Feature 57 (config and provisioning): modules declare config and provisions, their files rendered from templates; synced with main (issues of feature 57, 874)

modules/mesh-vault/module.json

@@ -1,6 +1,7 @@
 {
   "module": "mesh-vault",
   "version": "1",
+  "runs-as": "mesh-vault",
   "provides": [
     {
       "name": "secret",
@@ -15,6 +16,9 @@
     "rotated",
     "secret-changed"
   ],
+  "reads": [
+    "mesh-controller.assignments"
+  ],
   "receives": {
     "secret": "${dir:grants}/mesh.json"
   },
@@ -57,32 +61,56 @@
       }
     }
   },
+  "own-secrets": {
+    "broker": "${dir:state}/broker"
+  },
+  "secrets-owner": "mesh-vault",
+  "runtime-health": {
+    "kind": "tool",
+    "tool": "vault_health",
+    "interval": "60s",
+    "timeout": "10s",
+    "looks": 2,
+    "grace": "60s"
+  },
   "resources": [
+    {
+      "id": "account",
+      "type": "user",
+      "name": "mesh-vault",
+      "shell": "/usr/bin/nologin",
+      "home": "/var/lib/mesh-vault"
+    },
     {
       "id": "state",
       "type": "directory",
       "mode": "0700",
+      "owner": "mesh-vault",
       "place": "."
     },
     {
       "id": "grants",
       "type": "directory",
-      "mode": "0700"
+      "mode": "0700",
+      "owner": "mesh-vault"
     },
     {
       "id": "ledger",
       "type": "directory",
-      "mode": "0700"
+      "mode": "0700",
+      "owner": "mesh-vault"
     },
     {
       "id": "root",
       "type": "directory",
-      "mode": "0700"
+      "mode": "0700",
+      "owner": "mesh-vault"
     },
     {
       "id": "store",
       "type": "directory",
-      "mode": "0700"
+      "mode": "0700",
+      "owner": "mesh-vault"
     }
   ],
   "build": {
@@ -112,19 +140,28 @@
     "secret_holders",
     "secret_verify",
     "secret_handed",
+    "secret_asks",
     "secret_vault_export",
     "provisioner_retirement",
     "provisioner_retire_approve",
     "provisioner_retire_reject",
     "provisioner_delete",
-    "vault_status"
+    "vault_status",
+    "vault_health"
   ],
   "claims": [
     {
       "name": "mesh-vault",
       "scope": "mesh",
       "serves": [
-        "get"
+        "get",
+        "accept",
+        "secret-ask",
+        "issued",
+        "rotate",
+        "move-in",
+        "node-key",
+        "move-asks"
       ]
     }
   ]