Files
photos/module.json
jschoubben 3f0d622db0 The mongo credential authenticates against its own database, not admin
The provisioner creates the granted user inside the granted database —
mongo's own db-scoped convention — so authSource is the database's name.
Found by testing the credential before the cutover window, not during it.
2026-09-26 01:06:31 +02:00

190 lines
4.9 KiB
JSON

{
"module": "photos",
"version": "1",
"capabilities": [
"container-runtime"
],
"requires": [
"s3-bucket",
"mongodb-database",
"route"
],
"contributes": {
"s3-bucket": {
"bucket": "photos"
},
"mongodb-database": {
"name": "photos"
},
"route": {
"api": {
"label": "photos-api",
"port": 9102
},
"admin": {
"label": "photos",
"port": 8102
},
"eef": {
"label": "eef",
"port": 8104
},
"filip": {
"label": "filip",
"port": 8103
},
"flip": {
"label": "flip",
"port": 8103
},
"filip-api": {
"label": "filip-api",
"port": 9102
}
}
},
"binds": {
"s3-bucket": "/var/lib/photos/store.json",
"mongodb-database": "/var/lib/photos/database.json",
"route": "/var/lib/photos/route.json"
},
"secrets": {
"s3-bucket": "/var/lib/photos/store.secret",
"mongodb-database": "/var/lib/photos/database.secret"
},
"own-secrets": {
"admin-key": "/var/lib/photos/admin-key.secret"
},
"listens": [
{
"port": 9102,
"protocol": "tcp",
"from": "mesh",
"why": "the photos API over http; photos-api.novox.be is a route grant, and the proxy reaches it here. The machine side of the 9102:9000 mapping, named because three of this module's containers share the container-side port 80 and only the machine side tells them apart"
},
{
"port": 8102,
"protocol": "tcp",
"from": "mesh",
"why": "the admin client site over http; the public name photos.novox.be is a route grant, and the proxy reaches it here"
},
{
"port": 8103,
"protocol": "tcp",
"from": "mesh",
"why": "the filip client site over http; the public name filip.novox.be is a route grant, and the proxy reaches it here"
},
{
"port": 8104,
"protocol": "tcp",
"from": "mesh",
"why": "the eef client site over http; the public name eef.novox.be is a route grant, and the proxy reaches it here"
}
],
"resources": [
{
"id": "state",
"type": "directory",
"path": "/var/lib/photos",
"mode": "0700"
},
{
"id": "server-env",
"type": "file",
"path": "/var/lib/photos/server.env",
"mode": "0600",
"content": "NODE_ENV=production\nPORT=9000\nMONGO_URL=mongodb://${bound:mongodb-database:as}:${secret:mongodb-database}@${bound:mongodb-database:at}:${bound:mongodb-database:port}/${bound:mongodb-database:as}?authSource=${bound:mongodb-database:as}\nMONGO_DB=${bound:mongodb-database:as}\nMINIO_ENDPOINT=${bound:s3-bucket:at}\nMINIO_PORT=${bound:s3-bucket:port}\nMINIO_BUCKET=mesh-novox-photos\nMINIO_ACCESSKEY=${bound:s3-bucket:as}\nMINIO_SECRET=${secret:s3-bucket}\nMINIO_USE_SSL=false\nSUPER_ADMIN_KEY=${secret:admin-key}\n"
},
{
"id": "client-env",
"type": "file",
"path": "/var/lib/photos/client.env",
"mode": "0644",
"content": "REACT_APP_API_URL=https://photos-api.novox.be\n"
},
{
"id": "net",
"type": "network",
"name": "photos"
},
{
"id": "server",
"type": "container",
"name": "photos-server",
"artifact": "server",
"network": "photos",
"env-file": [
"/var/lib/photos/server.env"
],
"ports": [
"9102:9000"
],
"secrets-in-environment": "the application's own code reads MONGO_URL, MINIO_SECRET and SUPER_ADMIN_KEY from the environment (server/src/config.js); converting is this repository's change, tracked but not blocking the mesh conversion"
},
{
"id": "admin",
"type": "container",
"name": "photos-admin",
"artifact": "admin-client",
"network": "photos",
"env-file": [
"/var/lib/photos/client.env"
],
"ports": [
"8102:80"
]
},
{
"id": "eef",
"type": "container",
"name": "photos-eef",
"artifact": "client",
"network": "photos",
"env-file": [
"/var/lib/photos/client.env"
],
"ports": [
"8104:80"
]
},
{
"id": "filip",
"type": "container",
"name": "photos-filip",
"artifact": "client",
"network": "photos",
"env-file": [
"/var/lib/photos/client.env"
],
"ports": [
"8103:80"
]
}
],
"build": {
"on": [
{
"arg": "NODE_BASE",
"image": "node@sha256:48e4b67d85f87bd551df43704e24d252f56cc5f8e9718841aace50f19948f0f9"
}
],
"artifacts": [
{
"name": "server",
"kind": "image",
"from": "server/Dockerfile"
},
{
"name": "client",
"kind": "image",
"from": "client/Dockerfile"
},
{
"name": "admin-client",
"kind": "image",
"from": "admin-client/Dockerfile"
}
]
}
}