jschoubben
2b15cb57f0
The engine names the filesystem a waiting folder is on; a warrant is recorded for that filesystem, and a folder on another is asked about again and not taken there meanwhile. Entries the engine could not take out while their disk was away, stated before a send, do not hold that delivery's gate. mesh-host pinned to d2d9fbbd.
45 lines
3.1 KiB
SQL
45 lines
3.1 KiB
SQL
-- Every module is given an identity of its own, and the mesh takes a shared folder once, on the operator's word
|
||
-- (novox/hq ADR 0325 §3, §8, §11).
|
||
--
|
||
-- **One number per module, mesh-wide, allocated once and never again.** The node-engine makes the account
|
||
-- mesh-<module> on each machine the module is assigned to, with these numbers, so a container that declares
|
||
-- `identity` runs as the same uid and gid everywhere and a folder's entries mean the same on every machine. The
|
||
-- numbers come from a sequence of their own, 50000–59999 (catalogue.IdentityLow and IdentityHigh): above the
|
||
-- numbers distributions give people, below the 60000s Debian keeps for its daemons, and nowhere near root's 0 or a
|
||
-- root group's (0, 4, 10). The checks refuse a row outside the range, so no write, by hand or by a later bug, can make
|
||
-- an identity root (§11). uid and gid are one number. A sequence never hands a number back, and a row is kept after
|
||
-- its module is forgotten, so a number once given is never given to another module: a file left owned by a removed
|
||
-- module's identity is never inherited by a new one.
|
||
create sequence module_identity_number as integer minvalue 50000 maxvalue 59999 start 50000 no cycle;
|
||
|
||
create table module_identity (
|
||
module text primary key,
|
||
uid integer not null unique check (uid between 50000 and 59999),
|
||
gid integer not null unique check (gid between 50000 and 59999),
|
||
allocated timestamptz not null default now(),
|
||
check (uid = gid)
|
||
);
|
||
|
||
-- **A folder taken, per machine** (§8). The first time a placed folder that already holds data is to be kept, the
|
||
-- operator is asked once for that folder on that machine; on the warrant the node-engine adds the entries to
|
||
-- everything there, and the folder is taken: kept from then on without asking, a module that gains the access
|
||
-- added with no wait. The row is the record of that act — who approved it, under which warrant — and what tells a
|
||
-- later module's access that it joins a taken folder (`taken` on the access). The path is the folder as placed,
|
||
-- clean and absolute. A new warrant for the same folder on another filesystem replaces the row.
|
||
create table kept_folder (
|
||
node uuid not null references node (id) on delete cascade,
|
||
path text not null check (path like '/%'),
|
||
taken_at timestamptz not null default now(),
|
||
-- Who approved it, as the hand-act log says it, and the ask and warrant it was taken under.
|
||
taken_by text not null,
|
||
ask text not null,
|
||
warrant text not null,
|
||
-- What the node-engine answered when it started the take.
|
||
said text not null default '',
|
||
-- The filesystem the folder was on when it was taken, as the engine names it without a path ("fs-<12 hex>"):
|
||
-- a wait naming another (the folder moved to another disk) is not answered by this take, and the operator is
|
||
-- asked again; until the new warrant the folder is not taken there. Empty from an engine that names none.
|
||
placed text not null default '',
|
||
primary key (node, path)
|
||
);
|