mirror of
https://scm.tikali.ai/tikali/applications/monky/monky-deployd.git
synced 2026-09-18 08:36:15 +00:00
mdella
1c42e913a8
Stdlib-only Python 3.12 agent for docker VMs and laptops: flock → checkin
(bearer = the agent's OpenBao token, bootstrapped from the install kit's
jwt-tenancy deploy grant) → action apply|none|down → bundle (sha256
verified) → refusal checks (unresolved ${VAR} names only, manifest paths
pinned to monky/data/<env>/see/, privileged/host-network, rollback, disk
need×1.5+headroom) → lease → POST /v1/auth/jwt-tenancy/login → KV reads →
.env 0600 → promote → compose pull/up → wait healthy → report; finally
renew-self / re-lease before max TTL, scrub. Exit 0/75/78/1. Redactor log
filter. Transports sdk (openziti) / proxy (ziti tunnel proxy 18443/18200) /
system. Laptop mode.
Packaging: hardened oneshot + 60 s timer + proxy unit, nfpm .deb with
/opt/monky-deployd/venv, install.sh for Ubuntu 26.04 (Gitea release
download, enrol, ACLs, bootstrap from stdin), ansible role skeleton for
osg1-07. CI: lint/test on every change; wheel (openziti on ubuntu:26.04) and
package (nfpm) allow_failure until runner egress is proven; GitLab release +
release:gitea on v* tags. Docs: README, PROTOCOL, OPERATIONS, CHANGELOG,
CLAUDE/AGENTS.
Divergence noted: monky-tenancy main (MR !15) still ships the AppRole lease
and kit; this agent implements the plan's Gate 1 RESULT (login_jwt, no
unwrap) and refuses an AppRole lease loudly (LEASE_SHAPE).
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KLB7jieMNRkTsJ2epr4Ds1
23 lines
1.1 KiB
Bash
Executable File
23 lines
1.1 KiB
Bash
Executable File
#!/bin/sh
|
|
set -e
|
|
# service account + dirs
|
|
if command -v systemd-sysusers >/dev/null 2>&1; then
|
|
systemd-sysusers /usr/lib/sysusers.d/monky-deployd.conf || true
|
|
else
|
|
getent passwd monky-deployd >/dev/null || useradd --system --home-dir /var/lib/monky-deployd --shell /usr/sbin/nologin monky-deployd
|
|
fi
|
|
if command -v systemd-tmpfiles >/dev/null 2>&1; then
|
|
systemd-tmpfiles --create /usr/lib/tmpfiles.d/monky-deployd.conf || true
|
|
fi
|
|
install -d -m 0700 -o monky-deployd -g monky-deployd /var/lib/monky-deployd
|
|
install -d -m 0750 -o root -g monky-deployd /etc/monky-deployd
|
|
# the agent drives docker compose: docker group membership (no root)
|
|
if getent group docker >/dev/null; then usermod -a -G docker monky-deployd || true; fi
|
|
# the venv is relocatable only to the path it was built at; refuse a broken interpreter early
|
|
/opt/monky-deployd/venv/bin/python -c 'import monky_deployd' || { echo "monky-deployd: venv unusable (python3 mismatch?)" >&2; exit 1; }
|
|
if [ -d /run/systemd/system ]; then
|
|
systemctl daemon-reload || true
|
|
# do NOT enable the timer here: install.sh / the ansible role do it after the config exists
|
|
fi
|
|
exit 0
|