@namewta/speculo 1.0.7 → 1.0.8
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/package.json +1 -1
- package/template/workflows/ops/H-host-manage/H-host-manage.md +4 -0
- package/template/workflows/ops/README.md +6 -3
- package/template/workflows/ops/common/USAGE.md +1 -1
- package/template/workflows/ops/common/rules/persistence-and-secrets.md +1 -1
- package/template/workflows/ops/common/schemas/host.schema.json +64 -1
- package/template/workflows/ops/common/schemas/plan.schema.json +312 -0
- package/template/workflows/ops/common/schemas/spec.schema.json +136 -0
- package/template/workflows/ops/common/schemas/status.schema.json +142 -0
- package/template/workflows/ops/common/service-profiles/elasticsearch.md +13 -0
- package/template/workflows/ops/common/service-profiles/redis.md +4 -0
- package/template/workflows/ops/common/templates/CONTROLLER-RECORD.md +16 -2
- package/template/workflows/ops/common/templates/HOST-README.md +12 -2
- package/template/workflows/ops/common/tests/test_ops.mjs +232 -2
- package/template/workflows/ops/common/tools/opslib/agent.mjs +44 -13
- package/template/workflows/ops/common/tools/opslib/control_files.mjs +57 -0
- package/template/workflows/ops/common/tools/opslib/docs.mjs +202 -18
- package/template/workflows/ops/common/tools/opslib/execution.mjs +31 -13
- package/template/workflows/ops/common/tools/opslib/planner.mjs +108 -14
- package/template/workflows/ops/common/tools/opslib/transport.mjs +1 -1
package/package.json
CHANGED
|
@@ -27,4 +27,8 @@ Docker 缺失使用经审核且版本固定的 Linux Engine 安装配方，完
|
|
|
27
27
|
|
|
28
28
|
主机维护影响现存 APP/公共服务消费者时必须明确 acknowledged_consumers。完整计划列出下载、系统控制文件、服务重启、默认恢复和验证；执行通过后刷新主机双边记录。
|
|
29
29
|
|
|
30
|
+
`write-control` 精确绝对路径例外：内置 `/etc/docker/daemon.json` 与 `/etc/systemd/system/ops-*.service`；经审批还可声明 nginx conf.d、wireguard 配置、以及非 `ops-` 前缀的 systemd 单元。声明路径必须带理由、回滚说明和事后验证，不是任意 `/etc` 写权限。`sshd`/`docker`/`containerd` 等核心单元拒绝。业务数据路径没有该例外。
|
|
31
|
+
|
|
32
|
+
主机级入口（WireGuard、Nginx、探测页）写入 `resource_updates.hosts[].host_services`，生成器输出 `knowledge/host-services.json` 并进入服务一览表。跨主机公网入口写入 spec `public_ingress`，生成 `knowledge/public-ingress.json` 与「公网访问内网」章节。这些不是假的 APP 部署。`write-file` 不得覆盖生成器负责的 `README.md` / `DEPLOYMENTS.md` / `knowledge/host-services.json` / `knowledge/public-ingress.json` / `knowledge/INDEX.md`。
|
|
33
|
+
|
|
30
34
|
命令合同：`<Path>{roots.workflows}/ops/common/USAGE.md</Path>`；所有执行通过 ops.mjs，不能绕过计划审批直接拼接命令调用主机。
|
|
@@ -28,6 +28,9 @@ host_root/
|
|
|
28
28
|
DEPLOYMENTS.md
|
|
29
29
|
docs/standards/DEPLOYMENT-STANDARD.md
|
|
30
30
|
knowledge/
