jschoubben
e703a94fcd
Sixth green regression bed. Same shape as tools-gitlab: a runtime-only module comes up under the mesh, serves its full tool surface with no valid credentials (the Servarr lesson), stays up, binds its serve queues, and gets its scoped broker account. SUITE_EXIT=0. Claude-Session: https://claude.ai/code/session_01LrgweAeERJYBg88c5cKDzF
42 lines
1.9 KiB
YAML
42 lines
1.9 KiB
YAML
# One machine that becomes a mesh and is then assigned confluence — a tools-only, outbound-only
|
|
# external-SaaS integration (novox/hq ADR 0039), the same shape gitlab proved. confluence has NO
|
|
# service container, NO listener, NO provisioner — just a broker-bound runtime that serves the
|
|
# module's Confluence tools under a scoped account. It only ever calls out to a Confluence instance.
|
|
#
|
|
# The sharp point this bed proves is the Servarr lesson: the runtime MUST come up and serve its full
|
|
# tool surface even with NO valid Confluence credentials — the lab has no real Confluence, and
|
|
# confluence's own token is a mesh-minted own-secret that points at nothing. confluence's client is
|
|
# built lazily and never throws at registration, so the runtime logs `[mesh-tools] serving 3 tool(s)`
|
|
# and binds its serve queues regardless; a tool would only fail if it were actually invoked.
|
|
#
|
|
# MESH_LAB_HOST_BINARY=.../mesh-host MESH_LAB_BUNDLE=.../examples/substrate-first-node.lock
|
|
# scripts/build-module-runtime.sh confluence builds mesh-runtime-confluence:development into the
|
|
# local daemon, which this scenario stocks and serves by digest from its own registry. confluence
|
|
# needs no service image — it is tools-only.
|
|
scenario: tools-confluence
|
|
|
|
segments:
|
|
hosting:
|
|
kind: public
|
|
cidr: [192.0.2.0/24]
|
|
|
|
machines:
|
|
anchor:
|
|
at: { segment: hosting, address: [192.0.2.10] }
|
|
inbound: allow
|
|
memory: 3GiB
|
|
cpus: 2
|
|
|
|
images:
|
|
# The first-node substrate: store, broker, control.
|
|
- postgres:17-alpine
|
|
- cloudamqp/lavinmq:latest
|
|
- mesh-control:development
|
|
# confluence's runtime, built by scripts/build-module-runtime.sh confluence into the local daemon
|
|
# and stocked into the scenario's own registry, which is where the host pulls it from. There is no
|
|
# service image: confluence is tools-only and outbound-only.
|
|
- mesh-runtime-confluence:development
|
|
|
|
place:
|
|
all: [host, runtime]
|