novox/mesh-catalog
18
0
Fork 0
Code Issues Pull Requests 2 Actions Packages Projects Releases Wiki Activity
Files
125929dbc459c2e278e44630bf14d7edff16a77e
mesh-catalog/modules/nats/module.json
T
jschoubben 0d6d7acaae nats: a warrant's spend record in the keeper's own state spent; the fill pass while the consumer binds; partial says kept 
Review round 2 of the registry milestone:
- security F2: the spend record leaves requests, which the tools write as the tool runner's account, for state spent,
  named in the keeper's bus.state and declared read-only (the lead's 18:1x ruling: the tools read it, never write);
  nats_requests lists the warrants spent from it;
- running F1: the fill pass also runs while the manifest-accepted consumer is bound again;
- health note 3: an event said on the seat's subject and refused by its history is kept with its one id and said again
  on the history alone, never again with a new id;
- seams note 3, health note 4: words unsaid with a status that cannot be written raise the keeper's own condition
  status-unwritten, cleared when it is written; the health names what a restart would lose.

Claude-Session: https://claude.ai/code/session_01JG73KJNrH5EgFXMKKYSrig
2026-11-04 18:13:36 +01:00

361 lines
8.5 KiB
JSON
Raw Blame History

{
"module": "nats",
"version": "1",
"upgrade": {
"policy": "record",
"why": "the bus keeps the streams of the whole mesh: each move waits for a person's yes, which the operator's Approve of the release that carries its build gives, and its node backs its streams up before it applies (hq ADR 0236, ADR 0601)"
},
"provides": [
{
"name": "mesh-bus",
"scope": "mesh",
"credential": {
"form": "none"
}
},
{
"name": "bus-state",
"scope": "mesh",
"credential": {
"form": "none"
}
}
],
"claims": [
{
"name": "mesh-broker",
"scope": "mesh",
"serves": [
"list",
"show",
"check",
"orphans"
]
}
],
"bus-users": "/var/lib/nats-module/conf/accounts.conf",
"core-credentials": true,
"own-secrets": {
"broker": "${dir:mesh-state}/broker",
"broker-nats-tools": "${dir:tools-secret}/broker-nats-tools",
"broker-keeper": {
"path": "${dir:keeper-state}/broker-keeper",
"owner": "nats-keeper"
}
},
"capabilities": [
"container-runtime"
],
"emits": [
"consumer-removed",
"bucket-keys-removed",
"stream-removed",
"bucket-expiry-set"
],
"invokes": [
"seat:mesh-hand-acts.hand-act",
"mesh-delivery-indexer.indexer_bus_state"
],
"consumes": [
"mesh-delivery-indexer.manifest-accepted"
],
"uses": [
"operator-channel"
],
"streams": [
{
"name": "broker-events",
"events": [
"created",
"refused",
"drifted",
"drift-cleared",
"full",
"full-cleared",
"orphaned",
"recreated",
"dropped"
],
"max-age-days": 30,
"max-mib": 256
}
],
"state": [
{
"name": "asked",
"history": 5
},
{
"name": "requests",
"history": 5,
"ttl-seconds": 86400
},
{
"name": "spent",
"history": 1,
"ttl-seconds": 86400,
"read-only": true
}
],
"listens": [
{
"name": "bus",
"port": 4222,
"protocol": "tcp",
"from": "mesh",
"why": "the mesh bus \u2014 every link the mesh has, over TLS, reached across the overlay"
}
],
"tools": [
"nats_server",
"nats_connections",
"nats_closed_connections",
"nats_subscriptions",
"nats_streams",
"nats_backlog",
"nats_buckets",
"nats_users",
"nats_user_can",
"nats_snapshot_verify",
"nats_consumer_remove",
"nats_bucket_remove",
"nats_stream_remove",
"nats_bucket_expiry",
"nats_history",
"nats_create",
"nats_apply",
"nats_recreate",
"nats_drop",
"nats_keeper_health",
"nats_first_view_again",
"nats_requests"
],
"guards": [
8222
],
"data": {
"own": [
{
"id": "jetstream",
"path": "${dir:jetstream-data}",
"class": "valuable",
"active": "1d",
"backup": {
"dump": "p=${dir:snapshots}/bus.tar.partial; s=0; docker exec -i mesh-broker-nats /opt/mesh/mesh-nats-snapshot snapshot < ${dir:mesh-state}/broker > \"$p\" || s=$?; if [ $s -ne 0 ]; then echo \"mesh-nats-snapshot snapshot exited $s$([ $s -eq 137 -o $s -eq 143 ] && echo ' (killed by a signal)')\" >&2; docker inspect -f 'container {{.State.Status}} since {{.State.StartedAt}}' mesh-broker-nats >&2; rm -f \"$p\"; exit $s; fi; mv \"$p\" ${dir:snapshots}/bus.tar || exit 1",
