novox/mesh-catalog
3
0
Fork 0
Code Issues Pull Requests 4 Packages Projects Releases Wiki Activity

Merge pull request 'A definition names no host path for its own data' (#193) from feat/definitions-place-their-directories into main

Browse Source 
Reviewed-on: #193
This commit was merged in pull request #193.
This commit is contained in:
jschoubben
2026-09-30 19:17:00 +00:00
parent 12bbcafacf eed5e8958a
commit af069dd667
28 changed files with 210 additions and 223 deletions
Download Patch File Download Diff File Expand all files Collapse all files
modules/anthropic-consumer/module.json
+6 -7
View File
@@ -9,10 +9,10 @@
"model-access" "model-access"
], ],
"binds": { "binds": {
"model-access": "/var/lib/anthropic-consumer/model.json" "model-access": "${dir:state}/model.json"
}, },
"secrets": { "secrets": {
"model-access": "/var/lib/anthropic-consumer/access-token" "model-access": "${dir:state}/access-token"
}, },
"own-secrets": { "own-secrets": {
"broker": "/var/lib/mesh/anthropic-consumer/broker" "broker": "/var/lib/mesh/anthropic-consumer/broker"
@@ -30,8 +30,8 @@
{ {
"id": "state", "id": "state",
"type": "directory", "type": "directory",
"path": "/var/lib/anthropic-consumer", "mode": "0700",
"mode": "0700" "place": "."
}, },
{ {
"id": "claude-home", "id": "claude-home",
@@ -42,7 +42,6 @@
{ {
"id": "out", "id": "out",
"type": "directory", "type": "directory",
"path": "/var/lib/anthropic-consumer/out",
"mode": "0700" "mode": "0700"
}, },
{ {
@@ -56,7 +55,7 @@
"/app/modules/anthropic-consumer/dist/apply/index.js" "/app/modules/anthropic-consumer/dist/apply/index.js"
], ],
"volumes": [ "volumes": [
"/var/lib/anthropic-consumer:/run/state" "${dir:state}:/run/state"
], ],
"env": { "env": {
"MESH_MODEL_ACCESS_SECRET_FILE": "/run/state/access-token", "MESH_MODEL_ACCESS_SECRET_FILE": "/run/state/access-token",
@@ -78,7 +77,7 @@
], ],
"volumes": [ "volumes": [
"/var/lib/mesh/anthropic-consumer/broker:/run/secrets/broker:ro", "/var/lib/mesh/anthropic-consumer/broker:/run/secrets/broker:ro",
"/var/lib/anthropic-consumer:/run/state" "${dir:state}:/run/state"
], ],
"env": { "env": {
"MESH_BROKER_FILE": "/run/secrets/broker", "MESH_BROKER_FILE": "/run/secrets/broker",
modules/audit-logger/module.json
+5 -6
View File
@@ -6,7 +6,7 @@
"**" "**"
], ],
"own-secrets": { "own-secrets": {
"broker": "/var/lib/audit-logger/broker" "broker": "${dir:state}/broker"
}, },
"build": { "build": {
"on": [ "on": [
@@ -33,13 +33,12 @@
{ {
"id": "state", "id": "state",
"type": "directory", "type": "directory",
"path": "/var/lib/audit-logger", "mode": "0700",
"mode": "0700" "place": "."
}, },
{ {
"id": "trail", "id": "trail",
"type": "directory", "type": "directory",
"path": "/var/lib/audit-logger/trail",
"mode": "0700" "mode": "0700"
}, },
{ {
@@ -48,8 +47,8 @@
"name": "mesh-audit-logger", "name": "mesh-audit-logger",
"network": "host", "network": "host",
"volumes": [ "volumes": [
"/var/lib/audit-logger/broker:/run/secrets/broker:ro", "${dir:state}/broker:/run/secrets/broker:ro",
"/var/lib/audit-logger/trail:/trail" "${dir:trail}:/trail"
], ],
"env": { "env": {
"MESH_BROKER_FILE": "/run/secrets/broker", "MESH_BROKER_FILE": "/run/secrets/broker",
modules/builder/module.json
+2 -3
View File
@@ -33,7 +33,6 @@
{ {
"id": "workspace", "id": "workspace",
"type": "directory", "type": "directory",
"path": "/var/lib/builder/workspace",
"mode": "0700" "mode": "0700"
}, },
{ {
@@ -41,7 +40,7 @@
"type": "file", "type": "file",
"path": "/var/lib/mesh/builder/builder.env", "path": "/var/lib/mesh/builder/builder.env",
"mode": "0600", "mode": "0600",
"content": "MESH_BROKER_FILE=/run/mesh/broker\nMESH_NODE=${machine:name}\nMESH_REGISTRY=${bound:artifact-store:at}:${bound:artifact-store:port}\nMESH_PACKAGE_BINDING=/run/mesh/package-registry.json\nMESH_NPM_TOKEN_FILE=/run/mesh/package-registry.secret\nMESH_WORKSPACE=/var/lib/builder/workspace\n" "content": "MESH_BROKER_FILE=/run/mesh/broker\nMESH_NODE=${machine:name}\nMESH_REGISTRY=${bound:artifact-store:at}:${bound:artifact-store:port}\nMESH_PACKAGE_BINDING=/run/mesh/package-registry.json\nMESH_NPM_TOKEN_FILE=/run/mesh/package-registry.secret\nMESH_WORKSPACE=${dir:workspace}\n"
}, },
{ {
"id": "server", "id": "server",
@@ -53,7 +52,7 @@
], ],
"volumes": [ "volumes": [
"/var/lib/mesh/builder:/run/mesh:ro", "/var/lib/mesh/builder:/run/mesh:ro",
"/var/lib/builder/workspace:/var/lib/builder/workspace", "${dir:workspace}:${dir:workspace}",
"/var/run/docker.sock:/var/run/docker.sock" "/var/run/docker.sock:/var/run/docker.sock"
], ],
"restart-on": [ "restart-on": [
modules/cloudflare-dns/module.json
+9 -10
View File
@@ -12,13 +12,13 @@
"public-dns": {} "public-dns": {}
}, },
"grants": { "grants": {
"public-dns": "/var/lib/cloudflare-dns/grants" "public-dns": "${dir:grants}"
}, },
"receives": { "receives": {
"public-dns": "/var/lib/cloudflare-dns/grants/mesh.json" "public-dns": "${dir:grants}/mesh.json"
}, },
"own-secrets": { "own-secrets": {
"token": "/var/lib/cloudflare-dns/token", "token": "${dir:state}/token",
"broker": "/var/lib/mesh/cloudflare-dns/broker" "broker": "/var/lib/mesh/cloudflare-dns/broker"
}, },
"emits": [ "emits": [
@@ -35,19 +35,18 @@
{ {
"id": "state", "id": "state",
"type": "directory", "type": "directory",
"path": "/var/lib/cloudflare-dns", "mode": "0700",
"mode": "0700" "place": "."
}, },
{ {
"id": "grants", "id": "grants",
"type": "directory", "type": "directory",
"path": "/var/lib/cloudflare-dns/grants",
"mode": "0700" "mode": "0700"
}, },
{ {
"id": "config", "id": "config",
"type": "file", "type": "file",
"path": "/var/lib/cloudflare-dns/config.json", "path": "${dir:state}/config.json",
"merge": "json", "merge": "json",
"content": "{}", "content": "{}",
"mode": "0600" "mode": "0600"
@@ -58,9 +57,9 @@
"name": "mesh-cloudflare-dns", "name": "mesh-cloudflare-dns",
"network": "host", "network": "host",
"volumes": [ "volumes": [
"/var/lib/cloudflare-dns/config.json:/run/config/config.json:ro", "${dir:state}/config.json:/run/config/config.json:ro",
"/var/lib/cloudflare-dns/grants:/grants", "${dir:grants}:/grants",
"/var/lib/cloudflare-dns/token:/run/secrets/token:ro", "${dir:state}/token:/run/secrets/token:ro",
"/var/lib/mesh/cloudflare-dns/broker:/run/secrets/broker:ro" "/var/lib/mesh/cloudflare-dns/broker:/run/secrets/broker:ro"
], ],
"env": { "env": {
modules/confluence/module.json
+6 -6
View File
@@ -3,7 +3,7 @@
"version": "1", "version": "1",
"slug": "confl", "slug": "confl",
"own-secrets": { "own-secrets": {
"token": "/var/lib/confluence/token", "token": "${dir:state}/token",
"broker": "/var/lib/mesh/confluence/broker" "broker": "/var/lib/mesh/confluence/broker"
}, },
"resources": [ "resources": [
@@ -16,13 +16,13 @@
{ {
"id": "state", "id": "state",
"type": "directory", "type": "directory",
"path": "/var/lib/confluence", "mode": "0700",
"mode": "0700" "place": "."