|
|
31
|
+
INDEX.md
|
|
32
|
+
host-services.json # 主机级入口：WireGuard/Nginx/探测，不是 APP 部署
|
|
33
|
+
public-ingress.json # 跨主机公网→内网映射；入口与出口不是同一条连接
|
|
31
34
|
_host/ # 主机证据、安装器、有限缓存和隔离
|
|
32
35
|
_runtime/docker/ # 仅经准备/显式迁移的 Docker Engine
|
|
33
36
|
app-a/
|
|
@@ -62,15 +65,15 @@ host_root/
|
|
|
62
65
|
|
|
63
66
|
## 状态字段
|
|
64
67
|
|
|
65
|
-
schema_version=3；hosts、projects、deployments、allocations、bindings、releases、controller、policies、revision、updated_at。
|
|
68
|
+
schema_version=3；hosts、projects、deployments、allocations、bindings、releases、controller、policies、public_ingress、revision、updated_at。Host.host_services 登记主机级入口。public_ingress 登记跨主机公网映射。
|
|
66
69
|
|
|
67
|
-
部署状态区分 planned、running、configured、docs_pending、completed、failed、unknown、retired。version 是计划版本；observed_version 只有运行验证成功才更新。完成必须有 `both-sides-verified`
|
|
70
|
+
部署状态区分 planned、running、configured、docs_pending、completed、failed、unknown、retired。version 是计划版本；observed_version 只有运行验证成功才更新。完成必须有 `both-sides-verified` 回执，不能只看容器启动或文档标题。主机/全域总册必须同时有服务一览表（含主机级入口）和入口规范；缺一不算完整。
|
|
68
71
|
|
|
69
72
|
单主机 I/H 证据在 `hosts/id/runs/run-id/`；D/跨主机证据在 `releases/run-id/`，各主机保存索引。plan.json 与 approval.json 不可覆盖；journal.jsonl 具有摘要链。摘要链能发现内容修改，但不能单凭自身证明尾部没有被有权者完整截断；还应保留执行回执与备份。
|
|
70
73
|
|
|
71
74
|
## 路径分配
|
|
72
75
|
|
|
73
|
-
部署根由 host/project/layout 唯一派生。所有声明的 APP data/config/env/log/backups 路径都必须在该根内；容器只用显式 bind，禁止命名卷、匿名卷、跨项目 bind
|
|
76
|
+
部署根由 host/project/layout 唯一派生。所有声明的 APP data/config/env/log/backups 路径都必须在该根内；容器只用显式 bind，禁止命名卷、匿名卷、跨项目 bind。默认只读容器根；仅当镜像仍必须写根文件系统时，才允许带 `writable_root_justification` 的 `read_only: false`。config/env 默认 0644 只读挂载，供非 root 镜像用户读取。项目 env 文件集中在 env/；Compose 使用 raw env_file，要求实际 Compose >=2.30。`compose --wait` 之后仍检查容器 running 与 Health=healthy；TCP/docker-proxy 监听不是生产健康证明。
|
|
74
77
|
|
|
75
78
|
原生服务设置 HOME、XDG、缓存、临时目录和 OPS_* 到 APP 根内；Linux systemd 还设置 ProtectSystem/ReadWritePaths。通用自定义命令是用户审核的可执行代码，不是一个能阻止恶意程序所有系统调用的沙箱。来源代码必须可信，必须明确映射项目真实数据参数，并实际验证；发现无法约束的数据路径就阻塞，不能报完成。
|
|
76
79
|
|
|
@@ -65,7 +65,7 @@ node /path/to/ops/common/tools/ops.mjs --state /path/to/.speculo/ops mirror-prob
|
|
|
65
65
|
|
|
66
66
|
环境配方不抓 latest；管理器缺失先明确准备安装器。来源测速不修改配置，证书/哈希失败候选不使用，真实配置更换通过 H 的精确 write-file/write-control/命令计划。不能将 Python/npm/Docker/Maven 镜像混为一套规则。
|
|
67
67
|
|
|
68
|
-
H.host_actions 支持 mkdir、write-file（host.root
|
|
68
|
+
