jochen
f87f4cdfe5
mesh/merge-gate pass: builds baserow, grafana, mailu, matrix, mongodb, mosquitto, nodered, postgres, redis, step-ca, supabase, website → ace, novox; no bus…
mesh/repo-check pass: its merge-check.sh passed
mesh/delivery delivered
mesh/delivery-group group feat/health-the-first-declarations delivered: every member is delivered
Seven modules' images ship a check the mesh never read. Adopted by name where it says healthy on the live mesh today: nine of mail's containers (not its antivirus, whose six-minute start is past the five-minute bound, nor its cache, whose image ships none), the certificate authority, the spreadsheet app, four of the database suite's (the studio among them, with the address it binds fixed), the flow editor and the chat client. And the endpoints four services already declare, looked at from the machine: tcp on the database, the cache, the document store and the broker; http on the website and the dashboards. The count of undeclared falls from 93 to 70.
95 lines
2.3 KiB
JSON
95 lines
2.3 KiB
JSON
{
|
|
"module": "step-ca",
|
|
"version": "1",
|
|
"capabilities": [
|
|
"container-runtime"
|
|
],
|
|
"provides": [
|
|
{
|
|
"name": "internal-acme-ca",
|
|
"scope": "mesh"
|
|
}
|
|
],
|
|
"serves": {
|
|
"internal-acme-ca": {
|
|
"path": "/acme/acme/directory",
|
|
"roots": "/roots.pem"
|
|
}
|
|
},
|
|
"listens": [
|
|
{
|
|
"name": "acme",
|
|
"port": 9000,
|
|
"protocol": "tcp",
|
|
"from": "mesh",
|
|
"why": "the ACME directory and step-ca API; a proxy on any node reaches it here over the mesh to obtain certificates, and its single listen is what the consumer is told the port is"
|
|
}
|
|
],
|
|
"own-secrets": {
|
|
"password": "${dir:mesh-state}/password"
|
|
},
|
|
"data": {
|
|
"own": [
|
|
{
|
|
"id": "home",
|
|
"path": "${dir:home}",
|
|
"class": "valuable",
|
|
"why": "the mesh's certificate authority: its keys and its database of what it issued"
|
|
}
|
|
]
|
|
},
|
|
"resources": [
|
|
{
|
|
"id": "mesh-state",
|
|
"type": "directory",
|
|
"mode": "0700",
|
|
"place": "mesh"
|
|
},
|
|
{
|
|
"id": "home",
|
|
"type": "directory",
|
|
"mode": "0700",
|
|
"owner": "1000:1000",
|
|
"place": "."
|
|
},
|
|
{
|
|
"id": "config",
|
|
"type": "file",
|
|
"path": "${dir:mesh-state}/config.json",
|
|
"mode": "0644",
|
|
"content": "{}",
|
|
"merge": "json"
|
|
},
|
|
{
|
|
"id": "init-env",
|
|
"type": "file",
|
|
"path": "${dir:mesh-state}/init.env",
|
|
"mode": "0600",
|
|
"content": "DOCKER_STEPCA_INIT_PASSWORD=${secret:password}\nDOCKER_STEPCA_INIT_DNS_NAMES=${machine:at},${machine:name},localhost,127.0.0.1\n"
|
|
},
|
|
{
|
|
"id": "server",
|
|
"type": "container",
|
|
"name": "step-ca",
|
|
"image": "smallstep/step-ca@sha256:a2b17872915c193259b75a5474c398326f41bd199f0842093e52cf4182bc8270",
|
|
"health": {
|
|
"kind": "runtime"
|
|
},
|
|
"network": "host",
|
|
"env-file": [
|
|
"${dir:mesh-state}/init.env"
|
|
],
|
|
"env": {
|
|
"DOCKER_STEPCA_INIT_NAME": "Mesh Internal CA",
|
|
"DOCKER_STEPCA_INIT_ACME": "true",
|
|
"DOCKER_STEPCA_INIT_REMOTE_MANAGEMENT": "false"
|
|
},
|
|
"volumes": [
|
|
"${dir:home}:/home/step",
|
|
"${dir:mesh-state}:/run/mesh:ro"
|
|
],
|
|
"secrets-in-environment": "the entrypoint honours DOCKER_STEPCA_INIT_PASSWORD_FILE; convertible, awaiting a bed that proves it"
|
|
}
|
|
]
|
|
}
|