lead-57
deb2020bd4
mesh/merge-gate head deb2020bd47d merged into trunk 5652a1494493 — pass: builds postgres, sent nowhere; no bus step; 2 wait(s) for a person; every machine …
mesh/repo-check head deb2020bd47d merged into trunk 5652a1494493 — pass: its merge-check.sh passed, each part in its toolchain: merge-check.sh (go), merge-…
mesh/delivery delivered
On novox postgres is published 6852:5432; handed 5432, gitea and keycloak reached nothing once their files were filled from postgres's entry.
38 lines
2.5 KiB
Go
38 lines
2.5 KiB
Go
package main
|
|
|
|
// postgres handed to the provisioner (novox/hq ADR 0373, ADR 0349 clause 12, issue 780): where its consumers file
|
|
// is set, postgres runs on the SDK's provider helper instead of the harness reading the controller's grant files.
|
|
//
|
|
// The helper learns who binds postgres from the plans, composes each consumer's entry and reads its credential
|
|
// through ConsumersFile, the file this machine's provisioner client fills. It leaves the rest to the two hooks
|
|
// here: Make brings the consumer's database and role into being exactly as the harness's adapter does, and Gone
|
|
// retires what was kept for a consumer that no longer binds, the reversible way (retire_pg.go): the login is
|
|
// locked and marked to delete, nothing is dropped.
|
|
//
|
|
// **A consumer not moved is still the grant file's** (issue 937, ADR 0349 clause 17): only a moved consumer's plan
|
|
// names its provider, so the controller still gives every other consumer through postgres's grant file
|
|
// (MESH_RECEIVES) until R1 (issue 682). Each login it gives is asked for, and one no plan names is made and checked
|
|
// by the harness's grant pass exactly as on the grant path; a login a plan names is the helper's alone. A grant file
|
|
// that cannot be read is not nobody asking (issue 241): nothing is retired until it is read again.
|
|
|
|
import (
|
|
"git.novox.be/novox/mesh-sdk/go/provider"
|
|
"git.novox.be/novox/mesh-sdk/go/provider/harness"
|
|
)
|
|
|
|
// ProvisionName is what postgres provides, as its manifest says.
|
|
const ProvisionName = "postgres-database"
|
|
|
|
// moved is postgres handed to the provisioner: the SDK's moved path (harness.Moved) answering its consumers, and the
|
|
// harness (never run) whose retirement and tools it shares. consumersFile is where its machine's client fills its
|
|
// consumers. What differs from keycloak is only this declaration (issue 849).
|
|
//
|
|
// It serves its consumers the port its server is published on, on its machine (servedPort), never the container's
|
|
// own 5432: on a machine that publishes it elsewhere (6852:5432 on novox) nothing answers 5432 (issue 957).
|
|
func moved(consumersFile string, h *harness.Harness, servedPort int) (*harness.Moved, *provider.Provider, provider.Bus, error) {
|
|
return harness.NewMoved(consumersFile, h, harness.MovedSpec{Module: "postgres", Provision: ProvisionName,
|
|
Offer: provider.Offer{Credential: provider.PerConsumer, Serves: map[string]any{"port": servedPort}},
|
|
Login: func(e provider.Entry) string { return e.User },
|
|
Noun: "login", Made: "login", Backend: "the backend", WithGrants: true})
|
|
}
|