jschoubben
306c4ca13b
Tier 2 exists now. It holds one context of seven, inventory, and does one thing with it: brings its schema up to date. That is step 3 of the substrate bootstrap -- the step the first node cannot get past. Verified against a real PostgreSQL, with the built binary: applied 0001-nodes, reported 'already up to date' on the second run, and the node table is there with the index and the unique constraint the migration asks for. Written in Go, and the image is FROM scratch holding one file. Confirmed by unpacking it. That is the whole argument of ADR 0024: the bundle pins this image by digest and runs it where nothing can check it, so everything in it is something a person has to audit before trusting a first node. Exclusive store ownership is built as a rule about credentials rather than about intentions. There is no mesh-wide connection setting and no way to ask for one -- a context reads MESH_STORE_<ITS OWN NAME> and holds nothing else, so reaching another context's store needs a new variable, which is visible in the declaration that runs it. The migration runner is mostly refusals: an edited migration that already ran, a migration numbered below one that has run, duplicate numbers, misnamed files, empty files. All stop rather than warn, because at the moment any of them is true nobody knows what the database holds. It stops before identity, deliberately. What a node presents to prove who it is has not been decided anywhere, and a migration is the most expensive place in this system to guess. Two tests did not defend what they claimed, and both are fixed rather than removed. One asked only whether Open returned an error, which it did either way -- a bad context name and a missing credential both fail, so deleting the name check changed nothing. The other claimed to prove the migration runs in a transaction, but PostgreSQL already wraps a multi-statement query in one of its own, so it passed with the transaction taken out. What the transaction actually buys is that the schema change and the row recording it commit together, and there is now a test for that which fails when they are split.
30 lines
1015 B
Go
30 lines
1015 B
Go
// Package inventory is the context that knows which machines are in the mesh.
|
|
//
|
|
// novox/hq ADR 0006 names seven contexts; this is the first built, because everything else needs
|
|
// to be able to say which node it is talking about.
|
|
//
|
|
// It owns its store exclusively (novox/hq ADR 0008) — a database called `inventory`, reached with
|
|
// a credential no other context holds.
|
|
package inventory
|
|
|
|
import (
|
|
"embed"
|
|
|
|
"github.com/novox/mesh-control/internal/store"
|
|
)
|
|
|
|
// Name is what this context is called: its database, and the environment variable holding the
|
|
// credential for it, are both derived from this.
|
|
const Name = "inventory"
|
|
|
|
//go:embed migrations/*.sql
|
|
var files embed.FS
|
|
|
|
// Migrations are the schema changes this context carries, in order.
|
|
//
|
|
// Embedded, so the binary and its schema are one artifact: an image cannot run this code against
|
|
// a directory of migrations from a different version of it.
|
|
func Migrations() ([]store.Migration, error) {
|
|
return store.LoadMigrations(files, "migrations")
|
|
}
|