olsitec/foundation
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
foundation/package.json

17 lines
475 B
JSON
Raw Normal View History

feat(bootstrap): Bun-workspace skeleton + typed config + vendored modules — T02 - Bun workspaces (packages/* + bootstrap); Pulumi nodejs runtime under packagemanager: bun (no npm fallback needed). - bootstrap/config.ts: typed FoundationConfig per CONTRACT_001; loadConfig() fails closed, aggregating all missing+malformed keys in one error. Reads flat dotted keys; image digests excluded (they live in VERSIONS, D5). - bootstrap/Pulumi.foundation.yaml: non-secret placeholders only (RFC-5737 vm.host, .invalid offsite); no encryptionsalt/secrets committed (D2). pulumi preview = 0 resources under the passphrase provider via gitignored file:// state backend. - Stage-1 vendoring: packages/pulumi-{docker,vault} as @olsitec/* (source-only, logic unchanged). vault's 5 type-only imports from modules/olsitec re-homed verbatim into pulumi-vault/olsitec-types.ts to keep the egg self-contained. Realizes PLAN-002 §10 T02; ADR-005 / 000_TOPOLOGY.md §5 Stage-1. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
2026-06-30 18:06:21 +02:00
{
"name": "@olsitec/foundation",
"private": true,
"version": "0.0.0",
"description": "olsitec-foundation mono-repo — the bootstrap egg (bootstrap/) + vendored shared Pulumi modules (packages/*). One git clone = the full DR unit (000_TOPOLOGY.md, ADR-005).",
"workspaces": [
"packages/*",
feat(provision): Phase-0 throwaway test VM via vendored @olsitec/pulumi-hetzner - Vendor hetzner module (Stage-1, trimmed to @pulumi/hcloud+js-yaml; dropped unused types.ts + bcrypt/axios/tls/vault deps). GOTCHA documented: cloud-init moves SSH to port 222. - provision/: isolated stack (platformName foundation-test, no collision with olsicloud4-*) — one cx23 in nbg1-dc3 + firewall (222/80/443/2222) + Docker cloud-init. Dedicated throwaway ed25519 key (operator id_rsa already registered → uniqueness_error). - Provisioned + verified: foundation-test @ 91.98.117.152, Docker 29.6.1, docker-over-SSH OK. Token via ENV (pass), never committed; provision/state gitignored. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
2026-06-30 18:57:54 +02:00
"bootstrap",
feat(offsite-backup): olsitec-foundation bucket + scoped creds on home MinIO CONTRACT_004 offsite target (ADR-004 'second self-hosted location'). @pulumi/minio program (modeled on olsicloud4 modules/minio): bucket 'olsitec-foundation' + scoped IAM user/policy + service account on minio.wob.olsitec.de:19000. Verified: scoped SA can put/list/delete in its bucket, DENIED cross-bucket. Admin creds + scoped creds via ENV/state only (gitignored), never committed. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
2026-06-30 20:34:55 +02:00
"provision",
feat(runners): decoupled Pulumi stack for the fenced runner fleet (R5) A separate, isolated Pulumi project (peer to bootstrap/provision/offsite-backup) that provisions runner VM(s) on a libvirt host and registers Forgejo Actions runners with a distinct `fenced` label — so ecosystem/untrusted jobs run OFF the forge VM. Decoupled ON PURPOSE: a @pulumi/libvirt provider dials the runner host on every up/refresh, so keeping it in `bootstrap` would make the foundation undeployable/ unrefreshable whenever the host (crunchy01) is down or unreachable (the Terraform coupling trap). As its own stack, bootstrap never imports it — foundation ops never touch crunchy01, and this stack's health is independent. One-way dependency: it mints a runner token FROM the forge, i.e. runs after the foundation stands. Codifies what was built + hardened by hand this session (runners/README.md): Ubuntu VM on the LAN bridge (docker + qemu-guest-agent via cloud-init), the kube-router-proof FORWARD timer, and runner registration. Typechecked; the live `pulumi up` cutover from the hand-built VM is the remaining validation step. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
2026-07-01 03:15:39 +02:00
"offsite-backup",
"runners"
feat(bootstrap): Bun-workspace skeleton + typed config + vendored modules — T02 - Bun workspaces (packages/* + bootstrap); Pulumi nodejs runtime under packagemanager: bun (no npm fallback needed). - bootstrap/config.ts: typed FoundationConfig per CONTRACT_001; loadConfig() fails closed, aggregating all missing+malformed keys in one error. Reads flat dotted keys; image digests excluded (they live in VERSIONS, D5). - bootstrap/Pulumi.foundation.yaml: non-secret placeholders only (RFC-5737 vm.host, .invalid offsite); no encryptionsalt/secrets committed (D2). pulumi preview = 0 resources under the passphrase provider via gitignored file:// state backend. - Stage-1 vendoring: packages/pulumi-{docker,vault} as @olsitec/* (source-only, logic unchanged). vault's 5 type-only imports from modules/olsitec re-homed verbatim into pulumi-vault/olsitec-types.ts to keep the egg self-contained. Realizes PLAN-002 §10 T02; ADR-005 / 000_TOPOLOGY.md §5 Stage-1. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
2026-06-30 18:06:21 +02:00
],
"devDependencies": {
"typescript": "^5.0.0"
}
}
Reference in a new issue Copy permalink