H.host_actions 支持 mkdir、write-file（host.root 内相对路径；不得写生成器负责的 README/DEPLOYMENTS/knowledge 账本）、write-control（精确系统控制文件：内置 docker daemon.json 与 ops-*.service，以及经理由/回滚/验证声明的 nginx、wireguard、非 ops- 前缀单元）、install-toolchain（明确写集/原默认/验证）、command（明确写集/验证）、defaults、quarantine、purge-quarantine。系统软件包安装使用明确批准的可信安装脚本，不自动猜当前发行版安装命令；Docker 示例见 service-profiles/docker-engine.md。主机级入口用 resource_updates.hosts[].host_services 与 spec.public_ingress 入账，不要为 Nginx/WireGuard 伪造 APP 部署。
|
|
69
69
|
|
|
70
70
|
隔离仅移动登记 cache/log，返回 released_bytes=0。确需释放空间，再为 `_host/quarantine/旧run/精确item` 生成 purge-quarantine 计划。没有回执、内容变化、超出有限清单或试图删除业务数据时阻塞。
|
|
71
71
|
|
|
@@ -16,7 +16,7 @@ private/credentials.json 是版本化明文账本；credential-put 不会修改
|
|
|
16
16
|
|
|
17
17
|
控制端项目 README、OPERATIONS 与全域总册保存真实值，特殊字符逐字保留。服务端 README 默认无密码但不能缺路径、版本、时间、启动停止、依赖和备份恢复；OPERATIONS 与 DEPLOYMENTS 默认是受限明文。未知旧密码不能编造；密钥认证没有密码，记录实际密钥认证而不是虚构一个口令。
|
|
18
18
|
|
|
19
|
-
POSIX
|
|
19
|
+
POSIX 账本、env 与明文文档 0600、控制端目录 0700。`config/` 与 `*.conf`/`*.acl` 默认 0644，供非 root 容器用户读取只读挂载；Windows 使用受限 ACL，不以 chmod 代替 DACL。明文不进入 Git、Web 目录、构建上下文、普通日志；env 是指定的本地配置文件例外，不能再进入镜像层。示例凭据全为演示，不可用于生产。
|
|
20
20
|
|
|
21
21
|
## 双边完成门
|
|
22
22
|
|
|
@@ -73,6 +73,9 @@
|
|
|
73
73
|
},
|
|
74
74
|
"required": [],
|
|
75
75
|
"additionalProperties": false
|
|
76
|
+
},
|
|
77
|
+
"host_services": {
|
|
78
|
+
"$ref": "#/$defs/host_services"
|
|
76
79
|
}
|
|
77
80
|
},
|
|
78
81
|
"required": [
|
|
@@ -84,5 +87,65 @@
|
|
|
84
87
|
"identity",
|
|
85
88
|
"connection"
|
|
86
89
|
],
|
|
87
|
-
"additionalProperties": false
|
|
90
|
+
"additionalProperties": false,
|
|
91
|
+
"$defs": {
|
|
92
|
+
"host_services": {
|
|
93
|
+
"type": "array",
|
|
94
|
+
"items": {
|
|
95
|
+
"type": "object",
|
|
96
|
+
"properties": {
|
|
97
|
+
"id": {
|
|
98
|
+
"type": "string",
|
|
99
|
+
"pattern": "^[a-z0-9]+(?:-[a-z0-9]+)*$",
|
|
100
|
+
"maxLength": 80
|
|
101
|
+
},
|
|
102
|
+
"kind": {
|
|
103
|
+
"enum": [
|
|
104
|
+
"wireguard",
|
|
105
|
+
"nginx",
|
|
106
|
+
"systemd",
|
|
107
|
+
"probe",
|
|
108
|
+
"other"
|
|
109
|
+
]
|
|
110
|
+
},
|
|
111
|
+
"unit": {
|
|
112
|
+
"type": "string",
|
|
113
|
+
"minLength": 1
|
|
114
|
+
},
|
|
115
|
+
"listen_port": {
|
|
116
|
+
"type": "integer",
|
|
117
|
+
"minimum": 1,
|
|
118
|
+
"maximum": 65535
|
|
119
|
+
},
|
|
120
|
+
"listen": {
|
|
121
|
+
"type": "array",
|
|
122
|
+
"items": {
|
|
123
|
+
"type": "string",
|
|
124
|
+
"minLength": 1
|
|
125
|
+
}
|
|
126
|
+
},
|
|
127
|
+
"tunnel_address": {
|
|
128
|
+
"type": "string",
|
|
129
|
+
"minLength": 1
|
|
130
|
+
},
|
|
131
|
+
"config_path": {
|
|
132
|
+
"type": "string",
|
|
133
|
+
"minLength": 1
|
|
134
|
+
},
|
|
135
|
+
"public_url": {
|
|
136
|
+
"type": "string",
|
|
137
|
+
"minLength": 1
|
|
138
