monky-deployd

mdella/monky-deployd

Fork 0

mirror of https://scm.tikali.ai/tikali/applications/monky/monky-deployd.git synced 2026-09-18 04:36:15 +00:00

Commit Graph

Author	SHA1	Message	Date
mdella	037782e1ff	fix: accept sites fmt\|cbs\|pdx\|roam (tenancy 0.7.x) and keep the identity read grant alive across tunneller rewrites — 0.1.10 deployd#3 (DD-0620): every kit for a backend registered since 2026-09-08 died at `--site`. env-dev-08 (2026-09-11..13): two days of "identity is not readable" ticks — ziti-edge-tunnel re-creates the file with mode 0600, the ACL mask goes to ---, group membership stops helping. identity-acl.sh + monky-deployd-identity-acl.path re-apply the grant on every directory change. Doc-Drift: DD-0620 fixed Closes #3 Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01ASnneBmT7rfaJLE8NGNw7S	2026-09-13 00:17:35 +00:00
mdella	1c42e913a8	feat: monky-deployd v0.1.0 — pull agent over the mesh (ADR-0028) Stdlib-only Python 3.12 agent for docker VMs and laptops: flock → checkin (bearer = the agent's OpenBao token, bootstrapped from the install kit's jwt-tenancy deploy grant) → action apply\|none\|down → bundle (sha256 verified) → refusal checks (unresolved ${VAR} names only, manifest paths pinned to monky/data/<env>/see/, privileged/host-network, rollback, disk need×1.5+headroom) → lease → POST /v1/auth/jwt-tenancy/login → KV reads → .env 0600 → promote → compose pull/up → wait healthy → report; finally renew-self / re-lease before max TTL, scrub. Exit 0/75/78/1. Redactor log filter. Transports sdk (openziti) / proxy (ziti tunnel proxy 18443/18200) / system. Laptop mode. Packaging: hardened oneshot + 60 s timer + proxy unit, nfpm .deb with /opt/monky-deployd/venv, install.sh for Ubuntu 26.04 (Gitea release download, enrol, ACLs, bootstrap from stdin), ansible role skeleton for osg1-07. CI: lint/test on every change; wheel (openziti on ubuntu:26.04) and package (nfpm) allow_failure until runner egress is proven; GitLab release + release:gitea on v* tags. Docs: README, PROTOCOL, OPERATIONS, CHANGELOG, CLAUDE/AGENTS. Divergence noted: monky-tenancy main (MR !15) still ships the AppRole lease and kit; this agent implements the plan's Gate 1 RESULT (login_jwt, no unwrap) and refuses an AppRole lease loudly (LEASE_SHAPE). Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01KLB7jieMNRkTsJ2epr4Ds1	2026-09-05 08:01:36 +00:00

Author

SHA1

Message

Date

mdella

037782e1ff

fix: accept sites fmt|cbs|pdx|roam (tenancy 0.7.x) and keep the identity read grant alive across tunneller rewrites — 0.1.10

deployd#3 (DD-0620): every kit for a backend registered since 2026-09-08 died at `--site`.
env-dev-08 (2026-09-11..13): two days of "identity is not readable" ticks — ziti-edge-tunnel
re-creates the file with mode 0600, the ACL mask goes to ---, group membership stops helping.
identity-acl.sh + monky-deployd-identity-acl.path re-apply the grant on every directory change.

Doc-Drift: DD-0620 fixed
Closes #3

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01ASnneBmT7rfaJLE8NGNw7S

2026-09-13 00:17:35 +00:00

mdella

1c42e913a8

feat: monky-deployd v0.1.0 — pull agent over the mesh (ADR-0028)

Stdlib-only Python 3.12 agent for docker VMs and laptops: flock → checkin
(bearer = the agent's OpenBao token, bootstrapped from the install kit's
jwt-tenancy deploy grant) → action apply|none|down → bundle (sha256
verified) → refusal checks (unresolved ${VAR} names only, manifest paths
pinned to monky/data/<env>/see/, privileged/host-network, rollback, disk
need×1.5+headroom) → lease → POST /v1/auth/jwt-tenancy/login → KV reads →
.env 0600 → promote → compose pull/up → wait healthy → report; finally
renew-self / re-lease before max TTL, scrub. Exit 0/75/78/1. Redactor log
filter. Transports sdk (openziti) / proxy (ziti tunnel proxy 18443/18200) /
system. Laptop mode.

Packaging: hardened oneshot + 60 s timer + proxy unit, nfpm .deb with
/opt/monky-deployd/venv, install.sh for Ubuntu 26.04 (Gitea release
download, enrol, ACLs, bootstrap from stdin), ansible role skeleton for
osg1-07. CI: lint/test on every change; wheel (openziti on ubuntu:26.04) and
package (nfpm) allow_failure until runner egress is proven; GitLab release +
release:gitea on v* tags. Docs: README, PROTOCOL, OPERATIONS, CHANGELOG,
CLAUDE/AGENTS.

Divergence noted: monky-tenancy main (MR !15) still ships the AppRole lease
and kit; this agent implements the plan's Gate 1 RESULT (login_jwt, no
unwrap) and refuses an AppRole lease loudly (LEASE_SHAPE).

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KLB7jieMNRkTsJ2epr4Ds1

2026-09-05 08:01:36 +00:00

2 Commits