}, },
{ {
"id": "config", "id": "config",
"type": "file", "type": "file",
"path": "/var/lib/confluence/config.json", "path": "${dir:state}/config.json",
"merge": "json", "merge": "json",
"content": "{}", "content": "{}",
"mode": "0600" "mode": "0600"
@@ -33,8 +33,8 @@
"name": "mesh-runtime-confluence", "name": "mesh-runtime-confluence",
"network": "host", "network": "host",
"volumes": [ "volumes": [
"/var/lib/confluence/config.json:/run/config/config.json:ro", "${dir:state}/config.json:/run/config/config.json:ro",
"/var/lib/confluence/token:/run/secrets/token:ro", "${dir:state}/token:/run/secrets/token:ro",
"/var/lib/mesh/confluence/broker:/run/secrets/broker:ro" "/var/lib/mesh/confluence/broker:/run/secrets/broker:ro"
], ],
"env": { "env": {
modules/de-spiegel/module.json
+7 -7
View File
@@ -15,11 +15,11 @@
} }
}, },
"binds": { "binds": {
"route": "/var/lib/de-spiegel/route.json" "route": "${dir:state}/route.json"
}, },
"own-secrets": { "own-secrets": {
"smtp-user": "/var/lib/de-spiegel/smtp-user.secret", "smtp-user": "${dir:state}/smtp-user.secret",
"smtp-pass": "/var/lib/de-spiegel/smtp-pass.secret" "smtp-pass": "${dir:state}/smtp-pass.secret"
}, },
"listens": [ "listens": [
{ {
@@ -34,13 +34,13 @@
{ {
"id": "state", "id": "state",
"type": "directory", "type": "directory",
"path": "/var/lib/de-spiegel", "mode": "0700",
"mode": "0700" "place": "."
}, },
{ {
"id": "server-env", "id": "server-env",
"type": "file", "type": "file",
"path": "/var/lib/de-spiegel/server.env", "path": "${dir:state}/server.env",
"mode": "0600", "mode": "0600",
"content": "SMTP_AUTH_USER=${secret:smtp-user}\nSMTP_AUTH_PASS=${secret:smtp-pass}\n" "content": "SMTP_AUTH_USER=${secret:smtp-user}\nSMTP_AUTH_PASS=${secret:smtp-pass}\n"
}, },
@@ -56,7 +56,7 @@
"image": "registry-api.novox.be/novox/de-spiegel@sha256:e144b72ce9c145870470d765343549f2c60211728cd118b9ff0e4029f36342ba", "image": "registry-api.novox.be/novox/de-spiegel@sha256:e144b72ce9c145870470d765343549f2c60211728cd118b9ff0e4029f36342ba",
"network": "de-spiegel", "network": "de-spiegel",
"env-file": [ "env-file": [
"/var/lib/de-spiegel/server.env" "${dir:state}/server.env"
], ],
"ports": [ "ports": [
"35621" "35621"
modules/gitlab/module.json
+6 -6
View File
@@ -2,7 +2,7 @@
"module": "gitlab", "module": "gitlab",
"version": "1", "version": "1",
"own-secrets": { "own-secrets": {
"token": "/var/lib/gitlab/token", "token": "${dir:state}/token",
"broker": "/var/lib/mesh/gitlab/broker" "broker": "/var/lib/mesh/gitlab/broker"
}, },
"resources": [ "resources": [
@@ -15,13 +15,13 @@
{ {
"id": "state", "id": "state",
"type": "directory", "type": "directory",
"path": "/var/lib/gitlab", "mode": "0700",
"mode": "0700" "place": "."
}, },
{ {
"id": "config", "id": "config",
"type": "file", "type": "file",
"path": "/var/lib/gitlab/config.json", "path": "${dir:state}/config.json",
"merge": "json", "merge": "json",
"content": "{}", "content": "{}",
"mode": "0600" "mode": "0600"
@@ -32,8 +32,8 @@
"name": "mesh-runtime-gitlab", "name": "mesh-runtime-gitlab",
"network": "host", "network": "host",
"volumes": [ "volumes": [
"/var/lib/gitlab/config.json:/run/config/config.json:ro", "${dir:state}/config.json:/run/config/config.json:ro",
"/var/lib/gitlab/token:/run/secrets/token:ro", "${dir:state}/token:/run/secrets/token:ro",
"/var/lib/mesh/gitlab/broker:/run/secrets/broker:ro" "/var/lib/mesh/gitlab/broker:/run/secrets/broker:ro"
], ],
"env": { "env": {
modules/hello-web/module.json
+5 -5
View File
@@ -15,7 +15,7 @@
} }
}, },
"binds": { "binds": {
"route": "/var/lib/hello-web/route.json" "route": "${dir:state}/route.json"
}, },
"listens": [ "listens": [
{ {
@@ -30,13 +30,13 @@
{ {
"id": "state", "id": "state",
"type": "directory", "type": "directory",
"path": "/var/lib/hello-web", "mode": "0700",
"mode": "0700" "place": "."
}, },
{ {
"id": "page", "id": "page",
"type": "file", "type": "file",
"path": "/var/lib/hello-web/index.html", "path": "${dir:state}/index.html",
"mode": "0644", "mode": "0644",
"content": "hello from hello-web, routed by the mesh\n" "content": "hello from hello-web, routed by the mesh\n"
}, },
@@ -54,7 +54,7 @@
"8080" "8080"
], ],
"volumes": [ "volumes": [
"/var/lib/hello-web/index.html:/www/index.html:ro" "${dir:state}/index.html:/www/index.html:ro"
], ],
"args": [ "args": [
"sh", "sh",
modules/invoicing/module.json
+9 -9
View File
@@ -26,13 +26,13 @@
} }
}, },
"binds": { "binds": {
"mongodb-database": "/var/lib/invoicing/database.json", "mongodb-database": "${dir:state}/database.json",
"s3-bucket": "/var/lib/invoicing/store.json", "s3-bucket": "${dir:state}/store.json",
"route": "/var/lib/invoicing/route.json" "route": "${dir:state}/route.json"
}, },
"secrets": { "secrets": {
"mongodb-database": "/var/lib/invoicing/database.secret", "mongodb-database": "${dir:state}/database.secret",
"s3-bucket": "/var/lib/invoicing/store.secret" "s3-bucket": "${dir:state}/store.secret"
}, },
"listens": [ "listens": [
{ {
@@ -60,13 +60,13 @@
{ {
"id": "state", "id": "state",
"type": "directory", "type": "directory",
"path": "/var/lib/invoicing", "mode": "0700",
"mode": "0700" "place": "."
}, },
{ {
"id": "api-env", "id": "api-env",
"type": "file", "type": "file",
"path": "/var/lib/invoicing/api.env", "path": "${dir:state}/api.env",
"mode": "0600", "mode": "0600",
"content": "NODE_ENV=production\nPORT=9000\nMONGO_URL=mongodb://${bound:mongodb-database:as}:${secret:mongodb-database}@${bound:mongodb-database:at}:${bound:mongodb-database:port}/${bound:mongodb-database:as}?authSource=${bound:mongodb-database:as}\nMONGO_DB=${bound:mongodb-database:as}\nMINIO_BUCKET=mesh-novox-invoice\nMINIO_ENDPOINT=${bound:s3-bucket:at}\nMINIO_PORT=${bound:s3-bucket:port}\nMINIO_ACCESSKEY=${bound:s3-bucket:as}\nMINIO_SECRET=${secret:s3-bucket}\n" "content": "NODE_ENV=production\nPORT=9000\nMONGO_URL=mongodb://${bound:mongodb-database:as}:${secret:mongodb-database}@${bound:mongodb-database:at}:${bound:mongodb-database:port}/${bound:mongodb-database:as}?authSource=${bound:mongodb-database:as}\nMONGO_DB=${bound:mongodb-database:as}\nMINIO_BUCKET=mesh-novox-invoice\nMINIO_ENDPOINT=${bound:s3-bucket:at}\nMINIO_PORT=${bound:s3-bucket:port}\nMINIO_ACCESSKEY=${bound:s3-bucket:as}\nMINIO_SECRET=${secret:s3-bucket}\n"
}, },
@@ -103,7 +103,7 @@
"GID": "2201" "GID": "2201"
}, },
"env-file": [ "env-file": [
"/var/lib/invoicing/api.env" "${dir:state}/api.env"
], ],
"ports": [ "ports": [
"9000" "9000"
modules/jira/module.json
+6 -6
View File
@@ -2,7 +2,7 @@
"module": "jira", "module": "jira",
"version": "1", "version": "1",
"own-secrets": { "own-secrets": {
"token": "/var/lib/jira/token", "token": "${dir:state}/token",
"broker": "/var/lib/mesh/jira/broker" "broker": "/var/lib/mesh/jira/broker"
}, },
"resources": [ "resources": [
@@ -15,13 +15,13 @@
{ {
"id": "state", "id": "state",
"type": "directory", "type": "directory",
"path": "/var/lib/jira", "mode": "0700",
"mode": "0700" "place": "."