|
+
},
|
|
139
|
+
"notes": {
|
|
140
|
+
"type": "string"
|
|
141
|
+
}
|
|
142
|
+
},
|
|
143
|
+
"required": [
|
|
144
|
+
"id",
|
|
145
|
+
"kind"
|
|
146
|
+
],
|
|
147
|
+
"additionalProperties": false
|
|
148
|
+
}
|
|
149
|
+
}
|
|
150
|
+
}
|
|
88
151
|
}
|
|
@@ -46,6 +46,61 @@
|
|
|
46
46
|
"type": "string",
|
|
47
47
|
"minLength": 1
|
|
48
48
|
},
|
|
49
|
+
"registry_slice_digest": {
|
|
50
|
+
"type": "string",
|
|
51
|
+
"minLength": 1
|
|
52
|
+
},
|
|
53
|
+
"registry_scope": {
|
|
54
|
+
"type": "object",
|
|
55
|
+
"properties": {
|
|
56
|
+
"hosts": {
|
|
57
|
+
"type": "array",
|
|
58
|
+
"items": {
|
|
59
|
+
"type": "string"
|
|
60
|
+
}
|
|
61
|
+
},
|
|
62
|
+
"projects": {
|
|
63
|
+
"type": "array",
|
|
64
|
+
"items": {
|
|
65
|
+
"type": "string"
|
|
66
|
+
}
|
|
67
|
+
},
|
|
68
|
+
"deployments": {
|
|
69
|
+
"type": "array",
|
|
70
|
+
"items": {
|
|
71
|
+
"type": "string"
|
|
72
|
+
}
|
|
73
|
+
},
|
|
74
|
+
"allocations": {
|
|
75
|
+
"type": "array",
|
|
76
|
+
"items": {
|
|
77
|
+
"type": "string"
|
|
78
|
+
}
|
|
79
|
+
},
|
|
80
|
+
"bindings": {
|
|
81
|
+
"type": "array",
|
|
82
|
+
"items": {
|
|
83
|
+
"type": "string"
|
|
84
|
+
}
|
|
85
|
+
},
|
|
86
|
+
"policies": {
|
|
87
|
+
"type": "boolean"
|
|
88
|
+
},
|
|
89
|
+
"public_ingress": {
|
|
90
|
+
"type": "boolean"
|
|
91
|
+
}
|
|
92
|
+
},
|
|
93
|
+
"required": [
|
|
94
|
+
"hosts",
|
|
95
|
+
"projects",
|
|
96
|
+
"deployments",
|
|
97
|
+
"allocations",
|
|
98
|
+
"bindings",
|
|
99
|
+
"policies",
|
|
100
|
+
"public_ingress"
|
|
101
|
+
],
|
|
102
|
+
"additionalProperties": false
|
|
103
|
+
},
|
|
49
104
|
"registry_revision": {
|
|
50
105
|
"type": "integer"
|
|
51
106
|
},
|
|
@@ -129,6 +184,64 @@
|
|
|
129
184
|
},
|
|
130
185
|
"required": [],
|
|
131
186
|
"additionalProperties": false
|
|
187
|
+
},
|
|
188
|
+
"host_services": {
|
|
189
|
+
"type": "array",
|
|
190
|
+
"items": {
|
|
191
|
+
"type": "object",
|
|
192
|
+
"properties": {
|
|
193
|
+
"id": {
|
|
194
|
+
"type": "string",
|
|
195
|
+
"pattern": "^[a-z0-9]+(?:-[a-z0-9]+)*$",
|
|
196
|
+
"maxLength": 80
|
|
197
|
+
},
|
|
198
|
+
"kind": {
|
|
199
|
+
"enum": [
|
|
200
|
+
"wireguard",
|
|
201
|
+
"nginx",
|
|
202
|
+
"systemd",
|
|
203
|
+
"probe",
|
|
204
|
+
"other"
|
|
205
|
+
]
|
|
206
|
+
},
|
|
207
|
+
"unit": {
|
|
208
|
+
"type": "string",
|
|
209
|
+
"minLength": 1
|
|
210
|
+
},
|
|
211
|
+
"listen_port": {
|
|
212
|
+
"type": "integer",
|
|
213
|
+
"minimum": 1,
|
|
214
|
+
"maximum": 65535
|
|
215
|
+
},
|
|
216
|
+
