{
  "module": "step-ca",
  "version": "1",
  "capabilities": [
    "container-runtime"
  ],
  "provides": [
    {
      "name": "acme-ca",
      "scope": "mesh"
    }
  ],
  "serves": {
    "acme-ca": {
      "path": "/acme/acme/directory",
      "roots": "/roots.pem"
    }
  },
  "listens": [
    {
      "port": 9000,
      "protocol": "tcp",
      "from": "mesh",
      "why": "the ACME directory and step-ca API; a proxy on any node reaches it here over the mesh to obtain certificates, and its single listen is what the consumer is told the port is"
    }
  ],
  "own-secrets": {
    "password": "/var/lib/mesh/step-ca/password"
  },
  "resources": [
    {
      "id": "mesh-state",
      "type": "directory",
      "path": "/var/lib/mesh/step-ca",
      "mode": "0700"
    },
    {
      "id": "home",
      "type": "directory",
      "path": "/var/lib/step-ca",
      "mode": "0700",
      "owner": "1000:1000"
    },
    {
      "id": "config",
      "type": "file",
      "path": "/var/lib/mesh/step-ca/config.json",
      "mode": "0644",
      "content": "{}",
      "merge": "json"
    },
    {
      "id": "init-env",
      "type": "file",
      "path": "/var/lib/mesh/step-ca/init.env",
      "mode": "0600",
      "content": "DOCKER_STEPCA_INIT_PASSWORD=${secret:password}\nDOCKER_STEPCA_INIT_DNS_NAMES=${machine:at},${machine:name},localhost,127.0.0.1\n"
    },
    {
      "id": "server",
      "type": "container",
      "name": "step-ca",
      "image": "smallstep/step-ca@sha256:a2b17872915c193259b75a5474c398326f41bd199f0842093e52cf4182bc8270",
      "network": "host",
      "env-file": [
        "/var/lib/mesh/step-ca/init.env"
      ],
      "env": {
        "DOCKER_STEPCA_INIT_NAME": "Mesh Internal CA",
        "DOCKER_STEPCA_INIT_ACME": "true",
        "DOCKER_STEPCA_INIT_REMOTE_MANAGEMENT": "false"
      },
      "volumes": [
        "/var/lib/step-ca:/home/step",
        "/var/lib/mesh/step-ca:/run/mesh:ro"
      ],
      "secrets-in-environment": "the entrypoint honours DOCKER_STEPCA_INIT_PASSWORD_FILE; convertible, awaiting a bed that proves it"
    }
  ]
}