}, },
{ {
"id": "config", "id": "config",
"type": "file", "type": "file",
"path": "/var/lib/jira/config.json", "path": "${dir:state}/config.json",
"merge": "json", "merge": "json",
"content": "{}", "content": "{}",
"mode": "0600" "mode": "0600"
@@ -32,8 +32,8 @@
"name": "mesh-runtime-jira", "name": "mesh-runtime-jira",
"network": "host", "network": "host",
"volumes": [ "volumes": [
"/var/lib/jira/config.json:/run/config/config.json:ro", "${dir:state}/config.json:/run/config/config.json:ro",
"/var/lib/jira/token:/run/secrets/token:ro", "${dir:state}/token:/run/secrets/token:ro",
"/var/lib/mesh/jira/broker:/run/secrets/broker:ro" "/var/lib/mesh/jira/broker:/run/secrets/broker:ro"
], ],
"env": { "env": {
modules/keycloak/module.json
+17 -18
View File
@@ -21,11 +21,11 @@
} }
}, },
"binds": { "binds": {
"postgres-database": "/var/lib/keycloak/database.json", "postgres-database": "${dir:state}/database.json",
"route": "/var/lib/keycloak/route.json" "route": "${dir:state}/route.json"
}, },
"secrets": { "secrets": {
"postgres-database": "/var/lib/keycloak/database.secret" "postgres-database": "${dir:state}/database.secret"
}, },
"capabilities": [ "capabilities": [
"container-runtime" "container-runtime"
@@ -55,13 +55,13 @@
} }
}, },
"receives": { "receives": {
"oidc-client": "/var/lib/keycloak/grants/mesh.json" "oidc-client": "${dir:grants}/mesh.json"
}, },
"grants": { "grants": {
"oidc-client": "/var/lib/keycloak/grants" "oidc-client": "${dir:grants}"
}, },
"own-secrets": { "own-secrets": {
"admin": "/var/lib/keycloak/admin.secret", "admin": "${dir:state}/admin.secret",
"broker": "/var/lib/mesh/keycloak/broker" "broker": "/var/lib/mesh/keycloak/broker"
}, },
"resources": [ "resources": [
@@ -74,26 +74,25 @@
{ {
"id": "state", "id": "state",
"type": "directory", "type": "directory",
"path": "/var/lib/keycloak", "mode": "0700",
"mode": "0700" "place": "."
}, },
{ {
"id": "grants", "id": "grants",
"type": "directory", "type": "directory",
"path": "/var/lib/keycloak/grants",
"mode": "0700" "mode": "0700"
}, },
{ {
"id": "admin-env", "id": "admin-env",
"type": "file", "type": "file",
"path": "/var/lib/keycloak/admin.env", "path": "${dir:state}/admin.env",
"mode": "0600", "mode": "0600",
"content": "KEYCLOAK_ADMIN=admin\nKEYCLOAK_ADMIN_PASSWORD=${secret:admin}\n" "content": "KEYCLOAK_ADMIN=admin\nKEYCLOAK_ADMIN_PASSWORD=${secret:admin}\n"
}, },
{ {
"id": "database-env", "id": "database-env",
"type": "file", "type": "file",
"path": "/var/lib/keycloak/database.env", "path": "${dir:state}/database.env",
"mode": "0600", "mode": "0600",
"content": "KC_DB_URL=jdbc:postgresql://${bound:postgres-database:at}:${bound:postgres-database:port}/${bound:postgres-database:as}\nKC_DB_USERNAME=${bound:postgres-database:as}\nKC_DB_PASSWORD=${secret:postgres-database}\n" "content": "KC_DB_URL=jdbc:postgresql://${bound:postgres-database:at}:${bound:postgres-database:port}/${bound:postgres-database:as}\nKC_DB_USERNAME=${bound:postgres-database:as}\nKC_DB_PASSWORD=${secret:postgres-database}\n"
}, },
@@ -105,7 +104,7 @@
{ {
"id": "hostname", "id": "hostname",
"type": "file", "type": "file",
"path": "/var/lib/keycloak/hostname.env", "path": "${dir:state}/hostname.env",
"mode": "0644", "mode": "0644",
"content": "KC_HOSTNAME=https://${bound:route:name}\n" "content": "KC_HOSTNAME=https://${bound:route:name}\n"
}, },
@@ -125,9 +124,9 @@
"KC_PROXY_HEADERS": "xforwarded" "KC_PROXY_HEADERS": "xforwarded"
}, },
"env-file": [ "env-file": [
"/var/lib/keycloak/admin.env", "${dir:state}/admin.env",
"/var/lib/keycloak/database.env", "${dir:state}/database.env",
"/var/lib/keycloak/hostname.env" "${dir:state}/hostname.env"
], ],
"ports": [ "ports": [
"8080" "8080"
@@ -153,15 +152,15 @@
"volumes": [ "volumes": [
"/var/lib/mesh/keycloak/broker:/run/secrets/broker:ro", "/var/lib/mesh/keycloak/broker:/run/secrets/broker:ro",
"/var/lib/mesh/keycloak/config.json:/run/config/config.json:ro", "/var/lib/mesh/keycloak/config.json:/run/config/config.json:ro",
"/var/lib/keycloak/admin.secret:/run/secrets/admin:ro", "${dir:state}/admin.secret:/run/secrets/admin:ro",
"/var/lib/keycloak/grants:/var/lib/keycloak/grants:ro" "${dir:grants}:${dir:grants}:ro"
], ],
"env": { "env": {
"MESH_BROKER_FILE": "/run/secrets/broker", "MESH_BROKER_FILE": "/run/secrets/broker",
"MESH_KEYCLOAK_URL": "http://127.0.0.1:${port:8080}", "MESH_KEYCLOAK_URL": "http://127.0.0.1:${port:8080}",
"MESH_KEYCLOAK_CONFIG_FILE": "/run/config/config.json", "MESH_KEYCLOAK_CONFIG_FILE": "/run/config/config.json",
"MESH_KEYCLOAK_PASSWORD_FILE": "/run/secrets/admin", "MESH_KEYCLOAK_PASSWORD_FILE": "/run/secrets/admin",
"MESH_RECEIVES": "/var/lib/keycloak/grants/mesh.json" "MESH_RECEIVES": "${dir:grants}/mesh.json"
}, },
"restart-on": [ "restart-on": [
"runtime-config" "runtime-config"
modules/local-model-consumer/module.json
+4 -5
View File
@@ -6,25 +6,24 @@
"model-access" "model-access"
], ],
"binds": { "binds": {
"model-access": "/var/lib/local-model-consumer/model.json" "model-access": "${dir:state}/model.json"
}, },
"resources": [ "resources": [
{ {
"id": "state", "id": "state",
"type": "directory", "type": "directory",
"path": "/var/lib/local-model-consumer", "mode": "0700",
"mode": "0700" "place": "."
