The two halves of an object-store edge, as a readable pair

Manifests for a provider and a consumer, so the contract can be read rather than only exercised through a lab fixture that stages the grants by hand. Checked as a pair rather than separately, because two manifests that only ever parse alone are two manifests nobody has held against each other. The test asserts the names match, that each side says where it wants to be told, and that the consumer contributes the key the provisioner actually reads. That last one is the trap worth having a test for: a consumer contributing "name" — which is exactly what a database consumer contributes — resolves cleanly, deploys, and then fails on the machine with "asked for a bucket and did not name it". Nothing in that message points back at the manifest that caused it. Both mistakes were made while writing these two files.
2026-08-31 17:52:14 +02:00
parent ed9a30f22d
commit 950ebb9e28
4 changed files with 162 additions and 0 deletions
@@ -0,0 +1,51 @@
+{
+  "module": "object-store",
+  "version": "1",
+
+  "provides": [{"name": "s3-bucket", "scope": "mesh"}],
+  "capabilities": ["container-runtime"],
+
+  "listens": [
+    {"port": 9000, "protocol": "tcp", "from": "mesh",
+     "why": "the S3 endpoint, for modules on any machine that were granted a bucket"}
+  ],
+
+  "serves": {
+    "s3-bucket": {
+      "port": 9000,
+      "scheme": "http",
+      "region": "us-east-1"
+    }
+  },
+
+  "receives": {"s3-bucket": "/var/lib/objectstore/grants"},
+  "grants": {"s3-bucket": "/var/lib/objectstore/grants"},
+
+  "own-secrets": {"root": "/var/lib/objectstore/root.secret"},
+
+  "resources": [
+    {"id": "state", "type": "directory", "path": "/var/lib/objectstore", "mode": "0700"},
+    {"id": "grants", "type": "directory", "path": "/var/lib/objectstore/grants", "mode": "0700"},
+
+    {"id": "store", "type": "container", "name": "mesh-store",
+     "image": "minio/minio@sha256:0000000000000000000000000000000000000000000000000000000000000000",
+     "args": ["server", "/data"],
+     "env": {"MINIO_ROOT_USER": "meshroot"},
+     "ports": ["9000:9000"],
+     "volumes": ["mesh-store-data:/data", "/var/lib/objectstore/root.secret:/run/secrets/root:ro"]},
+
+    {"id": "provisioner", "type": "container", "name": "mesh-provision-objectstore",
+     "image": "mesh-provision-objectstore@sha256:0000000000000000000000000000000000000000000000000000000000000000",
+     "env": {
+       "GRANTS": "/var/lib/objectstore/grants",
+       "MESH_OBJECTSTORE_URL": "http://127.0.0.1:9000",
+       "MESH_OBJECTSTORE_ROOT_USER": "meshroot",
+       "MESH_OBJECTSTORE_ROOT_PASSWORD_FILE": "/run/secrets/root"
+     },
+     "volumes": [
+       "/var/lib/objectstore/grants:/var/lib/objectstore/grants:ro",
+       "/var/lib/objectstore/root.secret:/run/secrets/root:ro"
+     ],
+     "restart-on": ["grants"]}
+  ]
+}