"listen": {
|
|
217
|
+
"type": "array",
|
|
218
|
+
"items": {
|
|
219
|
+
"type": "string",
|
|
220
|
+
"minLength": 1
|
|
221
|
+
}
|
|
222
|
+
},
|
|
223
|
+
"tunnel_address": {
|
|
224
|
+
"type": "string",
|
|
225
|
+
"minLength": 1
|
|
226
|
+
},
|
|
227
|
+
"config_path": {
|
|
228
|
+
"type": "string",
|
|
229
|
+
"minLength": 1
|
|
230
|
+
},
|
|
231
|
+
"public_url": {
|
|
232
|
+
"type": "string",
|
|
233
|
+
"minLength": 1
|
|
234
|
+
},
|
|
235
|
+
"notes": {
|
|
236
|
+
"type": "string"
|
|
237
|
+
}
|
|
238
|
+
},
|
|
239
|
+
"required": [
|
|
240
|
+
"id",
|
|
241
|
+
"kind"
|
|
242
|
+
],
|
|
243
|
+
"additionalProperties": false
|
|
244
|
+
}
|
|
132
245
|
}
|
|
133
246
|
},
|
|
134
247
|
"required": [
|
|
@@ -365,6 +478,87 @@
|
|
|
365
478
|
],
|
|
366
479
|
"additionalProperties": false
|
|
367
480
|
},
|
|
481
|
+
"public_ingress": {
|
|
482
|
+
"oneOf": [
|
|
483
|
+
{
|
|
484
|
+
"type": "null"
|
|
485
|
+
},
|
|
486
|
+
{
|
|
487
|
+
"type": "object",
|
|
488
|
+
"properties": {
|
|
489
|
+
"schema_version": {
|
|
490
|
+
"const": 1
|
|
491
|
+
},
|
|
492
|
+
"title": {
|
|
493
|
+
"type": "string",
|
|
494
|
+
"minLength": 1
|
|
495
|
+
},
|
|
496
|
+
"path": {
|
|
497
|
+
"type": "string",
|
|
498
|
+
"minLength": 1
|
|
499
|
+
},
|
|
500
|
+
"not_the_same_as": {
|
|
501
|
+
"type": "string"
|
|
502
|
+
},
|
|
503
|
+
"mappings": {
|
|
504
|
+
"type": "array",
|
|
505
|
+
"items": {
|
|
506
|
+
"type": "object",
|
|
507
|
+
"properties": {
|
|
508
|
+
"public": {
|
|
509
|
+
"type": "string",
|
|
510
|
+
"minLength": 1
|
|
511
|
+
},
|
|
512
|
+
"layer4": {
|
|
513
|
+
"type": "string"
|
|
514
|
+
},
|
|
515
|
+
"via": {
|
|
516
|
+
"type": "array",
|
|
517
|
+
"items": {
|
|
518
|
+
"type": "string"
|
|
519
|
+
}
|
|
520
|
+
},
|
|
521
|
+
"backend": {
|
|
522
|
+
"type": "string",
|
|
523
|
+
"minLength": 1
|
|
524
|
+
},
|
|
525
|
+
"backend_deployment": {
|
|
526
|
+
"type": "string"
|
|
527
|
+
}
|
|
528
|
+
},
|
|
529
|
+
"required": [
|
|
530
|
+
"public",
|
|
531
|
+
"backend"
|
|
532
|
+
],
|
|
533
|
+
"additionalProperties": false
|
|
534
|
+
}
|
|
535
|
+
},
|
|
536
|
+
"open_http_checklist": {
|
|
537
|
+
"type": "array",
|
|
538
|
+
"items": {
|
|
539
|
+
"type": "string",
|
|
540
|
+
"minLength": 1
|
|
541
|
+
}
|
|
542
|
+
},
|
|
543
|
+
"forbidden_ports": {
|
|
544
|
+
"type": "array",
|
|
545
|
+
"items": {
|
|
546
|
+
"type": "integer",
|
|
547
|
+
"minimum": 1,
|
|
548
|
+
"maximum": 65535
|
|
549
|
+
}
|
|
550
|
+
}
|
|
551
|
+
},
|
|
552
|
+
"required": [
|
|
553