}, },
{ {
"id": "config", "id": "config",
"type": "directory", "type": "directory",
"path": "/var/lib/local-model-consumer/config",
"mode": "0700" "mode": "0700"
}, },
{ {
"id": "openai-env", "id": "openai-env",
"type": "file", "type": "file",
"path": "/var/lib/local-model-consumer/config/openai.env", "path": "${dir:config}/openai.env",
"mode": "0600", "mode": "0600",
"content": "OPENAI_BASE_URL=http://${bound:model-access:at}:${bound:model-access:port}/v1\nOPENAI_MODEL=${bound:model-access:model}\nOPENAI_API_KEY=local\n" "content": "OPENAI_BASE_URL=http://${bound:model-access:at}:${bound:model-access:port}/v1\nOPENAI_MODEL=${bound:model-access:model}\nOPENAI_API_KEY=local\n"
} }
modules/mesh-catalog/module.json
+7 -7
View File
@@ -20,10 +20,10 @@
} }
}, },
"binds": { "binds": {
"postgres-database": "/var/lib/mesh-catalog/database.json" "postgres-database": "${dir:state}/database.json"
}, },
"secrets": { "secrets": {
"postgres-database": "/var/lib/mesh-catalog/database.secret" "postgres-database": "${dir:state}/database.secret"
}, },
"own-secrets": { "own-secrets": {
"broker": "/var/lib/mesh/mesh-catalog/broker" "broker": "/var/lib/mesh/mesh-catalog/broker"
@@ -49,13 +49,13 @@
{ {
"id": "state", "id": "state",
"type": "directory", "type": "directory",
"path": "/var/lib/mesh-catalog", "mode": "0700",
"mode": "0700" "place": "."
}, },
{ {
"id": "database-url", "id": "database-url",
"type": "file", "type": "file",
"path": "/var/lib/mesh-catalog/database.url", "path": "${dir:state}/database.url",
"mode": "0600", "mode": "0600",
"content": "postgresql://${bound:postgres-database:as}:${secret:postgres-database}@${bound:postgres-database:at}:${bound:postgres-database:port}/${bound:postgres-database:as}\n" "content": "postgresql://${bound:postgres-database:as}:${secret:postgres-database}@${bound:postgres-database:at}:${bound:postgres-database:port}/${bound:postgres-database:as}\n"
}, },
@@ -66,8 +66,8 @@
"network": "host", "network": "host",
"volumes": [ "volumes": [
"/var/lib/mesh/mesh-catalog/broker:/run/secrets/broker:ro", "/var/lib/mesh/mesh-catalog/broker:/run/secrets/broker:ro",
"/var/lib/mesh-catalog:/run/state", "${dir:state}:/run/state",
"/var/lib/mesh-catalog/database.url:/run/secrets/database-url:ro" "${dir:state}/database.url:/run/secrets/database-url:ro"
], ],
"env": { "env": {
"MESH_BROKER_FILE": "/run/secrets/broker", "MESH_BROKER_FILE": "/run/secrets/broker",
modules/mesh-vault/module.json
+10 -13
View File
@@ -21,10 +21,10 @@
"mesh-vault.secret.deprovisioned" "mesh-vault.secret.deprovisioned"
], ],
"receives": { "receives": {
"secret": "/var/lib/mesh-vault/grants/mesh.json" "secret": "${dir:grants}/mesh.json"
}, },
"grants": { "grants": {
"secret": "/var/lib/mesh-vault/grants" "secret": "${dir:grants}"
}, },
"keeps": "/var/lib/mesh-vault/root", "keeps": "/var/lib/mesh-vault/root",
"own-secrets": { "own-secrets": {
@@ -40,25 +40,22 @@
{ {
"id": "state", "id": "state",
"type": "directory", "type": "directory",
"path": "/var/lib/mesh-vault", "mode": "0700",
"mode": "0700" "place": "."
}, },
{ {
"id": "grants", "id": "grants",
"type": "directory", "type": "directory",
"path": "/var/lib/mesh-vault/grants",
"mode": "0700" "mode": "0700"
}, },
{ {
"id": "ledger", "id": "ledger",
"type": "directory", "type": "directory",
"path": "/var/lib/mesh-vault/ledger",
"mode": "0700" "mode": "0700"
}, },
{ {
"id": "root", "id": "root",
"type": "directory", "type": "directory",
"path": "/var/lib/mesh-vault/root",
"mode": "0700" "mode": "0700"
}, },
{ {
@@ -68,15 +65,15 @@
"network": "host", "network": "host",
"volumes": [ "volumes": [
"/var/lib/mesh/mesh-vault/broker:/run/secrets/broker:ro", "/var/lib/mesh/mesh-vault/broker:/run/secrets/broker:ro",
"/var/lib/mesh-vault/grants:/var/lib/mesh-vault/grants:ro", "${dir:grants}:${dir:grants}:ro",
"/var/lib/mesh-vault/ledger:/var/lib/mesh-vault/ledger", "${dir:ledger}:${dir:ledger}",
"/var/lib/mesh-vault/root:/var/lib/mesh-vault/root:ro" "${dir:root}:${dir:root}:ro"
], ],
"env": { "env": {
"MESH_BROKER_FILE": "/run/secrets/broker", "MESH_BROKER_FILE": "/run/secrets/broker",
"MESH_RECEIVES": "/var/lib/mesh-vault/grants/mesh.json", "MESH_RECEIVES": "${dir:grants}/mesh.json",
"MESH_VAULT_LEDGER": "/var/lib/mesh-vault/ledger", "MESH_VAULT_LEDGER": "${dir:ledger}",
"MESH_VAULT_ROOT": "/var/lib/mesh-vault/root" "MESH_VAULT_ROOT": "${dir:root}"
}, },
"artifact": "runtime" "artifact": "runtime"
} }
modules/minio/module.json
+11 -12
View File
@@ -53,13 +53,13 @@
} }
}, },
"receives": { "receives": {
"s3-bucket": "/var/lib/minio/grants/mesh.json" "s3-bucket": "${dir:grants}/mesh.json"
}, },
"grants": { "grants": {
"s3-bucket": "/var/lib/minio/grants" "s3-bucket": "${dir:grants}"
}, },
"own-secrets": { "own-secrets": {
"root": "/var/lib/minio/root.secret", "root": "${dir:state}/root.secret",
"broker": "/var/lib/mesh/minio/broker" "broker": "/var/lib/mesh/minio/broker"
}, },
"resources": [ "resources": [
@@ -72,19 +72,18 @@
{ {
"id": "state", "id": "state",
"type": "directory", "type": "directory",
"path": "/var/lib/minio", "mode": "0700",
"mode": "0700" "place": "."
}, },
{ {
"id": "grants", "id": "grants",
"type": "directory", "type": "directory",
"path": "/var/lib/minio/grants",
"mode": "0700" "mode": "0700"
}, },
{ {
"id": "root-env", "id": "root-env",
"type": "file", "type": "file",
"path": "/var/lib/minio/root.env", "path": "${dir:state}/root.env",
"mode": "0600", "mode": "0600",
"content": "MINIO_ROOT_USER=meshroot\nMINIO_BROWSER_REDIRECT_URL=https://${bound:route:name-console}\n" "content": "MINIO_ROOT_USER=meshroot\nMINIO_BROWSER_REDIRECT_URL=https://${bound:route:name-console}\n"
}, },
@@ -112,7 +111,7 @@
":9001" ":9001"
], ],
"env-file": [ "env-file": [
"/var/lib/minio/root.env" "${dir:state}/root.env"
], ],
"ports": [ "ports": [
"9000", "9000",
@@ -120,7 +119,7 @@
], ],
"volumes": [ "volumes": [
"/var/lib/minio-store:/data", "/var/lib/minio-store:/data",
"/var/lib/minio/root.secret:/run/secrets/root:ro" "${dir:state}/root.secret:/run/secrets/root:ro"
], ],
"env": { "env": {
"MINIO_ROOT_PASSWORD_FILE": "/run/secrets/root", "MINIO_ROOT_PASSWORD_FILE": "/run/secrets/root",
@@ -134,8 +133,8 @@
"network": "minio-net", "network": "minio-net",
"volumes": [ "volumes": [
"/var/lib/mesh/minio/broker:/run/secrets/broker:ro", "/var/lib/mesh/minio/broker:/run/secrets/broker:ro",
"/var/lib/minio/grants:/var/lib/minio/grants:ro", "${dir:grants}:${dir:grants}:ro",
"/var/lib/minio/root.secret:/run/secrets/root:ro" "${dir:state}/root.secret:/run/secrets/root:ro"
], ],
"env": { "env": {
"MESH_MINIO_ENDPOINT": "http://minio:9000", "MESH_MINIO_ENDPOINT": "http://minio:9000",
@@ -143,7 +142,7 @@
"MESH_MINIO_ROOT_PASSWORD_FILE": "/run/secrets/root", "MESH_MINIO_ROOT_PASSWORD_FILE": "/run/secrets/root",
"MESH_MINIO_REGION": "eu-west", "MESH_MINIO_REGION": "eu-west",
"MESH_BROKER_FILE": "/run/secrets/broker", "MESH_BROKER_FILE": "/run/secrets/broker",
"MESH_RECEIVES": "/var/lib/minio/grants/mesh.json" "MESH_RECEIVES": "${dir:grants}/mesh.json"
}, },
"artifact": "runtime" "artifact": "runtime"
} }
modules/model-usage/module.json
+7 -7
View File
@@ -14,10 +14,10 @@
} }
}, },
"binds": { "binds": {
"postgres-database": "/var/lib/model-usage/database.json" "postgres-database": "${dir:state}/database.json"
}, },
"secrets": { "secrets": {
"postgres-database": "/var/lib/model-usage/database.secret" "postgres-database": "${dir:state}/database.secret"
}, },
"consumes": [ "consumes": [
"*.usage.*" "*.usage.*"
@@ -35,13 +35,13 @@
{ {
"id": "state", "id": "state",
"type": "directory", "type": "directory",
"path": "/var/lib/model-usage", "mode": "0700",
"mode": "0700" "place": "."
