jschoubben
945390e59a
The single standalone instance from the first pass didn't match HAL's actual topology: HAL runs minio1-4, two drives each, behind an nginx load balancer on 9000 (S3) and 9001 (console). This rewrite mirrors that exactly — same node count, same erasure-coding command, same LB config — so the migration is a real like-for-like move, not a simplification. Only the two images that had to change did: the minio server (dead upstream, already fixed in the prior commit) and nginx (1.19.2-alpine is long EOL; repinned to current stable-alpine by digest). Data still lands on a fresh, empty, mesh-owned path, never HAL's live drives. The OIDC-wait entrypoint wrapper HAL used is dropped: it's a no-op when MINIO_IDENTITY_OPENID_CONFIG_URL is unset (it always is here — no OIDC integration was ever wired to minio itself), and this catalogue has no container resource field for overriding a container's entrypoint anyway — every converted module relies on the image's own entrypoint plus args, which is exactly what the original single-node version already did.
221 lines
8.5 KiB
JSON
221 lines
8.5 KiB
JSON
{
|
|
"module": "minio",
|
|
"version": "1",
|
|
"provides": [
|
|
{
|
|
"name": "s3-bucket",
|
|
"scope": "mesh"
|
|
}
|
|
],
|
|
"capabilities": [
|
|
"container-runtime"
|
|
],
|
|
"emits": [
|
|
"module.minio.bucket.created",
|
|
"module.minio.bucket.removed"
|
|
],
|
|
"listens": [
|
|
{
|
|
"port": 9000,
|
|
"protocol": "tcp",
|
|
"from": "mesh",
|
|
"why": "the S3 endpoint, load-balanced across the 4-node erasure-coded cluster"
|
|
},
|
|
{
|
|
"port": 9001,
|
|
"protocol": "tcp",
|
|
"from": "mesh",
|
|
"why": "the admin console, load-balanced across the 4-node erasure-coded cluster"
|
|
}
|
|
],
|
|
"serves": {
|
|
"s3-bucket": {
|
|
"scheme": "http",
|
|
"region": "us-east-1",
|
|
"port": 9000
|
|
}
|
|
},
|
|
"receives": {
|
|
"s3-bucket": "/var/lib/minio/grants/mesh.json"
|
|
},
|
|
"grants": {
|
|
"s3-bucket": "/var/lib/minio/grants"
|
|
},
|
|
"own-secrets": {
|
|
"root": "/var/lib/minio/root.secret",
|
|
"broker": "/var/lib/mesh/minio/broker"
|
|
},
|
|
"resources": [
|
|
{
|
|
"id": "mesh-state",
|
|
"type": "directory",
|
|
"path": "/var/lib/mesh/minio",
|
|
"mode": "0700"
|
|
},
|
|
{
|
|
"id": "state",
|
|
"type": "directory",
|
|
"path": "/var/lib/minio",
|
|
"mode": "0700"
|
|
},
|
|
{
|
|
"id": "grants",
|
|
"type": "directory",
|
|
"path": "/var/lib/minio/grants",
|
|
"mode": "0700"
|
|
},
|
|
{
|
|
"id": "root-env",
|
|
"type": "file",
|
|
"path": "/var/lib/minio/root.env",
|
|
"mode": "0600",
|
|
"content": "MINIO_ROOT_USER=meshroot\n"
|
|
},
|
|
{
|
|
"id": "data",
|
|
"type": "directory",
|
|
"path": "/var/lib/minio-store",
|
|
"mode": "0700"
|
|
},
|
|
{
|
|
"id": "nginx-conf",
|
|
"type": "file",
|
|
"path": "/var/lib/minio/nginx.conf",
|
|
"mode": "0644",
|
|
