jschoubben
00e54d46d7
mesh-build-go binds /var/lib/mesh-build-node-cache/toolchain read-only into the integration level's one shut-off process when it is there; the unit level never. mesh-build-node opens its installed toolchains to other accounts (folders 0755, files 0644, writable by its owner alone; its cache 0711, so the npm cache beside them stays its own), and realMachine copies the toolchain of its own lock from there instead of npm ci from the registry, which the level cannot reach.
184 lines
3.7 KiB
JSON
184 lines
3.7 KiB
JSON
{
|
|
"module": "mesh-build-node",
|
|
"version": "1",
|
|
"moved": true,
|
|
"runs-as": "mesh-build-node",
|
|
"capabilities": [
|
|
"package-manager",
|
|
"user-namespaces"
|
|
],
|
|
"state": [
|
|
"toolchains",
|
|
"keys",
|
|
"steps"
|
|
],
|
|
"tools": [
|
|
"build_node_fetch",
|
|
"build_node_test",
|
|
"build_node_build",
|
|
"build_node_step",
|
|
"build_node_steps",
|
|
"build_node_toolchains",
|
|
"build_node_status",
|
|
"build_node_health"
|
|
],
|
|
"streams": [
|
|
{
|
|
"name": "toolchains-node",
|
|
"events": [
|
|
"toolchain.**"
|
|
]
|
|
}
|
|
],
|
|
"requires": [
|
|
"forge-account",
|
|
"npm-package-registry",
|
|
"node-toolchain",
|
|
"artifact-store"
|
|
],
|
|
"contributes": {
|
|
"npm-package-registry": {
|
|
"access": "write"
|
|
}
|
|
},
|
|
"binds": {
|
|
"npm-package-registry": "${dir:state}/package-registry.json"
|
|
},
|
|
"secrets": {
|
|
"npm-package-registry": "${dir:state}/package-registry.secret"
|
|
},
|
|
"own-secrets": {
|
|
"broker": "${dir:state}/broker"
|
|
},
|
|
"secrets-owner": "mesh-build-node",
|
|
"runtime-health": {
|
|
"kind": "tool",
|
|
"tool": "build_node_health",
|
|
"interval": "60s",
|
|
"timeout": "10s",
|
|
"looks": 2,
|
|
"grace": "60s"
|
|
},
|
|
"resources": [
|
|
{
|
|
"id": "account",
|
|
"type": "user",
|
|
"name": "mesh-build-node",
|
|
"shell": "/usr/bin/nologin",
|
|
"home": "/var/lib/mesh-build-node"
|
|
},
|
|
{
|
|
"id": "state",
|
|
"type": "directory",
|
|
"mode": "0700",
|
|
"owner": "mesh-build-node",
|
|
"place": ".",
|
|
"unknown": "program"
|
|
},
|
|
{
|
|
"id": "work",
|
|
"type": "directory",
|
|
"path": "/var/lib/mesh-build-node-work",
|
|
"mode": "0700",
|
|
"owner": "mesh-build-node",
|
|
"unknown": "program"
|
|
},
|
|
{
|
|
"id": "cache",
|
|
"type": "directory",
|
|
"path": "/var/lib/mesh-build-node-cache",
|
|
"mode": "0711",
|
|
"owner": "mesh-build-node",
|
|
"unknown": "program"
|
|
},
|
|
{
|
|
"id": "ssh-dir",
|
|
"type": "directory",
|
|
"path": "${dir:state}/.ssh",
|
|
"mode": "0700",
|
|
"owner": "mesh-build-node",
|
|
"unknown": "program"
|
|
},
|
|
{
|
|
"id": "ssh-config",
|
|
"type": "file",
|
|
"path": "${dir:ssh-dir}/config",
|
|
"owner": "mesh-build-node",
|
|
"mode": "0600",
|
|
"template": "files/forge"
|
|
},
|
|
{
|
|
"id": "known-hosts",
|
|
"type": "file",
|
|
"path": "${dir:ssh-dir}/known_hosts",
|
|
"owner": "mesh-build-node",
|
|
"mode": "0644",
|
|
"template": "files/known_hosts"
|
|
},
|
|
{
|
|
"id": "git-config",
|
|
"type": "file",
|
|
"path": "${dir:state}/.config/git/config",
|
|
"owner": "mesh-build-node",
|
|
"mode": "0644",
|
|
"template": "files/gitconfig"
|
|
},
|
|
{
|
|
"id": "registry",
|
|
"type": "file",
|
|
"path": "${dir:state}/registry",
|
|
"owner": "mesh-build-node",
|
|
"mode": "0644",
|
|
"template": "files/registry"
|
|
},
|
|
{
|
|
"id": "toolchain-dir",
|
|
"type": "archive",
|
|
"path": "${dir:state}/toolchain",
|
|
"owner": "mesh-build-node",
|
|
"artifact": "toolchain",
|
|
"unknown": "program"
|
|
},
|
|
{
|
|
"id": "git",
|
|
"type": "package",
|
|
"package": "git"
|
|
},
|
|
{
|
|
"id": "openssh",
|
|
"type": "package",
|
|
"package": "openssh"
|
|
},
|
|
{
|
|
"id": "bubblewrap",
|
|
"type": "package",
|
|
"package": "bubblewrap"
|
|
}
|
|
],
|
|
"build": {
|
|
"artifacts": [
|
|
{
|
|
"name": "tools",
|
|
"kind": "bundle",
|
|
"language": "go",
|
|
"system": "arch",
|
|
"from": "cmd/mesh-build-node",
|
|
"binary": "mesh-build-node",
|
|
"loads": [
|
|
"mesh-build-node"
|
|
]
|
|
},
|
|
{
|
|
"name": "files",
|
|
"kind": "archive",
|
|
"from": "files"
|
|
},
|
|
{
|
|
"name": "toolchain",
|
|
"kind": "archive",
|
|
"from": "toolchain"
|
|
}
|
|
]
|
|
}
|
|
}
|