}, },
{ {
"id": "database-url", "id": "database-url",
"type": "file", "type": "file",
"path": "/var/lib/model-usage/database.url", "path": "${dir:state}/database.url",
"mode": "0600", "mode": "0600",
"content": "postgresql://${bound:postgres-database:as}:${secret:postgres-database}@${bound:postgres-database:at}:${bound:postgres-database:port}/${bound:postgres-database:as}\n" "content": "postgresql://${bound:postgres-database:as}:${secret:postgres-database}@${bound:postgres-database:at}:${bound:postgres-database:port}/${bound:postgres-database:as}\n"
}, },
@@ -53,8 +53,8 @@
"network": "host", "network": "host",
"volumes": [ "volumes": [
"/var/lib/mesh/model-usage/broker:/run/secrets/broker:ro", "/var/lib/mesh/model-usage/broker:/run/secrets/broker:ro",
"/var/lib/model-usage:/run/state", "${dir:state}:/run/state",
"/var/lib/model-usage/database.url:/run/secrets/database-url:ro" "${dir:state}/database.url:/run/secrets/database-url:ro"
], ],
"env": { "env": {
"MESH_BROKER_FILE": "/run/secrets/broker", "MESH_BROKER_FILE": "/run/secrets/broker",
modules/n8n/module.json
+8 -8
View File
@@ -18,14 +18,14 @@
} }
}, },
"binds": { "binds": {
"postgres-database": "/var/lib/n8n/database.json", "postgres-database": "${dir:state}/database.json",
"route": "/var/lib/n8n/route.json" "route": "${dir:state}/route.json"
}, },
"secrets": { "secrets": {
"postgres-database": "/var/lib/n8n/database.secret" "postgres-database": "${dir:state}/database.secret"
}, },
"own-secrets": { "own-secrets": {
"basic-auth": "/var/lib/n8n/basic-auth.secret" "basic-auth": "${dir:state}/basic-auth.secret"
}, },
"listens": [ "listens": [
{ {
@@ -40,8 +40,8 @@
{ {
"id": "state", "id": "state",
"type": "directory", "type": "directory",
"path": "/var/lib/n8n", "mode": "0700",
"mode": "0700" "place": "."
}, },
{ {
"id": "data", "id": "data",
@@ -53,7 +53,7 @@
{ {
"id": "server-env", "id": "server-env",
"type": "file", "type": "file",
"path": "/var/lib/n8n/server.env", "path": "${dir:state}/server.env",
"mode": "0600", "mode": "0600",
"content": "N8N_HOST=${bound:route:name}\nN8N_PORT=5678\nN8N_PROTOCOL=https\nWEBHOOK_URL=https://${bound:route:name}/\nN8N_BASIC_AUTH_ACTIVE=true\nN8N_BASIC_AUTH_USER=admin\nN8N_BASIC_AUTH_PASSWORD=${secret:basic-auth}\nNODE_FUNCTION_ALLOW_BUILTIN=*\nNODE_FUNCTION_ALLOW_EXTERNAL=*\nDB_TYPE=postgresdb\nDB_POSTGRESDB_HOST=${bound:postgres-database:at}\nDB_POSTGRESDB_PORT=${bound:postgres-database:port}\nDB_POSTGRESDB_DATABASE=${bound:postgres-database:as}\nDB_POSTGRESDB_USER=${bound:postgres-database:as}\nDB_POSTGRESDB_PASSWORD=${secret:postgres-database}\n" "content": "N8N_HOST=${bound:route:name}\nN8N_PORT=5678\nN8N_PROTOCOL=https\nWEBHOOK_URL=https://${bound:route:name}/\nN8N_BASIC_AUTH_ACTIVE=true\nN8N_BASIC_AUTH_USER=admin\nN8N_BASIC_AUTH_PASSWORD=${secret:basic-auth}\nNODE_FUNCTION_ALLOW_BUILTIN=*\nNODE_FUNCTION_ALLOW_EXTERNAL=*\nDB_TYPE=postgresdb\nDB_POSTGRESDB_HOST=${bound:postgres-database:at}\nDB_POSTGRESDB_PORT=${bound:postgres-database:port}\nDB_POSTGRESDB_DATABASE=${bound:postgres-database:as}\nDB_POSTGRESDB_USER=${bound:postgres-database:as}\nDB_POSTGRESDB_PASSWORD=${secret:postgres-database}\n"
}, },
@@ -69,7 +69,7 @@
"image": "n8nio/n8n@sha256:4846eb2f4b874ab04cde7fc1e249d2ddaec66e9aea64439beb2972cfea88e3c0", "image": "n8nio/n8n@sha256:4846eb2f4b874ab04cde7fc1e249d2ddaec66e9aea64439beb2972cfea88e3c0",
"network": "n8n", "network": "n8n",
"env-file": [ "env-file": [
"/var/lib/n8n/server.env" "${dir:state}/server.env"
], ],
"ports": [ "ports": [
"5678" "5678"
modules/openai-consumer/module.json
+5 -6
View File
@@ -9,22 +9,21 @@
"model-access" "model-access"
], ],
"binds": { "binds": {
"model-access": "/var/lib/openai-consumer/model.json" "model-access": "${dir:state}/model.json"
}, },
"secrets": { "secrets": {
"model-access": "/var/lib/openai-consumer/api-key" "model-access": "${dir:state}/api-key"
}, },
"resources": [ "resources": [
{ {
"id": "state", "id": "state",
"type": "directory", "type": "directory",
"path": "/var/lib/openai-consumer", "mode": "0700",
"mode": "0700" "place": "."
}, },
{ {
"id": "config", "id": "config",
"type": "directory", "type": "directory",
"path": "/var/lib/openai-consumer/config",
"mode": "0700" "mode": "0700"
}, },
{ {
@@ -38,7 +37,7 @@
"/app/modules/openai-consumer/dist/apply/index.js" "/app/modules/openai-consumer/dist/apply/index.js"
], ],
"volumes": [ "volumes": [
"/var/lib/openai-consumer:/run/state" "${dir:state}:/run/state"
], ],
"env": { "env": {
"MESH_MODEL_ACCESS_SECRET_FILE": "/run/state/api-key", "MESH_MODEL_ACCESS_SECRET_FILE": "/run/state/api-key",
modules/photos-eef/module.json
+3 -3
View File
@@ -15,7 +15,7 @@
} }
}, },
"binds": { "binds": {
"route": "/var/lib/photos-eef/route.json" "route": "${dir:state}/route.json"
}, },
"listens": [ "listens": [
{ {
@@ -30,8 +30,8 @@
{ {
"id": "state", "id": "state",
"type": "directory", "type": "directory",
"path": "/var/lib/photos-eef", "mode": "0700",
"mode": "0700" "place": "."