"content": "user nginx;\nworker_processes auto;\n\nerror_log /var/log/nginx/error.log warn;\npid /var/run/nginx.pid;\n\nevents {\n worker_connections 4096;\n}\n\nhttp {\n include /etc/nginx/mime.types;\n default_type application/octet-stream;\n\n log_format main '$remote_addr - $remote_user [$time_local] \"$request\" '\n '$status $body_bytes_sent \"$http_referer\" '\n '\"$http_user_agent\" \"$http_x_forwarded_for\"';\n\n access_log /var/log/nginx/access.log main;\n sendfile on;\n keepalive_timeout 65;\n\n upstream minio {\n server minio1:9000;\n server minio2:9000;\n server minio3:9000;\n server minio4:9000;\n }\n\n upstream console {\n ip_hash;\n server minio1:9001;\n server minio2:9001;\n server minio3:9001;\n server minio4:9001;\n }\n\n server {\n listen 9000;\n listen [::]:9000;\n server_name localhost;\n\n ignore_invalid_headers off;\n client_max_body_size 0;\n proxy_buffering off;\n\n location / {\n proxy_set_header Host $http_host;\n proxy_set_header X-Real-IP $remote_addr;\n proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;\n proxy_set_header X-Forwarded-Proto $scheme;\n\n proxy_connect_timeout 300;\n proxy_http_version 1.1;\n proxy_set_header Connection \"\";\n chunked_transfer_encoding off;\n\n proxy_pass http://minio;\n }\n }\n\n server {\n listen 9001;\n listen [::]:9001;\n server_name localhost;\n\n ignore_invalid_headers off;\n client_max_body_size 0;\n proxy_buffering off;\n\n location / {\n proxy_set_header Host $http_host;\n proxy_set_header X-Real-IP $remote_addr;\n proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;\n proxy_set_header X-Forwarded-Proto $scheme;\n proxy_set_header X-NginX-Proxy true;\n\n real_ip_header X-Real-IP;\n\n proxy_connect_timeout 300;\n proxy_http_version 1.1;\n proxy_set_header Upgrade $http_upgrade;\n proxy_set_header Connection \"upgrade\";\n\n chunked_transfer_encoding off;\n\n proxy_pass http://console;\n }\n }\n}\n"
|
|
},
|
|
{
|
|
"id": "net",
|
|
"type": "network",
|
|
"name": "minio"
|
|
},
|
|
{
|
|
"id": "minio1",
|
|
"type": "container",
|
|
"name": "minio1",
|
|
"image": "docker.io/pgsty/minio@sha256:b6bfe7239bfc83fb90d31612d9704d86039dd714f7904b3f1ad68f211e602372",
|
|
"network": "minio",
|
|
"args": ["server", "--console-address", ":9001", "http://minio{1...4}/data{1...2}"],
|
|
"env-file": ["/var/lib/minio/root.env"],
|
|
"volumes": [
|
|
"/var/lib/minio-store/data1-1:/data1",
|
|
"/var/lib/minio-store/data1-2:/data2",
|
|
"/var/lib/minio-store/unused-volume-stub/minio1:/data",
|
|
"/var/lib/minio/root.secret:/run/secrets/root:ro"
|
|
],
|
|
"env": {
|
|
"MINIO_ROOT_PASSWORD_FILE": "/run/secrets/root",
|
|
"MINIO_BROWSER_REDIRECT_URL": "https://files.novox.be"
|
|
}
|
|
},
|
|
{
|
|
"id": "minio2",
|
|
"type": "container",
|
|
"name": "minio2",
|
|
"image": "docker.io/pgsty/minio@sha256:b6bfe7239bfc83fb90d31612d9704d86039dd714f7904b3f1ad68f211e602372",
|
|
"network": "minio",
|
|
"args": ["server", "--console-address", ":9001", "http://minio{1...4}/data{1...2}"],
|
|
"env-file": ["/var/lib/minio/root.env"],
|
|
"volumes": [
|
|
"/var/lib/minio-store/data2-1:/data1",
