mesh-catalog/modules/mesh-vault/module.json

{
  "module": "mesh-vault",
  "version": "1",
  "runs-as": "mesh-vault",
  "provides": [
    {
      "name": "secret",
      "credential": {
        "form": "pair"
      },
      "scope": "mesh",
      "identity": {
        "in": "a vault entry"
      }
    }
  ],
  "emits": [
    "provisioned",
    "rotated",
    "secret-changed",
    "account-hashed",
    "own-replaced",
    "account-issued",
    "signed"
  ],
  "reads": [
    "node-engine.have",
    "mesh-grants.accounts",
    "mesh-controller.lease",
    "mesh-delivery-assigner.placement",
    "mesh-provisioner.plans",
    "mesh-provisioner.provisions"
  ],
  "state": [
    {
      "name": "bus-accounts",
      "history": 2
    },
    "signers",
    "bound"
  ],
  "receives": {
    "secret": "${dir:grants}/mesh.json"
  },
  "grants": {
    "secret": "${dir:grants}"
  },
  "keeps": "/var/lib/mesh-vault/root",
  "data": {
    "own": [
      {
        "id": "state",
        "path": "${dir:state}",
        "class": "valuable",
        "why": "the vault's own keys"
      },
      {
        "id": "ledger",
        "path": "${dir:ledger}",
        "class": "valuable",
        "why": "every secret the vault keeps"
      },
      {
        "id": "root",
        "path": "${dir:root}",
        "class": "valuable",
        "why": "the vault's root material"
      },
      {
        "id": "store",
        "path": "${dir:store}",
        "class": "valuable",
        "why": "every secret the vault holds, sealed to its own key and to the operator key"
      }
    ],
    "consumers": {
      "secret": {
        "class": "valuable",
        "in": "ledger",
        "why": "a secret given to a consumer is kept nowhere else in the clear"
      }
    }
  },
  "own-secrets": {
    "broker": "${dir:state}/broker"
  },
  "secrets-owner": "mesh-vault",
  "runtime-health": {
    "kind": "tool",
    "tool": "vault_health",
    "interval": "60s",
    "timeout": "10s",
    "looks": 2,
    "grace": "60s"
  },
  "resources": [
    {
      "id": "account",
      "type": "user",
      "name": "mesh-vault",
      "shell": "/usr/bin/nologin",
      "home": "/var/lib/mesh-vault"
    },
    {
      "id": "state",
      "type": "directory",
      "mode": "0700",
      "owner": "mesh-vault",
      "place": ".",
      "unknown": "program"
    },
    {
      "id": "grants",
      "type": "directory",
      "mode": "0700",
      "owner": "mesh-vault",
      "unknown": "program"
    },
    {
      "id": "ledger",
      "type": "directory",
      "mode": "0700",
      "owner": "mesh-vault",
      "unknown": "program"
    },
    {
      "id": "root",
      "type": "directory",
      "mode": "0700",
      "owner": "mesh-vault",
      "unknown": "program"
    },
    {
      "id": "store",
      "type": "directory",
      "mode": "0700",
      "owner": "mesh-vault",
      "unknown": "program"
    }
  ],
  "build": {
    "artifacts": [
      {
        "name": "code",
        "kind": "bundle",
        "language": "go",
        "system": "arch",
        "from": "cmd/mesh-vault",
        "binary": "mesh-vault",
        "loads": [
          "mesh-vault"
        ],
        "env": {
          "MESH_RECEIVES": "${dir:grants}/mesh.json",
          "MESH_VAULT_LEDGER": "${dir:ledger}",
          "MESH_VAULT_ROOT": "${dir:root}",
          "MESH_VAULT_STORE": "${dir:store}",
          "MESH_VAULT_STATE": "${dir:state}",
          "MESH_VAULT_SECRET_ASK_CALLERS": "node-tools"
        }
      }
    ]
  },
  "tools": [
    "secret_export",
    "secret_holders",
    "secret_verify",
    "secret_handed",
    "secret_own",
    "account_hash",
    "account_adopt",
    "account_retire",
    "secret_asks",
    "secret_vault_export",
    "provisioner_retirement",
    "provisioner_retire_approve",
    "provisioner_retire_reject",
    "provisioner_delete",
    "vault_status",
    "vault_health",
    "own_drift",
    "own_take_switch",
    "vault_signers",
    "vault_signed",
    "signers_reassert"
  ],
  "claims": [
    {
      "name": "mesh-vault",
      "scope": "mesh",
      "serves": [
        "get",
        "accept",
        "secret-ask",
        "issued",
        "rotate",
        "move-in",
        "node-key",
        "move-asks",
        "own",
        "issue-account",
        "sign"
      ]
    }
  ]
}