# One machine that becomes a mesh and is then assigned gitlab — the exemplar of the tools-only,
# outbound-only external-SaaS integration (novox/hq ADR 0039). gitlab is the thinnest converted
# shape: NO service container, NO listener, NO provisioner — just a broker-bound runtime that serves
# the module's GitLab tools under a scoped account. Its sibling in kind is unifi (a tooled app), but
# gitlab has no server of its own to run alongside; it only ever calls out to a GitLab instance.
#
# The sharp point this bed proves is the Servarr lesson: the runtime MUST come up and serve its full
# tool surface even with NO valid GitLab credentials — the lab has no real GitLab, and gitlab's own
# token is a mesh-minted own-secret that points at nothing. gitlab's client is built lazily and never
# throws at registration, so the runtime logs `[mesh-tools] serving 23 tool(s)` and binds its serve
# queues regardless; a tool would only fail if it were actually invoked without real creds.
#
#   MESH_LAB_HOST_BINARY=.../mesh-host   MESH_LAB_BUNDLE=.../examples/foundation-first-node.lock
#   scripts/build-module-runtime.sh gitlab builds mesh-runtime-gitlab:development into the local
#   daemon, which the machine pulls from the internet over its uplink. gitlab needs no
#   service image — it is tools-only.
scenario: tools-gitlab

segments:
  hosting:
    kind: public
    cidr: [192.0.2.0/24]

machines:
  anchor:
    at: { segment: hosting, address: [192.0.2.10] }
    egress: true
    inbound: allow
    memory: 3GiB
    cpus: 2

images:
  - mesh-controller:development
  # gitlab's runtime, built by scripts/build-module-runtime.sh gitlab into the local daemon and
  # loaded onto the machine, which holds it by its own image ID. There is no
  # service image: gitlab is tools-only and outbound-only.
  - mesh-runtime-gitlab:development

place:
  all: [host, runtime]