Feature 57 (config and provisioning): modules declare config and provisions, their files rendered from templates; synced with main (issues of feature 57, 874)

2026-10-16 07:37:43 +00:00
parent 1a2c917abf
commit 9652b2d5ce
771 changed files with 52063 additions and 1774 deletions
@@ -0,0 +1,41 @@
+#!/bin/sh
+# Generated by the mesh. Do not edit: module supabase writes this file and replaces it at every push.
+#
+# Two things logflare 1.4.0 does not do for itself, done here before it starts; either failing
+# stops the start, with the reason as the last line of this container's log.
+#
+# 1. The API key never travels in a URL. logflare prints the whole URL of every request that fails,
+# query string included, in the error report Plug.Cowboy writes ("Request: POST
+# /api/logs?source_name=...&api_key=..."). That is an error, so no log level hides it while errors
+# are logged at all (novox/hq issue 268). logflare reads the key from the x-api-key header as well,
+# and the mesh's caller, vector, sends it there; this refuses to start logflare while the vector
+# config it is given still passes the key in a URL: an analytics that does not start says why
+# here, and one that leaks says nothing.
+#
+# 2. Its database says what its environment says. logflare copies LOGFLARE_API_KEY into its default
+# user and POSTGRES_BACKEND_URL into every source's backend once, when it creates them, and never
+# again; reconcile.exs makes both copies match the environment through logflare's own code, after
+# its migrations and before it starts. That is what lets the mesh rotate the key by starting
+# logflare again, and what moves the sources' backend when the database's address or password
+# changes.
+set -e
+conf=/run/logflare/vector.yml
+if [ ! -r "$conf" ]; then
+  echo "analytics: $conf is not there to check, so whether the API key travels in a URL is unknown; not starting (novox/hq issue 268)" >&2
+  exit 1
+fi
+if grep -v '^[[:space:]]*#' "$conf" | grep -q 'api_key='; then
+  echo "analytics: $conf passes the API key in a URL, and logflare prints a failed request's URL; not starting (novox/hq issue 268)" >&2
+  exit 1
+fi
+reconcile=/run/logflare/reconcile.exs
+if [ ! -r "$reconcile" ]; then
+  echo "analytics: $reconcile is not there, so whether logflare's stored key and backends match its environment is unknown; not starting" >&2
+  exit 1
+fi
+cd /opt/app/rel/logflare/bin
+# The tables reconcile.exs reads exist only once the migrations have run; run.sh runs them again,
+# which finds nothing left to do.
+./logflare eval Logflare.Release.migrate
+./logflare eval 'Code.eval_file("/run/logflare/reconcile.exs")'
+exec sh run.sh