{
  "module": "mesh-vault",
  "version": "1",
  "runs-as": "mesh-vault",
  "provides": [
    {
      "name": "secret",
      "credential": {
        "form": "pair"
      },
      "scope": "mesh",
      "identity": {
        "in": "a vault entry"
      }
    }
  ],
  "emits": [
    "provisioned",
    "rotated",
    "secret-changed",
    "account-hashed",
    "own-replaced",
    "account-issued",
    "signed",
    "rotation-begun",
    "node-account-ready",
    "rotation-done",
    "own-retired"
  ],
  "invokes": [
    "seat:mesh-hand-acts.hand-acts"
  ],
  "reads": [
    "node-engine.have",
    "mesh-grants.accounts",
    "mesh-delivery-assigner.placement",
    "mesh-provisioner.plans",
    "mesh-provisioner.provisions"
  ],
  "state": [
    {
      "name": "bus-accounts",
      "history": 2
    },
    "signers",
    "bound",
    "node-logins"
  ],
  "receives": {
    "secret": "${dir:grants}/mesh.json"
  },
  "grants": {
    "secret": "${dir:grants}"
  },
  "keeps": "/var/lib/mesh-vault/root",
  "data": {
    "own": [
      {
        "id": "state",
        "path": "${dir:state}",
        "class": "valuable",
        "why": "the vault's own keys"
      },
      {
        "id": "ledger",
        "path": "${dir:ledger}",
        "class": "valuable",
        "why": "every secret the vault keeps"
      },
      {
        "id": "root",
        "path": "${dir:root}",
        "class": "valuable",
        "why": "the vault's root material"
      },
      {
        "id": "store",
        "path": "${dir:store}",
        "class": "valuable",
        "why": "every secret the vault holds, sealed to its own key and to the operator key"
      }
    ],
    "consumers": {
      "secret": {
        "class": "valuable",
        "in": "ledger",
        "why": "a secret given to a consumer is kept nowhere else in the clear"
      }
    }
  },
  "own-secrets": {
    "broker": "${dir:state}/broker"
  },
  "secrets-owner": "mesh-vault",
  "runtime-health": {
    "kind": "tool",
    "tool": "vault_health",
    "interval": "60s",
    "timeout": "10s",
    "looks": 2,
    "grace": "60s"
  },
  "resources": [
    {
      "id": "account",
      "type": "user",
      "name": "mesh-vault",
      "shell": "/usr/bin/nologin",
      "home": "/var/lib/mesh-vault"
    },
    {
      "id": "state",
      "type": "directory",
      "mode": "0700",
      "owner": "mesh-vault",
      "place": ".",
      "unknown": "program"
    },
    {
      "id": "grants",
      "type": "directory",
      "mode": "0700",
      "owner": "mesh-vault",
      "unknown": "program"
    },
    {
      "id": "ledger",
      "type": "directory",
      "mode": "0700",
      "owner": "mesh-vault",
      "unknown": "program"
    },
    {
      "id": "root",
      "type": "directory",
      "mode": "0700",
      "owner": "mesh-vault",
      "unknown": "program"
    },
    {
      "id": "store",
      "type": "directory",
      "mode": "0700",
      "owner": "mesh-vault",
      "unknown": "program"
    },
    {
      "id": "retire-callers",
      "trusted": true,
      "type": "file",
      "path": "${dir:state}/retire-callers.json",
      "mode": "0600",
      "owner": "mesh-vault",
      "merge": "json",
      "template": "files/retire-callers.json",
      "takes-config": [
        "retire-callers"
      ]
    }
  ],
  "build": {
    "artifacts": [
      {
        "name": "code",
        "kind": "bundle",
        "language": "go",
        "system": "arch",
        "from": "cmd/mesh-vault",
        "binary": "mesh-vault",
        "loads": [
          "mesh-vault"
        ],
        "env": {
          "MESH_RECEIVES": "${dir:grants}/mesh.json",
          "MESH_VAULT_LEDGER": "${dir:ledger}",
          "MESH_VAULT_ROOT": "${dir:root}",
          "MESH_VAULT_STORE": "${dir:store}",
          "MESH_VAULT_STATE": "${dir:state}",
          "MESH_VAULT_SECRET_ASK_CALLERS": "node-tools",
          "MESH_VAULT_ENROLMENT_CALLERS": "mesh-enrolment",
          "MESH_VAULT_RETIRE_CALLERS": "${dir:state}/retire-callers.json"
        }
      },
      {
        "name": "files",
        "kind": "archive",
        "from": "files"
      }
    ]
  },
  "tools": [
    "secret_export",
    "secret_holders",
    "secret_verify",
    "secret_handed",
    "own_handed",
    "secret_own",
    "account_hash",
    "account_adopt",
    "account_retire",
    "secret_asks",
    "secret_vault_export",
    "provisioner_retirement",
    "provisioner_retire_approve",
    "provisioner_retire_reject",
    "provisioner_delete",
    "vault_status",
    "vault_health",
    "own_drift",
    "own_take_switch",
    "vault_signers",
    "vault_signed",
    "signers_reassert",
    "node_logins"
  ],
  "claims": [
    {
      "name": "mesh-vault",
      "scope": "mesh",
      "serves": [
        "get",
        "secret-ask",
        "issued",
        "rotate",
        "move-in",
        "node-key",
        "own",
        "issue-account",
        "sign",
        "enrolment-token",
        "node-account",
        "rotate-node",
        "node-account-confirm",
        "abandon",
        "retire"
      ]
    }
  ],
  "config": {
    "retire-callers": {
      "type": "list",
      "description": "Who may call the seat's verb retire, which removes one module's own secret on a node because no manifest reads it any more: a module's name (on every machine), <machine>.<module>, or person.<name>. The holder of the seat mesh-config alone by default (design 32); the verb also needs a hand act the caller recorded for exactly that node, module and secret.",
      "trusted": true,
      "default": [
        "mesh-config"
      ]
    }
  }
}