mesh-tools
652b00b25b
mesh/merge-gate checking again: the gate refused `unknown` because the controller judged with a node-engine validator pinned before mesh-host #117; mesh-co…
mesh/repo-check checking again: the gate refused `unknown` because the controller judged with a node-engine validator pinned before mesh-host #117; mesh-co…
mesh/delivery-group group feat/owned-paths checking: 0 of 2 member(s) ready
mesh/delivery superseded: a newer head of the same pull request
Every directory and archive resource carries `unknown`: move-out for a home folder whose program writes nothing there (the node-engine, delivered in mesh-host #117, moves the rest to ~/.local/state/mesh-moved/<module>/ with a list), module for ~/.ssh and ~/.claude, program elsewhere; `knows` keeps what a program or the operator relies on (powerlevel10k's compiled files, i3's scripts and the asus/g14 drop-ins, dunst's slack rule, betterbird's records, node-env's forge credential, issue 1033). Two shared folders are no longer declared. Each module's README says it. checks/owned holds every manifest to it; checks/sshdir stays while main's merge check runs it (issue 1035). Tests that pin a manifest follow the new key only. Reviewed in three rounds.
192 lines
4.5 KiB
JSON
192 lines
4.5 KiB
JSON
{
|
|
"module": "nfs-server",
|
|
"version": "1",
|
|
"upgrade": {
|
|
"policy": "record",
|
|
"why": "the folders other machines mount: a build that breaks the exports leaves every client's mount hanging or refused, and the gate on this one machine does not see the clients (hq ADR 0236, ADR 0263)"
|
|
},
|
|
"capabilities": [
|
|
"package-manager",
|
|
"service-manager"
|
|
],
|
|
"provides": [
|
|
{
|
|
"name": "nfs-share",
|
|
"scope": "mesh",
|
|
"identity": false
|
|
}
|
|
],
|
|
"data": {
|
|
"consumers": {
|
|
"nfs-share": {
|
|
"class": "none",
|
|
"why": "the shared folders are the operator's data (hq ADR 0051): what a client writes lands in them, and they are protected where the operator declares them, never by this module, which keeps nothing of a consumer's"
|
|
}
|
|
}
|
|
},
|
|
"claims": [
|
|
{
|
|
"name": "node-nfs-server",
|
|
"scope": "node",
|
|
"serves": [
|
|
"exports",
|
|
"clients",
|
|
"test",
|
|
"reload",
|
|
"adopt"
|
|
]
|
|
}
|
|
],
|
|
"state": [
|
|
{
|
|
"name": "exports",
|
|
"ttl-seconds": 120,
|
|
"per-machine": true
|
|
}
|
|
],
|
|
"reads": [
|
|
"mounts.shares"
|
|
],
|
|
"invokes": [
|
|
"seat:mesh-controller.seats",
|
|
"seat:mesh-controller.data"
|
|
],
|
|
"config": {
|
|
"shares": {
|
|
"type": "string",
|
|
"description": "The folders this machine exports, as space-separated name=path; the operator's, with no default (novox/hq ADR 0263).",
|
|
"trusted": true,
|
|
"required": true
|
|
},
|
|
"grants": {
|
|
"type": "string",
|
|
"description": "Which nodes may mount which share, and how: share=node:rw|ro[,node:rw|ro], entries separated by spaces, or none to export to no node whatever a node wants (novox/hq ADR 0263).",
|
|
"trusted": true,
|
|
"default": "none"
|
|
}
|
|
},
|
|
"facts": {
|
|
"machines": {
|
|
"path": "/etc/nfs-server/machines",
|
|
"template": "# Written by the mesh (module nfs-server, novox/hq ADR 0263): every machine of the mesh and its private\n# address, from which the module takes a node's address. Replaced on every push.\n{{range .Machines}}{{.Name}} {{.Address}}\n{{end}}"
|
|
}
|
|
},
|
|
"tools": [
|
|
"nfs_health"
|
|
],
|
|
"listens": [
|
|
{
|
|
"name": "nfs",
|
|
"port": 2049,
|
|
"protocol": "tcp",
|
|
"from": "mesh",
|
|
"fixed": true,
|
|
"why": "the shares, to the mesh's machines only (hq ADR 0263): NFS version 4 alone, which needs no other port, and never the home network, where a device that is not a node could claim any user id"
|
|
}
|
|
],
|
|
"resources": [
|
|
{
|
|
"id": "package",
|
|
"type": "package",
|
|
"package": "nfs-utils"
|
|
},
|
|
{
|
|
"id": "nfs-conf",
|
|
"type": "file",
|
|
"path": "/etc/nfs.conf.d/50-mesh.conf",
|
|
"mode": "0644",
|
|
"template": "files/50-mesh.conf"
|
|
},
|
|
{
|
|
"id": "run-dir",
|
|
"type": "directory",
|
|
"path": "/run/nfs-server",
|
|
"mode": "0755",
|
|
"unknown": "program"
|
|
},
|
|
{
|
|
"id": "server",
|
|
"type": "service",
|
|
"unit": "nfs-server.service",
|
|
"state": "running",
|
|
"boot": "enabled",
|
|
"restart-on": [
|
|
"nfs-conf"
|
|
],
|
|
"health": {
|
|
"kind": "unit"
|
|
}
|
|
},
|
|
{
|
|
"id": "wants-dir-parent",
|
|
"type": "directory",
|
|
"path": "/var/lib/nfs-server",
|
|
"mode": "0755",
|
|
"unknown": "program"
|
|
},
|
|
{
|
|
"id": "wants-dir",
|
|
"type": "directory",
|
|
"path": "/var/lib/nfs-server/from-bus",
|
|
"mode": "0755",
|
|
"owner": "${machine:account}",
|
|
"unknown": "program"
|
|
},
|
|
{
|
|
"id": "exports",
|
|
"type": "process",
|
|
"name": "nfs-server-exports",
|
|
"artifact": "tools",
|
|
"run": [
|
|
"./nfs-server",
|
|
"exports"
|
|
],
|
|
"restart-on": [
|
|
"config"
|
|
],
|
|
"health": {
|
|
"kind": "tool",
|
|
"tool": "nfs_health",
|
|
"interval": "60s",
|
|
"timeout": "10s",
|
|
"looks": 2,
|
|
"grace": "90s"
|
|
}
|
|
},
|
|
{
|
|
"id": "config-dir",
|
|
"type": "directory",
|
|
"path": "/etc/nfs-server",
|
|
"mode": "0755",
|
|
"unknown": "program"
|
|
},
|
|
{
|
|
"id": "config",
|
|
"type": "file",
|
|
"path": "/etc/nfs-server/shares.conf",
|
|
"mode": "0644",
|
|
"template": "files/shares.conf"
|
|
}
|
|
],
|
|
"build": {
|
|
"artifacts": [
|
|
{
|
|
"name": "tools",
|
|
"kind": "bundle",
|
|
"language": "go",
|
|
"system": "arch",
|
|
"from": "cmd/nfs-server",
|
|
"binary": "nfs-server",
|
|
"loads": [
|
|
"nfs-server"
|
|
]
|
|
},
|
|
{
|
|
"name": "files",
|
|
"kind": "archive",
|
|
"from": "files"
|
|
}
|
|
]
|
|
}
|
|
}
|