|
|
"/var/lib/minio-store/data2-2:/data2",
|
|
"/var/lib/minio-store/unused-volume-stub/minio2:/data",
|
|
"/var/lib/minio/root.secret:/run/secrets/root:ro"
|
|
],
|
|
"env": {
|
|
"MINIO_ROOT_PASSWORD_FILE": "/run/secrets/root",
|
|
"MINIO_BROWSER_REDIRECT_URL": "https://files.novox.be"
|
|
}
|
|
},
|
|
{
|
|
"id": "minio3",
|
|
"type": "container",
|
|
"name": "minio3",
|
|
"image": "docker.io/pgsty/minio@sha256:b6bfe7239bfc83fb90d31612d9704d86039dd714f7904b3f1ad68f211e602372",
|
|
"network": "minio",
|
|
"args": ["server", "--console-address", ":9001", "http://minio{1...4}/data{1...2}"],
|
|
"env-file": ["/var/lib/minio/root.env"],
|
|
"volumes": [
|
|
"/var/lib/minio-store/data3-1:/data1",
|
|
"/var/lib/minio-store/data3-2:/data2",
|
|
"/var/lib/minio-store/unused-volume-stub/minio3:/data",
|
|
"/var/lib/minio/root.secret:/run/secrets/root:ro"
|
|
],
|
|
"env": {
|
|
"MINIO_ROOT_PASSWORD_FILE": "/run/secrets/root",
|
|
"MINIO_BROWSER_REDIRECT_URL": "https://files.novox.be"
|
|
}
|
|
},
|
|
{
|
|
"id": "minio4",
|
|
"type": "container",
|
|
"name": "minio4",
|
|
"image": "docker.io/pgsty/minio@sha256:b6bfe7239bfc83fb90d31612d9704d86039dd714f7904b3f1ad68f211e602372",
|
|
"network": "minio",
|
|
"args": ["server", "--console-address", ":9001", "http://minio{1...4}/data{1...2}"],
|
|
"env-file": ["/var/lib/minio/root.env"],
|
|
"volumes": [
|
|
"/var/lib/minio-store/data4-1:/data1",
|
|
"/var/lib/minio-store/data4-2:/data2",
|
|
"/var/lib/minio-store/unused-volume-stub/minio4:/data",
|
|
"/var/lib/minio/root.secret:/run/secrets/root:ro"
|
|
],
|
|
"env": {
|
|
"MINIO_ROOT_PASSWORD_FILE": "/run/secrets/root",
|
|
"MINIO_BROWSER_REDIRECT_URL": "https://files.novox.be"
|
|
}
|
|
},
|
|
{
|
|
"id": "lb",
|
|
"type": "container",
|
|
"name": "minio",
|
|
"image": "docker.io/library/nginx@sha256:985220252f3863977e468f611ef118ebd01421289dd86ee1ae99cb068c3bce2b",
|
|
"network": "minio",
|
|
"ports": ["9000", "9001"],
|
|
"volumes": [
|
|
"/var/lib/minio/nginx.conf:/etc/nginx/nginx.conf:ro"
|
|
]
|
|
},
|
|
{
|
|
"id": "runtime",
|
|
"type": "container",
|
|
"name": "mesh-minio",
|
|
"network": "minio",
|
|
"volumes": [
|
|
"/var/lib/mesh/minio/broker:/run/secrets/broker:ro",
|
|
"/var/lib/minio/grants:/var/lib/minio/grants:ro",
|
|
"/var/lib/minio/root.secret:/run/secrets/root:ro"
|
|
],
|
|
"env": {
|
|
"MESH_MINIO_ENDPOINT": "http://minio:9000",
|
|
"MESH_MINIO_ROOT_USER": "meshroot",
|
|
"MESH_MINIO_ROOT_PASSWORD_FILE": "/run/secrets/root",
|
|
"MESH_BROKER_FILE": "/run/secrets/broker",
|
|
"MESH_RECEIVES": "/var/lib/minio/grants/mesh.json"
|
|
},
|
|
"artifact": "runtime"
|
|
}
|
|
],
|
|
"build": {
|
|
"on": [
|
|
{
|
|
"arg": "BUILD_BASE",
|
|
"module": "mesh-tools",
|
|
"artifact": "build"
|
|
},
|
|
{
|
|
"arg": "RUNTIME_BASE",
|
|
"module": "mesh-tools",
|
|
"artifact": "runtime"
|
|
}
|
|
],
|
|
"artifacts": [
|
|
{
|
|
"name": "runtime",
|
|
"kind": "image",
|
|
"from": "Dockerfile"
|
|
}
|
|
]
|
|
}
|
|
}
|