|
+
"schema_version",
|
|
554
|
+
"title",
|
|
555
|
+
"path",
|
|
556
|
+
"mappings"
|
|
557
|
+
],
|
|
558
|
+
"additionalProperties": false
|
|
559
|
+
}
|
|
560
|
+
]
|
|
561
|
+
},
|
|
368
562
|
"updated_at": {
|
|
369
563
|
"type": [
|
|
370
564
|
"string",
|
|
@@ -461,6 +655,64 @@
|
|
|
461
655
|
},
|
|
462
656
|
"required": [],
|
|
463
657
|
"additionalProperties": false
|
|
658
|
+
},
|
|
659
|
+
"host_services": {
|
|
660
|
+
"type": "array",
|
|
661
|
+
"items": {
|
|
662
|
+
"type": "object",
|
|
663
|
+
"properties": {
|
|
664
|
+
"id": {
|
|
665
|
+
"type": "string",
|
|
666
|
+
"pattern": "^[a-z0-9]+(?:-[a-z0-9]+)*$",
|
|
667
|
+
"maxLength": 80
|
|
668
|
+
},
|
|
669
|
+
"kind": {
|
|
670
|
+
"enum": [
|
|
671
|
+
"wireguard",
|
|
672
|
+
"nginx",
|
|
673
|
+
"systemd",
|
|
674
|
+
"probe",
|
|
675
|
+
"other"
|
|
676
|
+
]
|
|
677
|
+
},
|
|
678
|
+
"unit": {
|
|
679
|
+
"type": "string",
|
|
680
|
+
"minLength": 1
|
|
681
|
+
},
|
|
682
|
+
"listen_port": {
|
|
683
|
+
"type": "integer",
|
|
684
|
+
"minimum": 1,
|
|
685
|
+
"maximum": 65535
|
|
686
|
+
},
|
|
687
|
+
"listen": {
|
|
688
|
+
"type": "array",
|
|
689
|
+
"items": {
|
|
690
|
+
"type": "string",
|
|
691
|
+
"minLength": 1
|
|
692
|
+
}
|
|
693
|
+
},
|
|
694
|
+
"tunnel_address": {
|
|
695
|
+
"type": "string",
|
|
696
|
+
"minLength": 1
|
|
697
|
+
},
|
|
698
|
+
"config_path": {
|
|
699
|
+
"type": "string",
|
|
700
|
+
"minLength": 1
|
|
701
|
+
},
|
|
702
|
+
"public_url": {
|
|
703
|
+
"type": "string",
|
|
704
|
+
"minLength": 1
|
|
705
|
+
},
|
|
706
|
+
"notes": {
|
|
707
|
+
"type": "string"
|
|
708
|
+
}
|
|
709
|
+
},
|
|
710
|
+
"required": [
|
|
711
|
+
"id",
|
|
712
|
+
"kind"
|
|
713
|
+
],
|
|
714
|
+
"additionalProperties": false
|
|
715
|
+
}
|
|
464
716
|
}
|
|
465
717
|
},
|
|
466
718
|
"required": [
|
|
@@ -1000,6 +1252,8 @@
|
|
|
1000
1252
|
"expires_at",
|
|
1001
1253
|
"controller_id",
|
|
1002
1254
|
"registry_digest",
|
|
1255
|
+
"registry_slice_digest",
|
|
1256
|
+
"registry_scope",
|
|
1003
1257
|
"registry_revision",
|
|
1004
1258
|
"hosts",
|
|
1005
1259
|
"transport_digests",
|
|
@@ -1092,6 +1346,64 @@
|
|
|
1092
1346
|
},
|
|
1093
1347
|
"required": [],
|
|
1094
1348
|
"additionalProperties": false
|
|
1349
|
+
},
|
|
1350
|
+
"host_services": {
|
|
1351
|
+
"type": "array",
|
|
1352
|
+
"items": {
|
|
1353
|
+
"type": "object",
|
|
1354
|
+
"properties": {
|
|
1355
|
+
"id": {
|
|
1356
|
+
"type": "string",
|
|
1357
|
+
"pattern": "^[a-z0-9]+(?:-[a-z0-9]+)*$",
|
|
1358
|
+
"maxLength": 80
|
|