}, },
{ {
"id": "net", "id": "net",
modules/photos-filip/module.json
+3 -3
View File
@@ -15,7 +15,7 @@
} }
}, },
"binds": { "binds": {
"route": "/var/lib/photos-filip/route.json" "route": "${dir:state}/route.json"
}, },
"listens": [ "listens": [
{ {
@@ -30,8 +30,8 @@
{ {
"id": "state", "id": "state",
"type": "directory", "type": "directory",
"path": "/var/lib/photos-filip", "mode": "0700",
"mode": "0700" "place": "."
}, },
{ {
"id": "net", "id": "net",
modules/photos/module.json
+9 -9
View File
@@ -22,13 +22,13 @@
} }
}, },
"binds": { "binds": {
"s3-bucket": "/var/lib/photos/store.json", "s3-bucket": "${dir:state}/store.json",
"mongodb-database": "/var/lib/photos/database.json", "mongodb-database": "${dir:state}/database.json",
"route": "/var/lib/photos/route.json" "route": "${dir:state}/route.json"
}, },
"secrets": { "secrets": {
"s3-bucket": "/var/lib/photos/store.secret", "s3-bucket": "${dir:state}/store.secret",
"mongodb-database": "/var/lib/photos/database.secret" "mongodb-database": "${dir:state}/database.secret"
}, },
"listens": [ "listens": [
{ {
@@ -50,13 +50,13 @@
{ {
"id": "state", "id": "state",
"type": "directory", "type": "directory",
"path": "/var/lib/photos", "mode": "0700",
"mode": "0700" "place": "."
}, },
{ {
"id": "server-env", "id": "server-env",
"type": "file", "type": "file",
"path": "/var/lib/photos/server.env", "path": "${dir:state}/server.env",
"mode": "0600", "mode": "0600",
"content": "NODE_ENV=production\nPORT=9000\nMONGO_URL=mongodb://${bound:mongodb-database:as}:${secret:mongodb-database}@${bound:mongodb-database:at}:${bound:mongodb-database:port}/${bound:mongodb-database:as}?authSource=admin\nMONGO_DB=${bound:mongodb-database:as}\nMINIO_ENDPOINT=${bound:s3-bucket:at}\nMINIO_PORT=${bound:s3-bucket:port}\nMINIO_BUCKET=mesh-novox-photos\nMINIO_ACCESSKEY=${bound:s3-bucket:as}\nMINIO_SECRET=${secret:s3-bucket}\nMINIO_USE_SSL=false\n" "content": "NODE_ENV=production\nPORT=9000\nMONGO_URL=mongodb://${bound:mongodb-database:as}:${secret:mongodb-database}@${bound:mongodb-database:at}:${bound:mongodb-database:port}/${bound:mongodb-database:as}?authSource=admin\nMONGO_DB=${bound:mongodb-database:as}\nMINIO_ENDPOINT=${bound:s3-bucket:at}\nMINIO_PORT=${bound:s3-bucket:port}\nMINIO_BUCKET=mesh-novox-photos\nMINIO_ACCESSKEY=${bound:s3-bucket:as}\nMINIO_SECRET=${secret:s3-bucket}\nMINIO_USE_SSL=false\n"
}, },
@@ -72,7 +72,7 @@
"image": "registry-api.novox.be/novox/photos-server@sha256:3f165acbbd1fd731b12fe798c95879c081a44b00e2c569ef7f47165f6a527201", "image": "registry-api.novox.be/novox/photos-server@sha256:3f165acbbd1fd731b12fe798c95879c081a44b00e2c569ef7f47165f6a527201",
"network": "photos", "network": "photos",
"env-file": [ "env-file": [
"/var/lib/photos/server.env" "${dir:state}/server.env"
], ],
"ports": [ "ports": [
"9000" "9000"
modules/postgres/module.json
+9 -10
View File
@@ -42,13 +42,13 @@
} }
}, },
"receives": { "receives": {
"postgres-database": "/var/lib/postgres/grants/mesh.json" "postgres-database": "${dir:grants}/mesh.json"
}, },
"grants": { "grants": {
"postgres-database": "/var/lib/postgres/grants" "postgres-database": "${dir:grants}"
}, },
"own-secrets": { "own-secrets": {
"superuser": "/var/lib/postgres/superuser.secret", "superuser": "${dir:state}/superuser.secret",
"broker": "/var/lib/mesh/postgres/broker" "broker": "/var/lib/mesh/postgres/broker"
}, },
"resources": [ "resources": [
@@ -61,13 +61,12 @@
{ {
"id": "state", "id": "state",
"type": "directory", "type": "directory",
"path": "/var/lib/postgres", "mode": "0700",
"mode": "0700" "place": "."
}, },
{ {
"id": "grants", "id": "grants",
"type": "directory", "type": "directory",
"path": "/var/lib/postgres/grants",
"mode": "0700" "mode": "0700"
}, },
{ {
@@ -91,7 +90,7 @@
], ],
"volumes": [ "volumes": [
"/var/lib/mesh-store:/var/lib/postgresql/data", "/var/lib/mesh-store:/var/lib/postgresql/data",
"/var/lib/postgres/superuser.secret:/run/secrets/superuser:ro" "${dir:state}/superuser.secret:/run/secrets/superuser:ro"
] ]
}, },
{ {
@@ -101,15 +100,15 @@
"network": "host", "network": "host",
"volumes": [ "volumes": [
"/var/lib/mesh/postgres/broker:/run/secrets/broker:ro", "/var/lib/mesh/postgres/broker:/run/secrets/broker:ro",
"/var/lib/postgres/grants:/var/lib/postgres/grants:ro", "${dir:grants}:${dir:grants}:ro",
"/var/lib/postgres/superuser.secret:/run/secrets/superuser:ro" "${dir:state}/superuser.secret:/run/secrets/superuser:ro"
], ],
"env": { "env": {
"MESH_PROVISION_POSTGRES": "postgres://postgres@127.0.0.1:${port:5432}/postgres?sslmode=disable", "MESH_PROVISION_POSTGRES": "postgres://postgres@127.0.0.1:${port:5432}/postgres?sslmode=disable",
"MESH_PROVISION_POSTGRES_PORT": "${seat:mesh-store:5432}", "MESH_PROVISION_POSTGRES_PORT": "${seat:mesh-store:5432}",
"MESH_PROVISION_PASSWORD_FILE": "/run/secrets/superuser", "MESH_PROVISION_PASSWORD_FILE": "/run/secrets/superuser",
"MESH_BROKER_FILE": "/run/secrets/broker", "MESH_BROKER_FILE": "/run/secrets/broker",
"MESH_RECEIVES": "/var/lib/postgres/grants/mesh.json" "MESH_RECEIVES": "${dir:grants}/mesh.json"
}, },
"artifact": "runtime" "artifact": "runtime"
} }
modules/records/module.json
+4 -4
View File
@@ -34,8 +34,8 @@
{ {
"id": "checkout", "id": "checkout",
"type": "directory", "type": "directory",
"path": "/var/lib/records", "mode": "0700",
"mode": "0700" "place": "."
}, },
{ {
"id": "config", "id": "config",
@@ -61,13 +61,13 @@
"/var/lib/mesh/records/broker:/run/secrets/broker:ro", "/var/lib/mesh/records/broker:/run/secrets/broker:ro",
"/var/lib/mesh/records/config.json:/run/config/config.json:ro", "/var/lib/mesh/records/config.json:/run/config/config.json:ro",
"/var/lib/mesh/records/origin:/run/config/origin:ro", "/var/lib/mesh/records/origin:/run/config/origin:ro",
"/var/lib/records:/var/lib/records" "${dir:checkout}:${dir:checkout}"
], ],
"env": { "env": {
"MESH_BROKER_FILE": "/run/secrets/broker", "MESH_BROKER_FILE": "/run/secrets/broker",
"MESH_RECORDS_CONFIG_FILE": "/run/config/config.json", "MESH_RECORDS_CONFIG_FILE": "/run/config/config.json",
"MESH_RECORDS_ORIGIN_FILE": "/run/config/origin", "MESH_RECORDS_ORIGIN_FILE": "/run/config/origin",
"MESH_RECORDS_DIR": "/var/lib/records" "MESH_RECORDS_DIR": "${dir:checkout}"
}, },
"artifact": "runtime", "artifact": "runtime",
"restart-on": [ "restart-on": [
modules/route-adapter/module.json
+7 -7
View File
@@ -15,7 +15,7 @@
"route": {} "route": {}
}, },
"receives": { "receives": {
"route": "/var/lib/route-adapter/routes/mesh.json" "route": "${dir:routes-dir}/mesh.json"
}, },
"accesses": [ "accesses": [
{ {
@@ -27,8 +27,8 @@
{ {
"id": "state", "id": "state",
"type": "directory", "type": "directory",
"path": "/var/lib/route-adapter", "mode": "0700",
"mode": "0700" "place": "."