"into": "snapshots"
},
"why": "the bus's streams and key-value buckets: the hand-act log, conditions, every module's state; written all the time, so copied by the server's own snapshot of each stream (novox/hq ADR 0235), never as live files"
},
{
"id": "snapshots",
"path": "${dir:snapshots}",
"class": "rebuildable",
"why": "last night's snapshot of every stream with its manifest, made again every night"
}
]
},
"resources": [
{
"id": "keeper-account",
"type": "user",
"name": "nats-keeper",
"shell": "/usr/bin/nologin",
"home": "/var/lib/nats-keeper"
},
{
"id": "jetstream-data",
"type": "directory",
"path": "/var/lib/mesh-broker-nats",
"mode": "0700",
"unknown": "program"
},
{
"id": "conf-dir",
"type": "directory",
"path": "/var/lib/nats-module/conf",
"mode": "0700",
"unknown": "program"
},
{
"id": "tools-secret",
"type": "directory",
"path": "/var/lib/mesh/nats-tools",
"mode": "0711",
"unknown": "program"
},
{
"id": "keeper-state",
"type": "directory",
"path": "/var/lib/nats-keeper",
"mode": "0700",
"owner": "nats-keeper",
"unknown": "program"
},
{
"id": "snapshots",
"type": "directory",
"mode": "0700",
"unknown": "program"
},
{
"id": "mesh-state",
"type": "directory",
"mode": "0700",
"place": "mesh",
"unknown": "program"
},
{
"id": "server-conf",
"type": "file",
"path": "/var/lib/nats-module/conf/nats.conf",
"template": "files/nats.conf",
"mode": "0644"
},
{
"id": "state",
"type": "directory",
"mode": "0700",
"place": ".",
"unknown": "program"
},
{
"id": "program-snapshot",
"type": "archive",
"path": "${dir:state}/snapshot",
"artifact": "snapshot",
"unknown": "program"
},
{
"id": "program-entrypoint",
"type": "archive",
"path": "${dir:state}/entrypoint",
"artifact": "entrypoint",
"unknown": "program"
},
{
"id": "keeper",
"type": "process",
"name": "nats-keeper",
"artifact": "tools",
"run": [
"./nats-tools",
"keep"
],
"user": "nats-keeper",
"env": {
"MESH_BROKER_FILE": "${dir:keeper-state}/broker-keeper",
"MESH_NATS_FULL_RAISE": "75",
"MESH_NATS_FULL_CLEAR": "70",
"MESH_NATS_SNAPSHOTS_DIR": "${dir:keeper-state}"
},
"bus": {
"state": [
"asked",
"requests",
"spent"
],
"asks": true,
"keeps": true,
"invokes": [
"mesh-delivery-indexer.indexer_bus_state",
"seat:mesh-hand-acts.hand-act"
]
},
"health": {
"kind": "tool",
"tool": "nats_keeper_health",
"interval": "60s",
"timeout": "10s",
"looks": 2,
"grace": "180s"
}
},
{
"id": "server",
"type": "container",
"name": "mesh-broker-nats",
"ports": [
"4222:4222",
"127.0.0.1:8222:8222"
],
"volumes": [
"/var/lib/mesh-broker-nats:/data",
"/var/lib/nats-module/conf:/etc/nats:ro",
"${access:tls}:/tls:ro",
"${dir:state}/snapshot:/opt/mesh:ro",
"${dir:state}/entrypoint:/opt/mesh-entrypoint:ro"
],
"args": [
"sh",
"/opt/mesh-entrypoint/entrypoint.sh"
],
"artifact": "server",
"restart-on": [
"program-snapshot",
"program-entrypoint"
],
"health": {
"kind": "tcp",
"endpoint": "bus"
}
}
],
"accesses": [
{
"id": "tls",
"path": "/var/lib/mesh-broker-tls",
"mode": "read"
}
],
"build": {
"artifacts": [
{
"name": "server",
"kind": "upstream",
"from": "nats:2.11.17-alpine@sha256:e4bf19f15fd3218814a4e3c9e0064e1334bd8aa20d5984b9f1a0afd084f8cc00"
},
{
"name": "snapshot",
"kind": "bundle",
"language": "go",
"system": "alpine",
"from": "cmd/mesh-nats-snapshot",
"binary": "mesh-nats-snapshot"
},
{
"name": "entrypoint",
"kind": "archive",
"from": "program"
},
{
"name": "tools",
"kind": "bundle",
"language": "go",
"system": "arch",
"from": "cmd/nats-tools",
"binary": "nats-tools",
"loads": [
"nats-tools"
],
"bus": {
"removes": [
"controller-leftovers"
]
},
"env": {
"MESH_NATS_MONITOR": "http://127.0.0.1:8222",
"MESH_NATS_CONTAINER": "mesh-broker-nats",
"MESH_NATS_USERS_FILE": "/etc/nats/accounts.conf",
"MESH_NATS_SNAPSHOTS_DIR": "${dir:snapshots}",
"NATS_TOOLS_CREDENTIAL": "${dir:tools-secret}/broker-nats-tools"
}
},
{
"name": "files",
"kind": "archive",
"from": "files"
}
]
}
}
Reference in New Issue View Git Blame Copy Permalink