novox/mesh-catalog
18
0
Fork 0
Code Issues Pull Requests 2 Actions Packages Projects Releases Wiki Activity
Files
68dd69f4ef6c8ae79cb7251bffaa57f18435e33d
mesh-catalog/modules/nats/module.json
T
jschoubben 3b61a05532 CAT-N8: a person's create, apply, recreate and drop are handed to the keeper as the caller the tool runner proved 
The bus module's tools hold no grant of the seat's acting verbs (design 25
§ 12.3): nats_create, nats_apply, nats_recreate and nats_drop write a request
into the keeper's own state requests, stamped with stdio.CallerOf (a name in
the arguments is never the caller), and read its end back. recreate and drop
raise the operator's ask first, its option binding exactly that act; the
keeper acts only on the router's warrant for it (Warrant.For, Option.Performs),
after a snapshot of the entry's streams (bussnap, moved from the snapshot
command with a streams filter), says recreated or dropped, and records every
act as a hand act through mesh-hand-acts. A drop removes an orphan alone.

Claude-Session: https://claude.ai/code/session_01JG73KJNrH5EgFXMKKYSrig
2026-11-04 12:34:59 +01:00

350 lines
8.3 KiB
JSON
Raw Blame History

{
"module": "nats",
"version": "1",
"upgrade": {
"policy": "record",
"why": "the bus keeps the streams of the whole mesh: each move waits for a person's yes, which the operator's Approve of the release that carries its build gives, and its node backs its streams up before it applies (hq ADR 0236, ADR 0601)"
},
"provides": [
{
"name": "mesh-bus",
"scope": "mesh",
"credential": {
"form": "none"
}
},
{
"name": "bus-state",
"scope": "mesh",
"credential": {
"form": "none"
}
}
],
"claims": [
{
"name": "mesh-broker",
"scope": "mesh",
"serves": [
"list",
"show",
"check",
"orphans"
]
}
],
"bus-users": "/var/lib/nats-module/conf/accounts.conf",
"core-credentials": true,
"own-secrets": {
"broker": "${dir:mesh-state}/broker",
"broker-nats-tools": "${dir:tools-secret}/broker-nats-tools",
"broker-keeper": {
"path": "${dir:keeper-state}/broker-keeper",
"owner": "nats-keeper"
}
},
"capabilities": [
"container-runtime"
],
"emits": [
"consumer-removed",
"bucket-keys-removed",
"stream-removed",
"bucket-expiry-set"
],
"invokes": [
"seat:mesh-hand-acts.hand-act",
"mesh-delivery-indexer.indexer_bus_state"
],
"consumes": [
"mesh-delivery-indexer.manifest-accepted"
],
"uses": [
"operator-channel"
],
"streams": [
{
"name": "broker-events",
"events": [
"created",
"refused",
"drifted",
"drift-cleared",
"full",
"full-cleared",
"orphaned",
"recreated",
"dropped"
],
"max-age-days": 30,
"max-mib": 256
}
],
"state": [
{
"name": "asked",
"history": 5
},
{
"name": "requests",
"history": 5,
"ttl-seconds": 86400
}
],
"listens": [
{
"name": "bus",
"port": 4222,
"protocol": "tcp",
"from": "mesh",
"why": "the mesh bus \u2014 every link the mesh has, over TLS, reached across the overlay"
}
],
"tools": [
"nats_server",
"nats_connections",
"nats_closed_connections",
"nats_subscriptions",
"nats_streams",
"nats_backlog",
"nats_buckets",
"nats_users",
"nats_user_can",
"nats_snapshot_verify",
"nats_consumer_remove",
"nats_bucket_remove",
"nats_stream_remove",
"nats_bucket_expiry",
"nats_history",
"nats_create",
"nats_apply",
"nats_recreate",
"nats_drop"
],
"guards": [
8222
],
"data": {
"own": [
{
"id": "jetstream",
"path": "${dir:jetstream-data}",
"class": "valuable",
"active": "1d",
"backup": {
"dump": "p=${dir:snapshots}/bus.tar.partial; s=0; docker exec -i mesh-broker-nats /opt/mesh/mesh-nats-snapshot snapshot < ${dir:mesh-state}/broker > \"$p\" || s=$?; if [ $s -ne 0 ]; then echo \"mesh-nats-snapshot snapshot exited $s$([ $s -eq 137 -o $s -eq 143 ] && echo ' (killed by a signal)')\" >&2; docker inspect -f 'container {{.State.Status}} since {{.State.StartedAt}}' mesh-broker-nats >&2; rm -f \"$p\"; exit $s; fi; mv \"$p\" ${dir:snapshots}/bus.tar || exit 1",
"into": "snapshots"
},
