mirror of
https://scm.tikali.ai/tikali/applications/monky/monky-deployd.git
synced 2026-09-18 04:36:15 +00:00
mdella
1c42e913a8
Stdlib-only Python 3.12 agent for docker VMs and laptops: flock → checkin
(bearer = the agent's OpenBao token, bootstrapped from the install kit's
jwt-tenancy deploy grant) → action apply|none|down → bundle (sha256
verified) → refusal checks (unresolved ${VAR} names only, manifest paths
pinned to monky/data/<env>/see/, privileged/host-network, rollback, disk
need×1.5+headroom) → lease → POST /v1/auth/jwt-tenancy/login → KV reads →
.env 0600 → promote → compose pull/up → wait healthy → report; finally
renew-self / re-lease before max TTL, scrub. Exit 0/75/78/1. Redactor log
filter. Transports sdk (openziti) / proxy (ziti tunnel proxy 18443/18200) /
system. Laptop mode.
Packaging: hardened oneshot + 60 s timer + proxy unit, nfpm .deb with
/opt/monky-deployd/venv, install.sh for Ubuntu 26.04 (Gitea release
download, enrol, ACLs, bootstrap from stdin), ansible role skeleton for
osg1-07. CI: lint/test on every change; wheel (openziti on ubuntu:26.04) and
package (nfpm) allow_failure until runner egress is proven; GitLab release +
release:gitea on v* tags. Docs: README, PROTOCOL, OPERATIONS, CHANGELOG,
CLAUDE/AGENTS.
Divergence noted: monky-tenancy main (MR !15) still ships the AppRole lease
and kit; this agent implements the plan's Gate 1 RESULT (login_jwt, no
unwrap) and refuses an AppRole lease loudly (LEASE_SHAPE).
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KLB7jieMNRkTsJ2epr4Ds1
47 lines
3.1 KiB
YAML
47 lines
3.1 KiB
YAML
# /etc/monky-deployd/config.yaml — monky-deployd v0.1.0 (MONKY-ADR-0028 §D)
|
|
# Written by packaging/install.sh (or the ansible role monky_deployd). YAML *subset*: maps, scalars,
|
|
# simple lists, comments. Keys not listed here are a config error.
|
|
|
|
env_id: env-qa-02 # env-<tier>-<nn> (or a grandfathered legacy id); MUST match the token's env
|
|
site: cbs # cbs | pdx (lowercase DC code)
|
|
transport: sdk # sdk (OpenZiti Python SDK, default) | proxy (monky-deployd-proxy.service) | system (tunneler `run` mode / plain DNS)
|
|
identity: /opt/openziti/etc/identities/monky-host.env-qa-02.json # the box's host identity (read via ACL)
|
|
|
|
tenancy:
|
|
service: monky.tenancy.deploy # ziti service bound by the tenancy sidecar -> 127.0.0.1:8081 (agent entrypoint)
|
|
host: monky.tenancy.deploy # intercept host (sdk/system); defaults to `service`
|
|
port: 8081
|
|
scheme: http # plain HTTP inside the mesh; the mesh is the transport security
|
|
proxy_addr: 127.0.0.1:18443 # transport: proxy
|
|
timeout_s: 30
|
|
|
|
bao:
|
|
service: openbao # ziti service (#openbao-client dial), terminates on openbao-active
|
|
addr: https://bao.cbs.tikali.net:8200 # intercept name — NOT public DNS; TLS validated against ca_bundle
|
|
proxy_addr: 127.0.0.1:18200 # transport: proxy (SNI + cert check still use bao.cbs.tikali.net)
|
|
ca_bundle: /etc/monky-deployd/openbao-ca.pem # the openbao-ca certificate (cert-manager CA, not public); `none` = system store
|
|
mount: jwt-tenancy # AUTH mount: POST /v1/auth/jwt-tenancy/login {"role": "see-env", "jwt": <deploy grant>}
|
|
role: see-env
|
|
kv_mount: monky # KV-v2 mount; the agent may read monky/data/<env_id>/see/* only
|
|
token_max_ttl_s: 2592000 # 30 d — re-lease `release_before_s` before this age
|
|
renew_below_s: 43200 # renew-self when the remaining TTL drops under 12 h
|
|
release_before_s: 172800 # re-lease 2 d before max TTL
|
|
timeout_s: 30
|
|
|
|
state_dir: /var/lib/monky-deployd # bao.token (0600), state.json, lock
|
|
deploy_dir: /var/lib/monky-deployd/env-qa-02 # releases/<sha>/ + current -> the compose project directory
|
|
bootstrap_path: /etc/monky-deployd/bootstrap.jwt # the kit's one-time deploy grant; consumed and deleted on first login
|
|
interval_s: 60 # loop-mode sleep (the systemd timer is the normal driver)
|
|
healthy_timeout_s: 300 # wait for `compose ps` to be healthy after `up`
|
|
|
|
disk:
|
|
factor: 1.5 # refuse when docker data-root free < need x factor + headroom (the env-dev-09 lesson)
|
|
headroom_bytes: 2147483648 # 2 GiB
|
|
|
|
volumes_on_absent: keep # keep | purge — what `down` does with data volumes (never purge on prod)
|
|
laptop_mode: false # true: offline exits 0 quietly; run without the timer (`monky-deployd run`)
|
|
# prod: false # override tier detection (env-prod-* / prod-cedar are prod)
|
|
# compose_project: monky-env-qa-02 # docker compose project name
|
|
# docker_bin: docker
|
|
# log_level: INFO
|