Feature 57 (config and provisioning): modules declare config and provisions, their files rendered from templates; synced with main (issues of feature 57, 874)

modules/nfs-server/module.json

@@ -51,13 +51,20 @@
     "seat:mesh-controller.seats",
     "seat:mesh-controller.data"
   ],
-  "settings": {
-    "grants": {
-      "kind": "preference",
-      "default": "none",
-      "why": "which nodes may mount which share, and how, is this machine's to say (hq ADR 0263, review of mesh-catalog #136): share=node:rw|ro[,node:rw|ro], entries separated by spaces; none exports to no node, whatever a node wants"
-    }
-  },
+    "config": {
+      "shares": {
+        "type": "string",
+        "description": "The folders this machine exports, as space-separated name=path; the operator's, with no default (novox/hq ADR 0263).",
+        "trusted": true,
+        "required": true
+      },
+      "grants": {
+        "type": "string",
+        "description": "Which nodes may mount which share, and how: share=node:rw|ro[,node:rw|ro], entries separated by spaces, or none to export to no node whatever a node wants (novox/hq ADR 0263).",
+        "trusted": true,
+        "default": "none"
+      }
+    },
   "facts": {
     "machines": {
       "path": "/etc/nfs-server/machines",
@@ -88,7 +95,7 @@
       "type": "file",
       "path": "/etc/nfs.conf.d/50-mesh.conf",
       "mode": "0644",
-      "content": "# Written by the mesh (module nfs-server, novox/hq ADR 0263). Replaced on every push; a drop-in of\n# the operator's that sorts after this one overrides it, and is theirs.\n#\n# NFS version 4 only: a client needs port 2049 and nothing else, so the module opens nothing more\n# than that, to the private network. Version 3 needs rpcbind and mountd, on ports the mesh does not open.\n[nfsd]\nvers2=n\nvers3=n\nvers4=y\nvers4.0=n\nvers4.1=y\nvers4.2=y\n"
+      "template": "files/50-mesh.conf"
     },
     {
       "id": "run-dir",
@@ -154,7 +161,7 @@
       "type": "file",
       "path": "/etc/nfs-server/shares.conf",
       "mode": "0644",
-      "content": "# Written by the mesh (module nfs-server, novox/hq ADR 0263) from this machine's assignment.\n# Replaced on every push; change the `shares` setting, never this file.\n#\n# The shares: name=folder, or name=folder:ro, one share per folder. The grants: share=node:rw|ro[,…],\n# which nodes may mount each and how. The module's process exports a share to a node's private address\n# only when it is granted here and that node's mounts module wants it, every client mapped to the\n# folder's owner, and only to addresses inside the range below.\nshares=${setting:shares}\ngrants=${setting:grants}\nrange=${machine:mesh-range}\n"
+      "template": "files/shares.conf"
     }
   ],
   "build": {
@@ -169,6 +176,11 @@
         "loads": [
           "nfs-server"
         ]
+      },
+      {
+        "name": "files",
+        "kind": "archive",
+        "from": "files"
       }
     ]
   }