mesh-catalog/modules/nats/module.json

{
  "module": "nats",
  "version": "1",
  "upgrade": {
    "policy": "record",
    "why": "the bus keeps the streams of the whole mesh: each move waits for a person's yes, which the operator's Approve of the release that carries its build gives, and its node backs its streams up before it applies (hq ADR 0236, ADR 0601)"
  },
  "provides": [
    {
      "name": "mesh-bus",
      "scope": "mesh",
      "credential": {
        "form": "none"
      }
    }
  ],
  "claims": [
    {
      "name": "mesh-broker",
      "scope": "mesh"
    }
  ],
  "bus-users": "/var/lib/nats-module/conf/accounts.conf",
  "own-secrets": {
    "broker": "${dir:mesh-state}/broker",
    "broker-nats-tools": "${dir:tools-secret}/broker-nats-tools"
  },
  "capabilities": [
    "container-runtime"
  ],
  "emits": [
    "consumer-removed",
    "bucket-keys-removed",
    "stream-removed",
    "bucket-expiry-set"
  ],
  "invokes": [
    "seat:mesh-hand-acts.hand-act"
  ],
  "consumes": [],
  "listens": [
    {
      "name": "bus",
      "port": 4222,
      "protocol": "tcp",
      "from": "mesh",
      "why": "the mesh bus — every link the mesh has, over TLS, reached across the overlay"
    }
  ],
  "tools": [
    "nats_server",
    "nats_connections",
    "nats_closed_connections",
    "nats_subscriptions",
    "nats_streams",
    "nats_backlog",
    "nats_buckets",
    "nats_users",
    "nats_user_can",
    "nats_snapshot_verify",
    "nats_consumer_remove",
    "nats_bucket_remove",
    "nats_stream_remove",
    "nats_bucket_expiry"
  ],
  "guards": [
    8222
  ],
  "data": {
    "own": [
      {
        "id": "jetstream",
        "path": "${dir:jetstream-data}",
        "class": "valuable",
        "active": "1d",
        "backup": {
          "dump": "docker exec -i mesh-broker-nats /opt/mesh/mesh-nats-snapshot snapshot < ${dir:mesh-state}/broker > ${dir:snapshots}/bus.tar.partial && mv ${dir:snapshots}/bus.tar.partial ${dir:snapshots}/bus.tar || { rm -f ${dir:snapshots}/bus.tar.partial; exit 1; }",
          "into": "snapshots"
        },
        "why": "the bus's streams and key-value buckets: the hand-act log, conditions, every module's state; written all the time, so copied by the server's own snapshot of each stream (novox/hq ADR 0235), never as live files"
      },
      {
        "id": "snapshots",
        "path": "${dir:snapshots}",
        "class": "rebuildable",
        "why": "last night's snapshot of every stream with its manifest, made again every night"
      }
    ]
  },
  "resources": [
    {
      "id": "jetstream-data",
      "type": "directory",
      "path": "/var/lib/mesh-broker-nats",
      "mode": "0700",
      "unknown": "program"
    },
    {
      "id": "conf-dir",
      "type": "directory",
      "path": "/var/lib/nats-module/conf",
      "mode": "0700",
      "unknown": "program"
    },
    {
      "id": "tools-secret",
      "type": "directory",
      "path": "/var/lib/mesh/nats-tools",
      "mode": "0711",
      "unknown": "program"
    },
    {
      "id": "snapshots",
      "type": "directory",
      "mode": "0700",
      "unknown": "program"
    },
    {
      "id": "mesh-state",
      "type": "directory",
      "mode": "0700",
      "place": "mesh",
      "unknown": "program"
    },
    {
      "id": "server-conf",
      "type": "file",
      "path": "/var/lib/nats-module/conf/nats.conf",
      "template": "files/nats.conf",
      "mode": "0644"
    },
    {
      "id": "state",
      "type": "directory",
      "mode": "0700",
      "place": ".",
      "unknown": "program"
    },
    {
      "id": "program-snapshot",
      "type": "archive",
      "path": "${dir:state}/snapshot",
      "artifact": "snapshot",
      "unknown": "program"
    },
    {
      "id": "program-entrypoint",
      "type": "archive",
      "path": "${dir:state}/entrypoint",
      "artifact": "entrypoint",
      "unknown": "program"
    },
    {
      "id": "server",
      "type": "container",
      "name": "mesh-broker-nats",
      "ports": [
        "4222:4222",
        "127.0.0.1:8222:8222"
      ],
      "volumes": [
        "/var/lib/mesh-broker-nats:/data",
        "/var/lib/nats-module/conf:/etc/nats:ro",
        "${access:tls}:/tls:ro",
        "${dir:state}/snapshot:/opt/mesh:ro",
        "${dir:state}/entrypoint:/opt/mesh-entrypoint:ro"
      ],
      "args": [
        "sh",
        "/opt/mesh-entrypoint/entrypoint.sh"
      ],
      "artifact": "server",
      "restart-on": [
        "program-snapshot",
        "program-entrypoint"
      ]
    }
  ],
  "accesses": [
    {
      "id": "tls",
      "path": "/var/lib/mesh-broker-tls",
      "mode": "read"
    }
  ],
  "build": {
    "artifacts": [
      {
        "name": "server",
        "kind": "upstream",
        "from": "nats:2.11.17-alpine@sha256:e4bf19f15fd3218814a4e3c9e0064e1334bd8aa20d5984b9f1a0afd084f8cc00"
      },
      {
        "name": "snapshot",
        "kind": "bundle",
        "language": "go",
        "system": "alpine",
        "from": "cmd/mesh-nats-snapshot",
        "binary": "mesh-nats-snapshot"
      },
      {
        "name": "entrypoint",
        "kind": "archive",
        "from": "program"
      },
      {
        "name": "tools",
        "kind": "bundle",
        "language": "go",
        "system": "arch",
        "from": "cmd/nats-tools",
        "binary": "nats-tools",
        "loads": [
          "nats-tools"
        ],
        "bus": {
          "removes": [
            "controller-leftovers"
          ]
        },
        "env": {
          "MESH_NATS_MONITOR": "http://127.0.0.1:8222",
          "MESH_NATS_CONTAINER": "mesh-broker-nats",
          "MESH_NATS_USERS_FILE": "/etc/nats/accounts.conf",
          "MESH_NATS_SNAPSHOTS_DIR": "${dir:snapshots}",
          "NATS_TOOLS_CREDENTIAL": "${dir:tools-secret}/broker-nats-tools"
        }
      },
      {
        "name": "files",
        "kind": "archive",
        "from": "files"
      }
    ]
  }
}