1359
|
+
},
|
|
1360
|
+
"kind": {
|
|
1361
|
+
"enum": [
|
|
1362
|
+
"wireguard",
|
|
1363
|
+
"nginx",
|
|
1364
|
+
"systemd",
|
|
1365
|
+
"probe",
|
|
1366
|
+
"other"
|
|
1367
|
+
]
|
|
1368
|
+
},
|
|
1369
|
+
"unit": {
|
|
1370
|
+
"type": "string",
|
|
1371
|
+
"minLength": 1
|
|
1372
|
+
},
|
|
1373
|
+
"listen_port": {
|
|
1374
|
+
"type": "integer",
|
|
1375
|
+
"minimum": 1,
|
|
1376
|
+
"maximum": 65535
|
|
1377
|
+
},
|
|
1378
|
+
"listen": {
|
|
1379
|
+
"type": "array",
|
|
1380
|
+
"items": {
|
|
1381
|
+
"type": "string",
|
|
1382
|
+
"minLength": 1
|
|
1383
|
+
}
|
|
1384
|
+
},
|
|
1385
|
+
"tunnel_address": {
|
|
1386
|
+
"type": "string",
|
|
1387
|
+
"minLength": 1
|
|
1388
|
+
},
|
|
1389
|
+
"config_path": {
|
|
1390
|
+
"type": "string",
|
|
1391
|
+
"minLength": 1
|
|
1392
|
+
},
|
|
1393
|
+
"public_url": {
|
|
1394
|
+
"type": "string",
|
|
1395
|
+
"minLength": 1
|
|
1396
|
+
},
|
|
1397
|
+
"notes": {
|
|
1398
|
+
"type": "string"
|
|
1399
|
+
}
|
|
1400
|
+
},
|
|
1401
|
+
"required": [
|
|
1402
|
+
"id",
|
|
1403
|
+
"kind"
|
|
1404
|
+
],
|
|
1405
|
+
"additionalProperties": false
|
|
1406
|
+
}
|
|
1095
1407
|
}
|
|
1096
1408
|
},
|
|
1097
1409
|
"required": [
|
|
@@ -102,6 +102,64 @@
|
|
|
102
102
|
},
|
|
103
103
|
"required": [],
|
|
104
104
|
"additionalProperties": false
|
|
105
|
+
},
|
|
106
|
+
"host_services": {
|
|
107
|
+
"type": "array",
|
|
108
|
+
"items": {
|
|
109
|
+
"type": "object",
|
|
110
|
+
"properties": {
|
|
111
|
+
"id": {
|
|
112
|
+
"type": "string",
|
|
113
|
+
"pattern": "^[a-z0-9]+(?:-[a-z0-9]+)*$",
|
|
114
|
+
"maxLength": 80
|
|
115
|
+
},
|
|
116
|
+
"kind": {
|
|
117
|
+
"enum": [
|
|
118
|
+
"wireguard",
|
|
119
|
+
"nginx",
|
|
120
|
+
"systemd",
|
|
121
|
+
"probe",
|
|
122
|
+
"other"
|
|
123
|
+
]
|
|
124
|
+
},
|
|
125
|
+
"unit": {
|
|
126
|
+
"type": "string",
|
|
127
|
+
"minLength": 1
|
|
128
|
+
},
|
|
129
|
+
"listen_port": {
|
|
130
|
+
"type": "integer",
|
|
131
|
+
"minimum": 1,
|
|
132
|
+
"maximum": 65535
|
|
133
|
+
},
|
|
134
|
+
"listen": {
|
|
135
|
+
"type": "array",
|
|
136
|
+
"items": {
|
|
137
|
+
"type": "string",
|
|
138
|
+
"minLength": 1
|
|
139
|
+
}
|
|
140
|
+
},
|
|
141
|
+
"tunnel_address": {
|
|
142
|
+
"type": "string",
|
|
143
|
+
"minLength": 1
|
|
144
|
+
},
|
|
145
|
+
"config_path": {
|
|
146
|
+
"type": "string",
|
|
147
|
+
"minLength": 1
|
|
148
|
+
},
|
|
149
|
+
"public_url": {
|
|
150
|
+
"type": "string",
|
|
151
|
+
"minLength": 1
|
|
152
|
+
},
|
|
153
|
+
"notes": {
|
|
154
|
+
"type": "string"
