[string]any `json:"artifacts"`
} `json:"build"`
}
if err := json.Unmarshal(raw, &m); err != nil {
t.Fatal(err)
}
for _, r := range m.Resources {
if _, inline := r["content"]; inline {
t.Errorf("resource %v keeps its text inline: keep it in files/ and name it as the template", r["id"])
}
if r["type"] == "file" {
templateText(t, r)
}
}
packs := 0
for _, a := range m.Build.Artifacts {
if a["kind"] == "archive" && a["from"] == "files" {
packs++
if a["name"] != "files" {
t.Errorf("the templates archive is named %v, not files", a["name"])
}
}
}
if packs != 1 {
t.Errorf("the build packs files/ into %d archives, not one", packs)
}
}
modules/docker/files/daemon.json
+1
View File
@@ -0,0 +1 @@
{"live-restore": true, "insecure-registries": ["${seat:mesh-artifact-store:reach}"], "log-driver": "json-file", "log-opts": {"max-size": "${config:log-max-size}", "max-file": "${config:log-max-file}"}}
modules/docker/files/docker-prune.service
+15
View File
@@ -0,0 +1,15 @@
# Generated by the mesh. Do not edit — module docker writes this file and replaces it at every push.
[Unit]
Description=Prune dangling images and unused build cache (the mesh's docker module)
# Never volumes, never a container, never an image a container uses: dangling
# images and build cache nothing refers to, unused for a week. What a person
# prunes beyond that is docker_prune's, by hand.
After=docker.service
ConditionPathExists=/run/docker.sock
[Service]
Type=oneshot
Nice=19
IOSchedulingClass=idle
ExecStart=/usr/bin/docker image prune --force --filter until=168h
ExecStart=/usr/bin/docker builder prune --force --filter until=168h
modules/docker/files/docker-prune.timer
+11
View File
@@ -0,0 +1,11 @@
# Generated by the mesh. Do not edit — module docker writes this file and replaces it at every push.
[Unit]
Description=Weekly prune of dangling images and unused build cache (the mesh's docker module)
[Timer]
OnCalendar=weekly
RandomizedDelaySec=1h
Persistent=true
[Install]
WantedBy=timers.target
modules/docker/files/log-rotation.conf
+5
View File
@@ -0,0 +1,5 @@
# The log rotation daemon.json takes, written by the mesh from this machine's settings log-max-size and
# log-max-file, and judged by the step log-rotation-check before daemon.json is written (novox/hq issue 452).
# Replaced on every push; change the settings, never this file.
size=${config:log-max-size}
files=${config:log-max-file}
modules/docker/module.json
+25 -15
View File
@@ -44,18 +44,23 @@
"docker exec cat /etc/resolv.conf"
]
},
"settings": {
"log-max-size": {
"kind": "preference",
"default": "100m",
"why": "each container's log is cut at this size and the runtime keeps log-max-file of them, so 100m and 10 hold about 1 GB per container: what the one machine with rotation set by hand has (novox/hq issue 452). A whole number from 1 with k, m or g after it, refused before daemon.json is written. The runtime reads it only at its next start, which the mesh never forces, and a container created before that keeps the options it was created with until it is created again"
"config": {
"log-max-size": {
"type": "string",
"description": "The size each container's log is cut at, a whole number from 1 with k, m or g after it; the runtime keeps log-max-file of them, so 100m and 10 hold about 1 GB per container (novox/hq issue 452). The runtime reads it only at its next start, which the mesh never forces, and a container created before that keeps the options it was created with until it is created again.",
"pattern": "[1-9][0-9]*[kmg]",
"trusted": true,
"default": "100m"
},
"log-max-file": {
"type": "number",
"description": "How many of a container's log files of log-max-size the runtime keeps, a count from 1 to 99, the oldest dropped first; taken at the runtime's next start and by containers created after it, like log-max-size (novox/hq issue 452).",
"minimum": 1,
"maximum": 99,
"trusted": true,
"default": 10
}
},
"log-max-file": {
"kind": "preference",
"default": 10,
"why": "how many of a container's log files of log-max-size the runtime keeps, the oldest dropped first; a count from 1 to 99, refused before daemon.json is written, taken at the runtime's next start and by containers created after it, like log-max-size (novox/hq issue 452)"
}
},
"resources": [
{
"id": "package",
@@ -86,7 +91,7 @@
"path": "${dir:state}/log-rotation.conf",
"mode": "0600",
"trusted": true,
"content": "# The log rotation daemon.json takes, written by the mesh from this machine's settings log-max-size and\n# log-max-file, and judged by the step log-rotation-check before daemon.json is written (novox/hq issue 452).\n# Replaced on every push; change the settings, never this file.\nsize=${setting:log-max-size}\nfiles=${setting:log-max-file}\n"
"template": "files/log-rotation.conf"
},
{
"id": "log-rotation-check",
@@ -112,7 +117,7 @@
"mode": "0644",
"into": "json",
"trusted": true,
"content": "{\"live-restore\": true, \"insecure-registries\": [\"${seat:mesh-artifact-store:reach}\"], \"log-driver\": \"json-file\", \"log-opts\": {\"max-size\": \"${setting:log-max-size}\", \"max-file\": \"${setting:log-max-file}\"}}\n"
"template": "files/daemon.json"
},
{
"id": "runtime",
@@ -129,14 +134,14 @@
"type": "file",
"path": "/etc/systemd/system/docker-prune.service",
"mode": "0644",
"content": "# Generated by the mesh. Do not edit — module docker writes this file and replaces it at every push.\n[Unit]\nDescription=Prune dangling images and unused build cache (the mesh's docker module)\n# Never volumes, never a container, never an image a container uses: dangling\n# images and build cache nothing refers to, unused for a week. What a person\n# prunes beyond that is docker_prune's, by hand.\nAfter=docker.service\nConditionPathExists=/run/docker.sock\n\n[Service]\nType=oneshot\nNice=19\nIOSchedulingClass=idle\nExecStart=/usr/bin/docker image prune --force --filter until=168h\nExecStart=/usr/bin/docker builder prune --force --filter until=168h\n"
"template": "files/docker-prune.service"
},
{
"id": "prune-timer",
"type": "file",
"path": "/etc/systemd/system/docker-prune.timer",
"mode": "0644",
"content": "# Generated by the mesh. Do not edit — module docker writes this file and replaces it at every push.\n[Unit]\nDescription=Weekly prune of dangling images and unused build cache (the mesh's docker module)\n\n[Timer]\nOnCalendar=weekly\nRandomizedDelaySec=1h\nPersistent=true\n\n[Install]\nWantedBy=timers.target\n"
"template": "files/docker-prune.timer"
},
{
"id": "prune",
@@ -162,6 +167,11 @@
"loads": [
"docker-tools"
]
},
{
"name": "files",
"kind": "archive",
"from": "files"
}
]
}