}, },
{ {
"id": "routes-dir", "id": "routes-dir",
@@ -39,7 +39,7 @@
{ {
"id": "config", "id": "config",
"type": "file", "type": "file",
"path": "/var/lib/route-adapter/config.json", "path": "${dir:state}/config.json",
"merge": "json", "merge": "json",
"mode": "0644", "mode": "0644",
"content": "{\n \"dynamic\": \"/services/traefik/dynamic\",\n \"entrypoint\": \"websecure\",\n \"certificate-resolver\": \"le\",\n \"machine\": \"host.docker.internal\"\n}\n" "content": "{\n \"dynamic\": \"/services/traefik/dynamic\",\n \"entrypoint\": \"websecure\",\n \"certificate-resolver\": \"le\",\n \"machine\": \"host.docker.internal\"\n}\n"
@@ -51,12 +51,12 @@
"artifact": "runtime", "artifact": "runtime",
"run-once": true, "run-once": true,
"volumes": [ "volumes": [
"/var/lib/route-adapter/routes/mesh.json:/var/lib/route-adapter/routes/mesh.json:ro", "${dir:routes-dir}/mesh.json:${dir:routes-dir}/mesh.json:ro",
"/var/lib/route-adapter/config.json:/run/config/config.json:ro", "${dir:state}/config.json:/run/config/config.json:ro",
"/services/traefik/dynamic:/services/traefik/dynamic" "/services/traefik/dynamic:/services/traefik/dynamic"
], ],
"env": { "env": {
"MESH_RECEIVES": "/var/lib/route-adapter/routes/mesh.json", "MESH_RECEIVES": "${dir:routes-dir}/mesh.json",
"MESH_ROUTE_ADAPTER_CONFIG": "/run/config/config.json" "MESH_ROUTE_ADAPTER_CONFIG": "/run/config/config.json"
}, },
"args": [ "args": [
modules/route-proxy/module.json
+16 -16
View File
@@ -15,15 +15,15 @@
"route": {} "route": {}
}, },
"receives": { "receives": {
"route": "/var/lib/route-proxy/routes/mesh.json" "route": "${dir:routes-dir}/mesh.json"
}, },
"requires": [ "requires": [
"acme-ca", "acme-ca",
"internal-acme-ca" "internal-acme-ca"
], ],
"binds": { "binds": {
"acme-ca": "/var/lib/route-proxy/acme-ca.json", "acme-ca": "${dir:state}/acme-ca.json",
"internal-acme-ca": "/var/lib/route-proxy/internal-acme-ca.json" "internal-acme-ca": "${dir:state}/internal-acme-ca.json"
}, },
"listens": [ "listens": [
{ {
@@ -45,8 +45,8 @@
{ {
"id": "state", "id": "state",
"type": "directory", "type": "directory",
"path": "/var/lib/route-proxy", "mode": "0700",
"mode": "0700" "place": "."
}, },
{ {
"id": "routes-dir", "id": "routes-dir",
@@ -69,14 +69,14 @@
{ {
"id": "acme-env", "id": "acme-env",
"type": "file", "type": "file",
"path": "/var/lib/route-proxy/acme.env", "path": "${dir:state}/acme.env",
"mode": "0600", "mode": "0600",
"content": "ACME_DIRECTORY=https://${bound:acme-ca:at}:${bound:acme-ca:port}${bound:acme-ca:path}\nACME_ROOTS=https://${bound:acme-ca:at}:${bound:acme-ca:port}${bound:acme-ca:roots}\nACME_ROOTS_PATH=${bound:acme-ca:roots}\n" "content": "ACME_DIRECTORY=https://${bound:acme-ca:at}:${bound:acme-ca:port}${bound:acme-ca:path}\nACME_ROOTS=https://${bound:acme-ca:at}:${bound:acme-ca:port}${bound:acme-ca:roots}\nACME_ROOTS_PATH=${bound:acme-ca:roots}\n"
}, },
{ {
"id": "internal-acme-env", "id": "internal-acme-env",
"type": "file", "type": "file",
"path": "/var/lib/route-proxy/internal-acme.env", "path": "${dir:state}/internal-acme.env",
"mode": "0600", "mode": "0600",
"content": "INTERNAL_ACME_DIRECTORY=https://${bound:internal-acme-ca:at}:${bound:internal-acme-ca:port}${bound:internal-acme-ca:path}\nINTERNAL_ACME_ROOTS=https://${bound:internal-acme-ca:at}:${bound:internal-acme-ca:port}${bound:internal-acme-ca:roots}\nINTERNAL_ACME_ROOTS_PATH=${bound:internal-acme-ca:roots}\n" "content": "INTERNAL_ACME_DIRECTORY=https://${bound:internal-acme-ca:at}:${bound:internal-acme-ca:port}${bound:internal-acme-ca:path}\nINTERNAL_ACME_ROOTS=https://${bound:internal-acme-ca:at}:${bound:internal-acme-ca:port}${bound:internal-acme-ca:roots}\nINTERNAL_ACME_ROOTS_PATH=${bound:internal-acme-ca:roots}\n"
}, },
@@ -88,10 +88,10 @@
"run-once": true, "run-once": true,
"network": "host", "network": "host",
"env-file": [ "env-file": [
"/var/lib/route-proxy/acme.env" "${dir:state}/acme.env"
], ],
"volumes": [ "volumes": [
"/var/lib/route-proxy/ca:/ca" "${dir:ca-dir}:/ca"
], ],
"args": [ "args": [
"sh", "sh",
@@ -110,10 +110,10 @@
"run-once": true, "run-once": true,
"network": "host", "network": "host",
"env-file": [ "env-file": [
"/var/lib/route-proxy/internal-acme.env" "${dir:state}/internal-acme.env"
], ],
"volumes": [ "volumes": [
"/var/lib/route-proxy/ca:/ca" "${dir:ca-dir}:/ca"
], ],
"args": [ "args": [
"sh", "sh",
@@ -131,13 +131,13 @@
"artifact": "server", "artifact": "server",
"network": "host", "network": "host",
"env-file": [ "env-file": [
"/var/lib/route-proxy/acme.env", "${dir:state}/acme.env",
"/var/lib/route-proxy/internal-acme.env" "${dir:state}/internal-acme.env"
], ],
"volumes": [ "volumes": [
"/var/lib/route-proxy/routes:/routes:ro", "${dir:routes-dir}:/routes:ro",
"/var/lib/route-proxy/acme:/acme", "${dir:acme-cache}:/acme",
"/var/lib/route-proxy/ca:/ca:ro" "${dir:ca-dir}:/ca:ro"
], ],
"env": { "env": {
"ROUTES": "/routes/mesh.json", "ROUTES": "/routes/mesh.json",
modules/showcase/module.json
+8 -8
View File
@@ -20,10 +20,10 @@
"postgres-database" "postgres-database"
], ],
"binds": { "binds": {
"postgres-database": "/var/lib/showcase/database.json" "postgres-database": "${dir:state}/database.json"
}, },
"secrets": { "secrets": {
"postgres-database": "/var/lib/showcase/database.secret" "postgres-database": "${dir:state}/database.secret"
}, },
"own-secrets": { "own-secrets": {
"broker": "/var/lib/mesh/showcase/broker" "broker": "/var/lib/mesh/showcase/broker"
@@ -100,13 +100,13 @@
{ {
"id": "state", "id": "state",
"type": "directory", "type": "directory",
"path": "/var/lib/showcase", "mode": "0755",
"mode": "0755" "place": "."