"why": "the bus's streams and key-value buckets: the hand-act log, conditions, every module's state; written all the time, so copied by the server's own snapshot of each stream (novox/hq ADR 0235), never as live files"
},
{
"id": "snapshots",
"path": "${dir:snapshots}",
"class": "rebuildable",
"why": "last night's snapshot of every stream with its manifest, made again every night"
}
]
},
"resources": [
{
"id": "keeper-account",
"type": "user",
"name": "nats-keeper",
"shell": "/usr/bin/nologin",
"home": "/var/lib/nats-keeper"
},
{
"id": "jetstream-data",
"type": "directory",
"path": "/var/lib/mesh-broker-nats",
"mode": "0700",
"unknown": "program"
},
{
"id": "conf-dir",
"type": "directory",
"path": "/var/lib/nats-module/conf",
"mode": "0700",
"unknown": "program"
},
{
"id": "tools-secret",
"type": "directory",
"path": "/var/lib/mesh/nats-tools",
"mode": "0711",
"unknown": "program"
},
{
"id": "keeper-state",
"type": "directory",
"path": "/var/lib/nats-keeper",
"mode": "0700",
"owner": "nats-keeper",
"unknown": "program"
},
{
"id": "snapshots",
"type": "directory",
"mode": "0700",
"unknown": "program"
},
{
"id": "mesh-state",
"type": "directory",
"mode": "0700",
"place": "mesh",
"unknown": "program"
},
{
"id": "server-conf",
"type": "file",
"path": "/var/lib/nats-module/conf/nats.conf",
"template": "files/nats.conf",
"mode": "0644"
},
{
"id": "state",
"type": "directory",
"mode": "0700",
"place": ".",
"unknown": "program"
},
{
"id": "program-snapshot",
"type": "archive",
"path": "${dir:state}/snapshot",
"artifact": "snapshot",
"unknown": "program"
},
{
"id": "program-entrypoint",
"type": "archive",
"path": "${dir:state}/entrypoint",
"artifact": "entrypoint",
"unknown": "program"
},
{
"id": "keeper",
"type": "process",
"name": "nats-keeper",
"artifact": "tools",
"run": [
"./nats-tools",
"keep"
],
"user": "nats-keeper",
"env": {
"MESH_BROKER_FILE": "${dir:keeper-state}/broker-keeper",
"MESH_NATS_FULL_RAISE": "75",
"MESH_NATS_FULL_CLEAR": "70",
"MESH_NATS_SNAPSHOTS_DIR": "${dir:keeper-state}"
},
"bus": {
"state": [
"asked",
"requests"
],
"asks": true,
"invokes": [
"mesh-delivery-indexer.indexer_bus_state",
"seat:mesh-hand-acts.hand-act"
]
},
"health": {
"kind": "tool",
"tool": "nats_keeper_health",
"interval": "60s",
"timeout": "10s",
"looks": 2,
"grace": "180s"
}
},
{
"id": "server",
"type": "container",
"name": "mesh-broker-nats",
"ports": [
"4222:4222",
"127.0.0.1:8222:8222"
],
"volumes": [
"/var/lib/mesh-broker-nats:/data",
"/var/lib/nats-module/conf:/etc/nats:ro",
"${access:tls}:/tls:ro",
"${dir:state}/snapshot:/opt/mesh:ro",
"${dir:state}/entrypoint:/opt/mesh-entrypoint:ro"
],
"args": [
"sh",
"/opt/mesh-entrypoint/entrypoint.sh"
],
"artifact": "server",
"restart-on": [
"program-snapshot",
"program-entrypoint"
],
"health": {
"kind": "tcp",
"endpoint": "bus"
}
}
],
"accesses": [
{
"id": "tls",
"path": "/var/lib/mesh-broker-tls",
"mode": "read"
}
],
"build": {
"artifacts": [
{
"name": "server",
"kind": "upstream",
"from": "nats:2.11.17-alpine@sha256:e4bf19f15fd3218814a4e3c9e0064e1334bd8aa20d5984b9f1a0afd084f8cc00"
},
{
"name": "snapshot",
"kind": "bundle",
"language": "go",
"system": "alpine",
"from": "cmd/mesh-nats-snapshot",
"binary": "mesh-nats-snapshot"
},
{
"name": "entrypoint",
"kind": "archive",
"from": "program"
},
{
"name": "tools",
"kind": "bundle",
"language": "go",
"system": "arch",
"from": "cmd/nats-tools",
"binary": "nats-tools",
"loads": [
"nats-tools"
],
"bus": {
"removes": [
"controller-leftovers"
]
},
"env": {
"MESH_NATS_MONITOR": "http://127.0.0.1:8222",
"MESH_NATS_CONTAINER": "mesh-broker-nats",
"MESH_NATS_USERS_FILE": "/etc/nats/accounts.conf",
"MESH_NATS_SNAPSHOTS_DIR": "${dir:snapshots}",
"NATS_TOOLS_CREDENTIAL": "${dir:tools-secret}/broker-nats-tools"
}
},
{
"name": "files",
"kind": "archive",
"from": "files"
}
]
}
}
Reference in New Issue View Git Blame Copy Permalink