olsitec/foundation
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(bootstrap): rustfs S3 data-plane + buckets/service account (T04)

Browse source 
foundation-rustfs (rustfs/rustfs digest-pinned) on foundation-net, internal only
(9000/9001 unpublished); named volume foundation-rustfs-data with retainOnDelete.
The four buckets (forgejo-packages/-artifacts/-lfs, foundation-backups) and a
scoped service account with generated keys (CONTRACT_002 rustfs slice) are
provisioned post-boot by an idempotent, readiness-gated remote.Command using a
throwaway mc container (ADR-007). RustFS speaks enough MinIO admin API for
`svcacct add`; `mc ready` is unreliable so readiness gates on `mc ls`; the mc
image's busybox lacks grep so existence checks use a shell `case`. Pins the
IMAGE_MC tool image in VERSIONS.

Live on cx33 Helsinki: 4 buckets present, service key registered, put/get
roundtrip OK, no published ports. Acceptance T04 met.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This commit is contained in:
Andreas Niemann 2026-06-30 21:19:53 +02:00
parent 6edba60612
commit 1792fd9f89
4 changed files with 147 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

8
bootstrap/index.ts
View file

@ -11,6 +11,7 @@ import { deployNetwork } from "./components/network";
import { deployDns } from "./components/dns";
import { generateCredentials } from "./components/credentials";
import { deployPostgres } from "./components/postgres";
import { deployRustfs } from "./components/rustfs";
const cfg = loadConfig();
@ -28,10 +29,10 @@ const credentials = generateCredentials(ctx);
// =============================================================================
// PHASE 3 — DATA PLANE (depends on: network)
// T03 postgres ✓ · T04 rustfs · T05 vault (sealed)
// T03 postgres ✓ · T04 rustfs ✓ · T05 vault (sealed)
// -----------------------------------------------------------------------------
const postgres = deployPostgres(ctx, credentials.postgres);
// const rustfs = deployRustfs(ctx, credentials.rustfs);
const rustfs = deployRustfs(ctx, credentials.rustfs);
// const vault = deployVault(ctx);
//
// --- GATE A: Vault init + unseal (T05) → writes unseal keys to encrypted config;
@ -49,10 +50,11 @@ const postgres = deployPostgres(ctx, credentials.postgres);
// =============================================================================
// Stack outputs (extended as phases land).
export const phase = "T03-postgres"; // network + DNS + data-plane: postgres
export const phase = "T04-rustfs"; // network + DNS + data-plane: postgres, rustfs
export const networkName = network.name;
export const vmTarget = `${cfg.vm.user}@${cfg.vm.host}`;
export const postgresEndpoint = postgres.endpoint;
export const rustfsEndpoint = rustfs.endpoint;
export const enabledFeatures = Object.entries(cfg.features)
.filter(([, on]) => on)
.map(([name]) => name);