}, },
{ {
"id": "settings", "id": "settings",
"type": "file", "type": "file",
"path": "/var/lib/showcase/showcase.env", "path": "${dir:state}/showcase.env",
"mode": "0600", "mode": "0600",
"content": "SHOWCASE_GREETING=hello\nSHOWCASE_EVERY_SECONDS=30\nSHOWCASE_STATE=/var/lib/showcase\nSHOWCASE_DATABASE=${bound:postgres-database:at}\nSHOWCASE_LISTEN=${port:8080}\n" "content": "SHOWCASE_GREETING=hello\nSHOWCASE_EVERY_SECONDS=30\nSHOWCASE_STATE=/var/lib/showcase\nSHOWCASE_DATABASE=${bound:postgres-database:at}\nSHOWCASE_LISTEN=${port:8080}\n"
}, },
@@ -137,7 +137,7 @@
], ],
"run-once": true, "run-once": true,
"env-file": [ "env-file": [
"/var/lib/showcase/showcase.env" "${dir:state}/showcase.env"
] ]
}, },
{ {
@@ -151,7 +151,7 @@
], ],
"user": "showcase", "user": "showcase",
"env-file": [ "env-file": [
"/var/lib/showcase/showcase.env" "${dir:state}/showcase.env"
], ],
"restart-on": [ "restart-on": [
"settings" "settings"
@@ -168,7 +168,7 @@
], ],
"schedule": "0 3 * * *", "schedule": "0 3 * * *",
"env-file": [ "env-file": [
"/var/lib/showcase/showcase.env" "${dir:state}/showcase.env"
] ]
}, },
{ {
modules/step-ca/module.json
+3 -3
View File
@@ -46,9 +46,9 @@
{ {
"id": "home", "id": "home",
"type": "directory", "type": "directory",
"path": "/var/lib/step-ca",
"mode": "0700", "mode": "0700",
"owner": "1000:1000" "owner": "1000:1000",
"place": "."
}, },
{ {
"id": "config", "id": "config",
@@ -80,7 +80,7 @@
"DOCKER_STEPCA_INIT_REMOTE_MANAGEMENT": "false" "DOCKER_STEPCA_INIT_REMOTE_MANAGEMENT": "false"
}, },
"volumes": [ "volumes": [
"/var/lib/step-ca:/home/step", "${dir:home}:/home/step",
"/var/lib/mesh/step-ca:/run/mesh:ro" "/var/lib/mesh/step-ca:/run/mesh:ro"
], ],
"secrets-in-environment": "the entrypoint honours DOCKER_STEPCA_INIT_PASSWORD_FILE; convertible, awaiting a bed that proves it" "secrets-in-environment": "the entrypoint honours DOCKER_STEPCA_INIT_PASSWORD_FILE; convertible, awaiting a bed that proves it"
modules/umami/module.json
+18 -19
View File
@@ -19,14 +19,14 @@
} }
}, },
"binds": { "binds": {
"postgres-database": "/var/lib/umami/database.json", "postgres-database": "${dir:state}/database.json",
"route": "/var/lib/umami/route.json" "route": "${dir:state}/route.json"
}, },
"secrets": { "secrets": {
"postgres-database": "/var/lib/umami/database.secret", "postgres-database": "${dir:state}/database.secret",
"secret": { "secret": {
"app-secret": "/var/lib/umami/app.secret", "app-secret": "${dir:state}/app.secret",
"admin": "/var/lib/umami/admin.secret" "admin": "${dir:state}/admin.secret"
} }
}, },
"provides": [ "provides": [
@@ -39,10 +39,10 @@
"analytics": {} "analytics": {}
}, },
"receives": { "receives": {
"analytics": "/var/lib/umami/grants/mesh.json" "analytics": "${dir:grants}/mesh.json"
}, },
"grants": { "grants": {
"analytics": "/var/lib/umami/grants" "analytics": "${dir:grants}"
}, },
"own-secrets": { "own-secrets": {
"broker": "/var/lib/mesh/umami/broker" "broker": "/var/lib/mesh/umami/broker"
@@ -53,7 +53,7 @@
"port": 3000, "port": 3000,
"protocol": "tcp", "protocol": "tcp",
"from": "mesh", "from": "mesh",
"why": "one port serves two surfaces \u2014 the dashboard and the collection endpoint that the browsers of every tracked site POST to. Both are reached through the proxy, by name, so the port is how the proxy reaches this module and nothing else (novox/hq ADR 0045). It said \"anywhere\" and gave the reason that the collection endpoint must be public, which is true of the name and not of the port: opened, the machine-side port served the dashboard over plain HTTP to the internet, bypassing every rule the proxy applies by path" "why": "one port serves two surfaces — the dashboard and the collection endpoint that the browsers of every tracked site POST to. Both are reached through the proxy, by name, so the port is how the proxy reaches this module and nothing else (novox/hq ADR 0045). It said \"anywhere\" and gave the reason that the collection endpoint must be public, which is true of the name and not of the port: opened, the machine-side port served the dashboard over plain HTTP to the internet, bypassing every rule the proxy applies by path"
} }
], ],
"resources": [ "resources": [
@@ -66,28 +66,27 @@
{ {
"id": "state", "id": "state",
"type": "directory", "type": "directory",
"path": "/var/lib/umami", "mode": "0700",
"mode": "0700" "place": "."
}, },
{ {
"id": "grants", "id": "grants",
"type": "directory", "type": "directory",
"path": "/var/lib/umami/grants",
"mode": "0700" "mode": "0700"
}, },
{ {
"id": "server-env", "id": "server-env",
"type": "file", "type": "file",
"path": "/var/lib/umami/server.env", "path": "${dir:state}/server.env",
"mode": "0600", "mode": "0600",
"content": "DATABASE_URL=postgresql://${bound:postgres-database:as}:${secret:postgres-database}@${bound:postgres-database:at}:${bound:postgres-database:port}/${bound:postgres-database:as}\nDATABASE_TYPE=postgresql\nAPP_SECRET=${secret:app-secret}\n" "content": "DATABASE_URL=postgresql://${bound:postgres-database:as}:${secret:postgres-database}@${bound:postgres-database:at}:${bound:postgres-database:port}/${bound:postgres-database:as}\nDATABASE_TYPE=postgresql\nAPP_SECRET=${secret:app-secret}\n"
}, },
{ {
"id": "provisioner-env", "id": "provisioner-env",
"type": "file", "type": "file",
"path": "/var/lib/umami/provisioner.env", "path": "${dir:state}/provisioner.env",
"mode": "0600", "mode": "0600",
"content": "MESH_PROVISION_UMAMI_URL=http://umami:3000\nGRANTS=/var/lib/umami/grants\n" "content": "MESH_PROVISION_UMAMI_URL=http://umami:3000\nGRANTS=${dir:grants}\n"
}, },
{ {
"id": "net", "id": "net",
@@ -101,7 +100,7 @@
"image": "ghcr.io/umami-software/umami@sha256:85909afc45bdcda1917394594a087421fdbb05610fded0fa9f6fb861abb2f367", "image": "ghcr.io/umami-software/umami@sha256:85909afc45bdcda1917394594a087421fdbb05610fded0fa9f6fb861abb2f367",
"network": "umami", "network": "umami",
"env-file": [ "env-file": [
"/var/lib/umami/server.env" "${dir:state}/server.env"
], ],
"ports": [ "ports": [
"3000" "3000"
@@ -115,16 +114,16 @@
"network": "umami", "network": "umami",
"volumes": [ "volumes": [
"/var/lib/mesh/umami/broker:/run/secrets/broker:ro", "/var/lib/mesh/umami/broker:/run/secrets/broker:ro",
"/var/lib/umami/grants:/var/lib/umami/grants", "${dir:grants}:${dir:grants}",
"/var/lib/umami/admin.secret:/run/secrets/admin:ro" "${dir:state}/admin.secret:/run/secrets/admin:ro"
], ],
"env": { "env": {
"MESH_BROKER_FILE": "/run/secrets/broker", "MESH_BROKER_FILE": "/run/secrets/broker",
"MESH_RECEIVES": "/var/lib/umami/grants/mesh.json", "MESH_RECEIVES": "${dir:grants}/mesh.json",
"MESH_UMAMI_ADMIN_PASSWORD_FILE": "/run/secrets/admin" "MESH_UMAMI_ADMIN_PASSWORD_FILE": "/run/secrets/admin"
}, },
"env-file": [ "env-file": [
"/var/lib/umami/provisioner.env" "${dir:state}/provisioner.env"
], ],
"artifact": "runtime" "artifact": "runtime"
} }