olsitec/foundation
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(bootstrap): rustfs S3 data-plane + buckets/service account (T04)

Browse source 
foundation-rustfs (rustfs/rustfs digest-pinned) on foundation-net, internal only
(9000/9001 unpublished); named volume foundation-rustfs-data with retainOnDelete.
The four buckets (forgejo-packages/-artifacts/-lfs, foundation-backups) and a
scoped service account with generated keys (CONTRACT_002 rustfs slice) are
provisioned post-boot by an idempotent, readiness-gated remote.Command using a
throwaway mc container (ADR-007). RustFS speaks enough MinIO admin API for
`svcacct add`; `mc ready` is unreliable so readiness gates on `mc ls`; the mc
image's busybox lacks grep so existence checks use a shell `case`. Pins the
IMAGE_MC tool image in VERSIONS.

Live on cx33 Helsinki: 4 buckets present, service key registered, put/get
roundtrip OK, no published ports. Acceptance T04 met.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This commit is contained in:
Andreas Niemann 2026-06-30 21:19:53 +02:00
parent 6edba60612
commit 1792fd9f89
4 changed files with 147 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

15
bootstrap/components/credentials.ts
View file

@ -24,9 +24,18 @@ export interface PostgresCredentials {
forgejoDbPassword: pulumi.Output<string>;
}
/** `foundation/rustfs/service-credentials` (CONTRACT_002 §2.3). */
export interface RustfsCredentials {
adminUser: string; // "rustfsadmin" — root access key name (deterministic)
adminPassword: pulumi.Output<string>; // root secret key (RUSTFS_SECRET_KEY)
serviceKeyId: pulumi.Output<string>; // scoped S3 key Forgejo/backup use
serviceKeySecret: pulumi.Output<string>;
}
/** Everything generateCredentials() produces; grows as Wave-2 tasks land. */
export interface FoundationCredentials {
postgres: PostgresCredentials;
rustfs: RustfsCredentials;
}
/**
@ -46,5 +55,11 @@ export function generateCredentials(ctx: DeployCtx): FoundationCredentials {
forgejoDbUser: "forgejo",
forgejoDbPassword: secret("forgejo-db-password"),
},
rustfs: {
adminUser: "rustfsadmin",
adminPassword: secret("rustfs-admin-password"),
serviceKeyId: secret("rustfs-service-key-id", 20), // S3 access-key id
serviceKeySecret: secret("rustfs-service-key-secret", 40), // S3 secret
},
};
}