mirror of
https://scm.tikali.ai/tikali/applications/monky/monky-deployd.git
synced 2026-09-18 06:36:16 +00:00
mdella
1c42e913a8
Stdlib-only Python 3.12 agent for docker VMs and laptops: flock → checkin
(bearer = the agent's OpenBao token, bootstrapped from the install kit's
jwt-tenancy deploy grant) → action apply|none|down → bundle (sha256
verified) → refusal checks (unresolved ${VAR} names only, manifest paths
pinned to monky/data/<env>/see/, privileged/host-network, rollback, disk
need×1.5+headroom) → lease → POST /v1/auth/jwt-tenancy/login → KV reads →
.env 0600 → promote → compose pull/up → wait healthy → report; finally
renew-self / re-lease before max TTL, scrub. Exit 0/75/78/1. Redactor log
filter. Transports sdk (openziti) / proxy (ziti tunnel proxy 18443/18200) /
system. Laptop mode.
Packaging: hardened oneshot + 60 s timer + proxy unit, nfpm .deb with
/opt/monky-deployd/venv, install.sh for Ubuntu 26.04 (Gitea release
download, enrol, ACLs, bootstrap from stdin), ansible role skeleton for
osg1-07. CI: lint/test on every change; wheel (openziti on ubuntu:26.04) and
package (nfpm) allow_failure until runner egress is proven; GitLab release +
release:gitea on v* tags. Docs: README, PROTOCOL, OPERATIONS, CHANGELOG,
CLAUDE/AGENTS.
Divergence noted: monky-tenancy main (MR !15) still ships the AppRole lease
and kit; this agent implements the plan's Gate 1 RESULT (login_jwt, no
unwrap) and refuses an AppRole lease loudly (LEASE_SHAPE).
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KLB7jieMNRkTsJ2epr4Ds1
54 lines
2.0 KiB
YAML
54 lines
2.0 KiB
YAML
# nfpm (https://nfpm.goreleaser.com) — builds monky-deployd_<ver>_amd64.deb in CI (`package` job).
|
|
# The venv under /opt/monky-deployd/venv is created by CI on ubuntu:26.04 with the system
|
|
# python3 (3.14 on 26.04; the agent needs >= 3.12) and the vendored openziti wheel when present.
|
|
name: monky-deployd
|
|
arch: amd64
|
|
platform: linux
|
|
version: ${VERSION}
|
|
section: admin
|
|
priority: optional
|
|
maintainer: Tikali <mdella@tikali.ai>
|
|
description: |
|
|
Monky backend pull agent (MONKY-ADR-0028): checkin -> bundle -> lease -> OpenBao -> docker compose -> report,
|
|
over the OpenZiti mesh with the box's own host identity.
|
|
vendor: Tikali
|
|
homepage: https://scm.tikali.ai/tikali/applications/monky/monky-deployd
|
|
license: Proprietary
|
|
depends:
|
|
- python3 (>= 3.12)
|
|
- acl
|
|
- ca-certificates
|
|
recommends:
|
|
- docker-compose-plugin
|
|
- ziti-edge-tunnel
|
|
contents:
|
|
- src: ./build/venv
|
|
dst: /opt/monky-deployd/venv
|
|
- src: ./packaging/bin/monky-deployd
|
|
dst: /usr/bin/monky-deployd
|
|
file_info: { mode: 0755 }
|
|
- src: ./packaging/systemd/monky-deployd.service
|
|
dst: /usr/lib/systemd/system/monky-deployd.service
|
|
- src: ./packaging/systemd/monky-deployd.timer
|
|
dst: /usr/lib/systemd/system/monky-deployd.timer
|
|
- src: ./packaging/systemd/monky-deployd-proxy.service
|
|
dst: /usr/lib/systemd/system/monky-deployd-proxy.service
|
|
- src: ./packaging/monky-deployd.sysusers
|
|
dst: /usr/lib/sysusers.d/monky-deployd.conf
|
|
- src: ./packaging/monky-deployd.tmpfiles
|
|
dst: /usr/lib/tmpfiles.d/monky-deployd.conf
|
|
- src: ./config.example.yaml
|
|
dst: /etc/monky-deployd/config.example.yaml
|
|
type: config
|
|
- src: ./packaging/install.sh
|
|
dst: /usr/share/monky-deployd/install.sh
|
|
file_info: { mode: 0755 }
|
|
- src: ./README.md
|
|
dst: /usr/share/doc/monky-deployd/README.md
|
|
- src: ./docs/OPERATIONS.md
|
|
dst: /usr/share/doc/monky-deployd/OPERATIONS.md
|
|
scripts:
|
|
postinstall: ./packaging/scripts/postinstall.sh
|
|
preremove: ./packaging/scripts/preremove.sh
|
|
postremove: ./packaging/scripts/postremove.sh
|