mdella/monky-deployd
1
0
Fork 0
mirror of https://scm.tikali.ai/tikali/applications/monky/monky-deployd.git synced 2026-09-18 05:36:15 +00:00
Code Issues Packages Projects Releases 1 Wiki Activity

feat: monky-deployd v0.1.0 — pull agent over the mesh (ADR-0028)

Browse Source 
Stdlib-only Python 3.12 agent for docker VMs and laptops: flock → checkin
(bearer = the agent's OpenBao token, bootstrapped from the install kit's
jwt-tenancy deploy grant) → action apply|none|down → bundle (sha256
verified) → refusal checks (unresolved ${VAR} names only, manifest paths
pinned to monky/data/<env>/see/, privileged/host-network, rollback, disk
need×1.5+headroom) → lease → POST /v1/auth/jwt-tenancy/login → KV reads →
.env 0600 → promote → compose pull/up → wait healthy → report; finally
renew-self / re-lease before max TTL, scrub. Exit 0/75/78/1. Redactor log
filter. Transports sdk (openziti) / proxy (ziti tunnel proxy 18443/18200) /
system. Laptop mode.

Packaging: hardened oneshot + 60 s timer + proxy unit, nfpm .deb with
/opt/monky-deployd/venv, install.sh for Ubuntu 26.04 (Gitea release
download, enrol, ACLs, bootstrap from stdin), ansible role skeleton for
osg1-07. CI: lint/test on every change; wheel (openziti on ubuntu:26.04) and
package (nfpm) allow_failure until runner egress is proven; GitLab release +
release:gitea on v* tags. Docs: README, PROTOCOL, OPERATIONS, CHANGELOG,
CLAUDE/AGENTS.

Divergence noted: monky-tenancy main (MR !15) still ships the AppRole lease
and kit; this agent implements the plan's Gate 1 RESULT (login_jwt, no
unwrap) and refuses an AppRole lease loudly (LEASE_SHAPE).

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KLB7jieMNRkTsJ2epr4Ds1
This commit is contained in:
Marcos Della
2026-09-05 08:01:36 +00:00
parent c72d6c0227
commit 1c42e913a8
48 changed files with 4932 additions and 64 deletions
Download Patch File Download Diff File Expand all files Collapse all files
packaging/nfpm.yaml
+53
View File
@@ -0,0 +1,53 @@
# nfpm (https://nfpm.goreleaser.com) — builds monky-deployd_<ver>_amd64.deb in CI (`package` job).
# The venv under /opt/monky-deployd/venv is created by CI on ubuntu:26.04 with the system
# python3 (3.14 on 26.04; the agent needs >= 3.12) and the vendored openziti wheel when present.
name: monky-deployd
arch: amd64
platform: linux
version: ${VERSION}
section: admin
priority: optional
maintainer: Tikali <mdella@tikali.ai>
description: |
Monky backend pull agent (MONKY-ADR-0028): checkin -> bundle -> lease -> OpenBao -> docker compose -> report,
over the OpenZiti mesh with the box's own host identity.
vendor: Tikali
homepage: https://scm.tikali.ai/tikali/applications/monky/monky-deployd
license: Proprietary
depends:
- python3 (>= 3.12)
- acl
- ca-certificates
recommends:
- docker-compose-plugin
- ziti-edge-tunnel
contents:
- src: ./build/venv
dst: /opt/monky-deployd/venv
- src: ./packaging/bin/monky-deployd
dst: /usr/bin/monky-deployd
file_info: { mode: 0755 }
- src: ./packaging/systemd/monky-deployd.service
dst: /usr/lib/systemd/system/monky-deployd.service
- src: ./packaging/systemd/monky-deployd.timer
dst: /usr/lib/systemd/system/monky-deployd.timer
- src: ./packaging/systemd/monky-deployd-proxy.service
dst: /usr/lib/systemd/system/monky-deployd-proxy.service
- src: ./packaging/monky-deployd.sysusers
dst: /usr/lib/sysusers.d/monky-deployd.conf
- src: ./packaging/monky-deployd.tmpfiles
dst: /usr/lib/tmpfiles.d/monky-deployd.conf
- src: ./config.example.yaml
dst: /etc/monky-deployd/config.example.yaml
type: config
- src: ./packaging/install.sh
dst: /usr/share/monky-deployd/install.sh
file_info: { mode: 0755 }
- src: ./README.md
dst: /usr/share/doc/monky-deployd/README.md
- src: ./docs/OPERATIONS.md
dst: /usr/share/doc/monky-deployd/OPERATIONS.md
scripts:
postinstall: ./packaging/scripts/postinstall.sh
preremove: ./packaging/scripts/preremove.sh
postremove: ./packaging/scripts/postremove.sh