Directories
¶
| Path | Synopsis |
|---|---|
|
Package addons manages Postgres and Redis addon containers for apps (E2.3): hardened containers on the owning app's network, generated credentials stored age-encrypted and injected into the app as ordinary write-only secrets, and encrypted backups to S3-compatible storage (see backup.go).
|
Package addons manages Postgres and Redis addon containers for apps (E2.3): hardened containers on the owning app's network, generated credentials stored age-encrypted and injected into the app as ordinary write-only secrets, and encrypted backups to S3-compatible storage (see backup.go). |
|
Package audit defines the control plane's audit-log interface (golden rule 5: every state-changing action writes an event).
|
Package audit defines the control plane's audit-log interface (golden rule 5: every state-changing action writes an event). |
|
Package auth is part of the Redoubt control plane.
|
Package auth is part of the Redoubt control plane. |
|
Package backup implements encrypted addon backups to S3-compatible storage and the minimal AWS Signature V4 client they need.
|
Package backup implements encrypted addon backups to S3-compatible storage and the minimal AWS Signature V4 client they need. |
|
Package build turns a validated git checkout into a tagged Docker image through rootless BuildKit (docs/BUILD_PLAN.md E1.2, docs/DECISIONS.md D-018).
|
Package build turns a validated git checkout into a tagged Docker image through rootless BuildKit (docs/BUILD_PLAN.md E1.2, docs/DECISIONS.md D-018). |
|
Package config loads and validates platformd's configuration from the environment.
|
Package config loads and validates platformd's configuration from the environment. |
|
Package deploy is part of the Redoubt control plane.
|
Package deploy is part of the Redoubt control plane. |
|
Package docker is part of the Redoubt control plane.
|
Package docker is part of the Redoubt control plane. |
|
dockertest
Package dockertest provides a minimal fake Docker Engine API for unit tests in other packages.
|
Package dockertest provides a minimal fake Docker Engine API for unit tests in other packages. |
|
Package git clones application repositories for the deploy pipeline using the pure-Go go-git library (D-013).
|
Package git clones application repositories for the deploy pipeline using the pure-Go go-git library (D-013). |
|
Package goldenrules holds repository-wide static regression tests for the golden rules in CLAUDE.md.
|
Package goldenrules holds repository-wide static regression tests for the golden rules in CLAUDE.md. |
|
Package httpapi is part of the Redoubt control plane.
|
Package httpapi is part of the Redoubt control plane. |
|
Package proxy is part of the Redoubt control plane.
|
Package proxy is part of the Redoubt control plane. |
|
Package queue runs the River job queue on the control-plane SQLite database, with the workers embedded in platformd (E1.3; golden rule 7: no Redis, no separate worker process).
|
Package queue runs the River job queue on the control-plane SQLite database, with the workers embedded in platformd (E1.3; golden rule 7: no Redis, no separate worker process). |
|
Package scan is part of the Redoubt control plane.
|
Package scan is part of the Redoubt control plane. |
|
Package secrets implements golden rule 3 for the Redoubt control plane: secret values are age-encrypted at rest and never logged, printed or displayed.
|
Package secrets implements golden rule 3 for the Redoubt control plane: secret values are age-encrypted at rest and never logged, printed or displayed. |
|
Package selfaudit scores a running Redoubt installation against its own secure-by-default checklist, in the spirit of docker-bench-security (E2.7): daemon configuration, the compose bundle (socket-proxy, Traefik, platformd, buildkitd), every platform-managed container, the control-plane's own state (Owner TOTP, bootstrap token, key file mode, audit chain) and, when it runs on the host, a few daemon files.
|
Package selfaudit scores a running Redoubt installation against its own secure-by-default checklist, in the spirit of docker-bench-security (E2.7): daemon configuration, the compose bundle (socket-proxy, Traefik, platformd, buildkitd), every platform-managed container, the control-plane's own state (Owner TOTP, bootstrap token, key file mode, audit chain) and, when it runs on the host, a few daemon files. |
|
Package store is part of the Redoubt control plane.
|
Package store is part of the Redoubt control plane. |
|
Package update implements `redoubt update`: opt-in, never silent, cosign-verified updates of the platform images (plan §3, golden guardrail "auto-update is an attack vector").
|
Package update implements `redoubt update`: opt-in, never silent, cosign-verified updates of the platform images (plan §3, golden guardrail "auto-update is an attack vector"). |
|
sigtest
Package sigtest is a miniature Sigstore for tests and demos: a Fulcio-like CA that issues short-lived code-signing certificates carrying the OIDC identity extensions, a Rekor-like key that signs entry timestamps, and an in-memory OCI registry that serves images and their cosign signature manifests.
|
Package sigtest is a miniature Sigstore for tests and demos: a Fulcio-like CA that issues short-lived code-signing certificates carrying the OIDC identity extensions, a Rekor-like key that signs entry timestamps, and an in-memory OCI registry that serves images and their cosign signature manifests. |
|
sigtest/demosign
command
demosign signs images in a local (plain-HTTP, loopback) registry with a throwaway Sigstore (sigtest) and writes the matching trust root, so `make demo-phase3` can exercise `redoubt update` end to end without GitHub OIDC.
|
demosign signs images in a local (plain-HTTP, loopback) registry with a throwaway Sigstore (sigtest) and writes the matching trust root, so `make demo-phase3` can exercise `redoubt update` end to end without GitHub OIDC. |
|
Package webhooks receives Git push webhooks from GitHub, GitLab and Gitea and turns them into deploy triggers.
|
Package webhooks receives Git push webhooks from GitHub, GitLab and Gitea and turns them into deploy triggers. |
Click to show internal directories.
Click to hide internal directories.