mirror of
https://scm.tikali.ai/tikali/applications/monky/monky-deployd.git
synced 2026-09-18 05:36:15 +00:00
mdella
c966450d8e
Inside the estate gitea.cbs.tikali.net resolves to jump1's RED EIP (10.10.0.175), which has no HTTP ingress, so backend boxes could not download the install artefacts from the Gitea mirror (cbs/iac#102). scm.tikali.ai is reachable from those boxes and the project is now public, so the GitLab generic package registry becomes the PRIMARY source: - packaging/install.sh: default source = scm.tikali.ai generic package registry (projects/69/packages/generic/monky-deployd/<ver>/...); `--source gitea` / MONKY_DEPLOYD_SOURCE=gitea keeps the Gitea release as the off-estate alternative; --base-url / MONKY_DEPLOYD_BASE_URL still override the base. - ansible role defaults: monky_deployd_base_url/_deb_url point at the registry, Gitea layout kept as a commented alternative. - README / docs/OPERATIONS.md / CLAUDE.md / CI comments + release description: both locations keep being published (release + release:gitea). - Version 0.1.1 (the tag gate refuses v* tags whose version != __version__); tests compare against __version__ instead of a literal. No agent change. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01KLB7jieMNRkTsJ2epr4Ds1
31 lines
2.1 KiB
Markdown
31 lines
2.1 KiB
Markdown
<!-- xlate:verbatim-fences -->
|
||
# Changelog
|
||
|
||
## v0.1.1 — 2026-09-05
|
||
|
||
- `install.sh` / ansible role / README: the **primary download is the public GitLab project's generic
|
||
package registry on scm.tikali.ai** (`/api/v4/projects/69/packages/generic/monky-deployd/<ver>/…`);
|
||
the one-liner fetches the script from `scm.tikali.ai/…/-/raw/main/packaging/install.sh`. Inside the
|
||
estate `gitea.cbs.tikali.net` is split-horizon to jump1's RED EIP (no HTTP ingress), so backend
|
||
boxes could not fetch the artefacts (cbs/iac#102). The Gitea release stays the off-estate
|
||
alternative (`--source gitea` / `MONKY_DEPLOYD_SOURCE=gitea`). No agent behaviour change.
|
||
|
||
## v0.1.0 — 2026-09-05
|
||
|
||
First release (MONKY-ADR-0028 §D, Reconciliation v2, Gate 1 v2).
|
||
|
||
- Stdlib-only Python 3.12 agent: `run --once|loop`, `status`, `bootstrap`, `--prune`.
|
||
- Protocol: `POST /v1/agent/checkin` (`action apply|none|down`), `GET /v1/agent/bundle/{env}/{sha}`
|
||
(sha256 verified), `POST /v1/agent/lease` → **deploy grant** (`login_jwt`), `POST /v1/agent/report`
|
||
(`result applied|failed|down`, redacted `log_tail`). An AppRole-shaped lease is refused (`LEASE_SHAPE`).
|
||
- OpenBao: `POST /v1/auth/jwt-tenancy/login {"role":"see-env","jwt":…}`; KV-v2 reads pinned to the
|
||
manifest's versions, paths pinned to `monky/data/<env>/see/`; renew-self / re-lease before max TTL.
|
||
- Refusals: `ENV_INCOMPLETE` (names only), `PRIVILEGED_REFUSED`, `ROLLBACK_REFUSED`, `DISK_INSUFFICIENT`
|
||
(`need × 1.5 + 2 GiB` vs docker data-root), `BUNDLE_SHA_MISMATCH`, `BUNDLE_ENV_MISMATCH`.
|
||
- Transports `sdk` (openziti SDK), `proxy` (`ziti tunnel proxy` 18443/18200), `system`.
|
||
- Exit codes 0 / 75 / 78 (`AGENT_ENV_MISMATCH`, no retry storm) / 1; laptop mode (offline exits 0).
|
||
- Packaging: hardened `monky-deployd.service` oneshot + 60 s timer, `monky-deployd-proxy.service`,
|
||
`nfpm` `.deb` with `/opt/monky-deployd/venv`, `packaging/install.sh` (Ubuntu 26.04), ansible role skeleton.
|
||
- Known divergence: monky-tenancy `main` (MR !15) still ships the AppRole lease/kit; the JWT-grant
|
||
follow-up is the tenancy side of this release (docs/PROTOCOL.md "Divergences").
|