|
|
155
|
+
}
|
|
156
|
+
},
|
|
157
|
+
"required": [
|
|
158
|
+
"id",
|
|
159
|
+
"kind"
|
|
160
|
+
],
|
|
161
|
+
"additionalProperties": false
|
|
162
|
+
}
|
|
105
163
|
}
|
|
106
164
|
},
|
|
107
165
|
"required": [
|
|
@@ -674,6 +732,10 @@
|
|
|
674
732
|
"type": "integer",
|
|
675
733
|
"minimum": 256,
|
|
676
734
|
"maximum": 511
|
|
735
|
+
},
|
|
736
|
+
"rollback": {
|
|
737
|
+
"type": "string",
|
|
738
|
+
"minLength": 1
|
|
677
739
|
}
|
|
678
740
|
},
|
|
679
741
|
"required": [
|
|
@@ -1019,6 +1081,80 @@
|
|
|
1019
1081
|
"external-mutation",
|
|
1020
1082
|
"production-critical"
|
|
1021
1083
|
]
|
|
1084
|
+
},
|
|
1085
|
+
"public_ingress": {
|
|
1086
|
+
"type": "object",
|
|
1087
|
+
"properties": {
|
|
1088
|
+
"schema_version": {
|
|
1089
|
+
"const": 1
|
|
1090
|
+
},
|
|
1091
|
+
"title": {
|
|
1092
|
+
"type": "string",
|
|
1093
|
+
"minLength": 1
|
|
1094
|
+
},
|
|
1095
|
+
"path": {
|
|
1096
|
+
"type": "string",
|
|
1097
|
+
"minLength": 1
|
|
1098
|
+
},
|
|
1099
|
+
"not_the_same_as": {
|
|
1100
|
+
"type": "string"
|
|
1101
|
+
},
|
|
1102
|
+
"mappings": {
|
|
1103
|
+
"type": "array",
|
|
1104
|
+
"items": {
|
|
1105
|
+
"type": "object",
|
|
1106
|
+
"properties": {
|
|
1107
|
+
"public": {
|
|
1108
|
+
"type": "string",
|
|
1109
|
+
"minLength": 1
|
|
1110
|
+
},
|
|
1111
|
+
"layer4": {
|
|
1112
|
+
"type": "string"
|
|
1113
|
+
},
|
|
1114
|
+
"via": {
|
|
1115
|
+
"type": "array",
|
|
1116
|
+
"items": {
|
|
1117
|
+
"type": "string"
|
|
1118
|
+
}
|
|
1119
|
+
},
|
|
1120
|
+
"backend": {
|
|
1121
|
+
"type": "string",
|
|
1122
|
+
"minLength": 1
|
|
1123
|
+
},
|
|
1124
|
+
"backend_deployment": {
|
|
1125
|
+
"type": "string"
|
|
1126
|
+
}
|
|
1127
|
+
},
|
|
1128
|
+
"required": [
|
|
1129
|
+
"public",
|
|
1130
|
+
"backend"
|
|
1131
|
+
],
|
|
1132
|
+
"additionalProperties": false
|
|
1133
|
+
}
|
|
1134
|
+
},
|
|
1135
|
+
"open_http_checklist": {
|
|
1136
|
+
"type": "array",
|
|
1137
|
+
"items": {
|
|
1138
|
+
"type": "string",
|
|
1139
|
+
"minLength": 1
|
|
1140
|
+
}
|
|
1141
|
+
},
|
|
1142
|
+
"forbidden_ports": {
|
|
1143
|
+
"type": "array",
|
|
1144
|
+
"items": {
|
|
1145
|
+
"type": "integer",
|
|
1146
|
+
"minimum": 1,
|
|
1147
|
+
"maximum": 65535
|
|
1148
|
+
}
|
|
1149
|
+
}
|
|
1150
|
+
},
|
|
1151
|
+
"required": [
|
|
1152
|
+
"schema_version",
|
|
1153
|
+
"title",
|
|
1154
|
+
"path",
|
|
1155
|
+
"mappings"
|
|
1156
|
+
],
|
|
1157
|
+
"additionalProperties": false
|
|
1022
1158
|
}
|
|
1023
1159
|
},
|
|
1024
1160
|
"required": [
|