Andreas Niemann
6edba60612
foundation-postgres (postgres:17, digest-pinned in VERSIONS) on foundation-net, internal only (5432 unpublished); named volume foundation-postgres-data with retainOnDelete. The forgejo login role + database are created post-boot by an idempotent, readiness-gated remote.Command (ADR-007), since 5432 isn't reachable from the operator. Adds the generator half of credentials.ts (@pulumi/random → CONTRACT_002 postgres keys) and lib/remote.ts (vmConnection over the VM SSH path). Live on cx33 Helsinki: container healthy, role 'forgejo' + db 'forgejo' present, no published ports. Acceptance T03 met. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
104 lines
4.8 KiB
Text
104 lines
4.8 KiB
Text
# shellcheck shell=sh disable=SC2034
|
|
# =============================================================================
|
|
# foundation/VERSIONS — determinism pin-file (PLAN-002 §Determinism, baseline D5)
|
|
# =============================================================================
|
|
#
|
|
# WHAT THIS IS
|
|
# The single source of truth for every container image and every host tool the
|
|
# foundation egg depends on. preflight/ and CI both read this file. An upgrade
|
|
# is a one-line diff here (PLAN-002 §7.1).
|
|
#
|
|
# FORMAT
|
|
# Plain `KEY=value`, one per line. This file is BOTH:
|
|
# * shell-`source`-able: `set -a; . ./VERSIONS; set +a`
|
|
# * greppable: `grep '^IMAGE_FORGEJO=' VERSIONS`
|
|
# No spaces around `=`. Values are unquoted simple tokens. Comments start `#`.
|
|
# Keys are UPPER_SNAKE_CASE. Do not use shell expansion in values.
|
|
#
|
|
# IMAGE PINNING (determinism — D5: "No floating tags")
|
|
# The DESIRED end state is to pin every image by DIGEST:
|
|
# IMAGE_<svc>=<repo>:<tag>@sha256:<64-hex-digest>
|
|
# A tag alone is mutable; the digest is the immutable content address.
|
|
#
|
|
# Where a real sha256 digest could NOT be resolved at authoring time (offline /
|
|
# no registry access), the value carries the stable version TAG plus the literal
|
|
# placeholder token `PIN_DIGEST` in the digest position:
|
|
# IMAGE_<svc>=<repo>:<tag>@sha256:PIN_DIGEST
|
|
# preflight treats `PIN_DIGEST` as "not yet pinned" and emits a WARNING (not a
|
|
# failure) so the scaffold is usable before digests are resolved. CI for a real
|
|
# `pulumi up` SHOULD fail-closed on any remaining PIN_DIGEST (gate that later).
|
|
#
|
|
# HOW TO PIN A DIGEST (`pin-digests` procedure — run when online, per image)
|
|
# For each IMAGE_* below, resolve the multi-arch (or linux/amd64) digest and
|
|
# replace `PIN_DIGEST` with the real hex, e.g.:
|
|
#
|
|
# # whole image index digest (recommended — arch-independent):
|
|
# docker manifest inspect caddy:2.10 \
|
|
# --verbose 2>/dev/null | jq -r '.[0].Descriptor.digest // .Descriptor.digest' | head -1
|
|
#
|
|
# # OR, simpler, pull then read the repo digest docker recorded:
|
|
# docker pull caddy:2.10
|
|
# docker inspect --format '{{index .RepoDigests 0}}' caddy:2.10
|
|
# # -> caddy@sha256:<digest> ; copy the <digest> after sha256:
|
|
#
|
|
# # OR with skopeo (no pull):
|
|
# skopeo inspect docker://caddy:2.10 | jq -r '.Digest'
|
|
#
|
|
# Then set: IMAGE_CADDY=caddy:2.10@sha256:<the-real-digest>
|
|
# Commit the VERSIONS diff (conventional commit, e.g. `chore(versions): pin caddy digest`).
|
|
#
|
|
# HOST TOOL VERSIONS are MINIMUMS (>=). preflight compares the installed tool
|
|
# version against TOOL_<x>_MIN using a numeric dotted-version comparison.
|
|
# =============================================================================
|
|
|
|
|
|
# -----------------------------------------------------------------------------
|
|
# CONTAINER IMAGES (CONTRACT_003 §3.2 — every container the egg runs)
|
|
# Format: IMAGE_<NAME>=<repo>:<tag>@sha256:<digest|PIN_DIGEST>
|
|
# -----------------------------------------------------------------------------
|
|
IMAGE_CADDY=caddy:2.10@sha256:PIN_DIGEST
|
|
IMAGE_FORGEJO=codeberg.org/forgejo/forgejo:11@sha256:PIN_DIGEST
|
|
IMAGE_POSTGRES=postgres:17@sha256:5c855ad7b85e68e48a62f34662853f38b57c1c1d80f3a927ab58034fd6d31c5e
|
|
IMAGE_VAULT=hashicorp/vault:1.18@sha256:PIN_DIGEST
|
|
IMAGE_RUSTFS=rustfs/rustfs:latest@sha256:PIN_DIGEST
|
|
IMAGE_ACT_RUNNER=code.forgejo.org/forgejo/runner:6@sha256:PIN_DIGEST
|
|
IMAGE_REGISTRY=registry:2@sha256:PIN_DIGEST
|
|
|
|
# NOTE on specific images:
|
|
# IMAGE_RUSTFS uses `latest` because RustFS does not (yet) publish stable
|
|
# semver tags reliably (PLAN-002 R3 — RustFS is young). MUST be pinned by
|
|
# digest before any real deploy; the digest is what gives determinism here.
|
|
# IMAGE_FORGEJO / IMAGE_ACT_RUNNER pull from Forgejo's own registries
|
|
# (codeberg.org / code.forgejo.org), not Docker Hub.
|
|
|
|
|
|
# -----------------------------------------------------------------------------
|
|
# HOST TOOLS (PLAN-002 §9.1 "binary installation" / "host validation")
|
|
# Format: TOOL_<NAME>_MIN=<minimum-version> (preflight enforces installed >= MIN)
|
|
# The matching CLI binary name preflight looks for is in checks/tools.sh.
|
|
# -----------------------------------------------------------------------------
|
|
|
|
# --- orchestration toolchain ---
|
|
TOOL_PULUMI_MIN=3.140.0
|
|
TOOL_BUN_MIN=1.1.0
|
|
TOOL_NODE_MIN=20.0.0
|
|
|
|
# --- container + scm ---
|
|
TOOL_DOCKER_MIN=24.0.0
|
|
TOOL_GIT_MIN=2.34.0
|
|
|
|
# --- crypto / compression / json (backup + secrets handling) ---
|
|
TOOL_AGE_MIN=1.1.0
|
|
TOOL_ZSTD_MIN=1.5.0
|
|
TOOL_JQ_MIN=1.6
|
|
|
|
# --- service CLIs used by bootstrap / backup / DR ---
|
|
TOOL_VAULT_MIN=1.15.0
|
|
TOOL_PSQL_MIN=15.0
|
|
TOOL_PG_DUMP_MIN=15.0
|
|
|
|
# --- ssh client (Pulumi docker-over-SSH provider, git-over-ssh) ---
|
|
TOOL_OPENSSH_MIN=8.0
|
|
|
|
# --- S3 / RustFS client (bucket ops, backup put/get). MinIO client `mc`. ---
|
|
TOOL_MC_MIN=2023.01.01
|