rustfscache

package
v1.2.0 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Aug 23, 2026 License: AGPL-3.0 Imports: 28 Imported by: 0

Documentation

Index

Constants

View Source 
const (
	SchemaVersion               = 1
	DefaultConfigPath           = "/etc/gha-fleet/rustfs-cache-identities.yaml"
	DefaultCredentialsDirectory = "/etc/garm/cache"
	DefaultCAFile               = "/etc/gha-fleet/trust/rustfs-ca.pem"
	DefaultRootAccessKeyFile    = "/etc/gha-fleet/secrets/rustfs-access-key"
	DefaultRootSecretKeyFile    = "/etc/gha-fleet/secrets/rustfs-secret-key"
	DefaultClaimJournalFile     = "/var/lib/gha-cache-broker/claims.json"
	DefaultClaimJournalLockFile = "/var/lib/gha-cache-broker/claims.lock"
	MaximumConfigBytes          = 64 * 1024
)

Variables

This section is empty.

Functions

func ValidateEndpoint 

func ValidateEndpoint(value string) error

ValidateEndpoint accepts the deployment address while refusing DNS, credentials, alternate ports and non-origin URL components. The exact IP is estate data and must not be compiled into this public package.

Types

type Config 

type Config struct {
	SchemaVersion        int        `yaml:"schema_version" json:"schema_version"`
	Endpoint             string     `yaml:"endpoint" json:"endpoint"`
	Region               string     `yaml:"region" json:"region"`
	CAFile               string     `yaml:"ca_file" json:"ca_file"`
	RootAccessKeyFile    string     `yaml:"root_access_key_file" json:"root_access_key_file"`
	RootSecretKeyFile    string     `yaml:"root_secret_key_file" json:"root_secret_key_file"`
	CredentialsDirectory string     `yaml:"credentials_directory" json:"credentials_directory"`
	Bucket               string     `yaml:"bucket" json:"bucket"`
	QuotaBytes           int64      `yaml:"quota_bytes" json:"quota_bytes"`
	ClaimEndpoint        string     `yaml:"claim_endpoint" json:"claim_endpoint"`
	ClaimJournalFile     string     `yaml:"claim_journal_file" json:"claim_journal_file"`
	ClaimJournalLockFile string     `yaml:"claim_journal_lock_file" json:"claim_journal_lock_file"`
	Identities           []Identity `yaml:"identities" json:"identities"`
}

func Load 

func Load(path string) (Config, error)

func (Config) Repository 

func (c Config) Repository() (string, error)

Repository returns the exact repository authorized by all configured cache identities. Validate proves every role shares this root.

func (Config) SortedIdentities 

func (c Config) SortedIdentities() []Identity

func (Config) Validate 

func (c Config) Validate() error

func (Config) ValidateProductionPaths 

func (c Config) ValidateProductionPaths() error

ValidateProductionPaths pins mutable credential material to the reviewed host boundary. Validate intentionally permits a temporary directory so the filesystem and reconciliation contracts can be exercised without root.

type Credential 

type Credential struct {
	AccessKey string
	SecretKey []byte
}

type Delivery 

type Delivery struct {
	Role      string
	Endpoint  string
	Region    string
	Bucket    string
	Prefix    string
	Mode      string
	AccessKey string
	SecretKey []byte
	CAPEM     []byte
}

Delivery is the smallest cache identity representation allowed to cross the host-to-disposable-worker boundary. SecretKey and CAPEM remain byte slices so callers can erase their copies after Incus accepts the file.

func LoadDelivery 

func LoadDelivery(config Config, role string, credentialUID, credentialGID, caUID, caGID int) (Delivery, error)

LoadDelivery validates and reads exactly one reconciled identity. It does not accept root credentials and does not mutate either local or remote state. The caller supplies the reviewed host ownership contract so the same checks can be exercised without privileged test fixtures.

func (*Delivery) Clear 

func (d *Delivery) Clear()

Clear erases mutable secret-bearing buffers owned by the delivery.

type HTTPRequester 

type HTTPRequester struct {
	Endpoint string
	Region   string
	Client   *http.Client
	Now      func() time.Time
}

func NewHTTPRequester 

func NewHTTPRequester(config Config) (*HTTPRequester, error)

func (*HTTPRequester) Do 

func (r *HTTPRequester) Do(
	ctx context.Context,
	credential Credential,
	method, requestPath, contentType string,
	body []byte,
) (Response, error)

type Identity 

type Identity struct {
	Role          string `yaml:"role" json:"role"`
	Policy        string `yaml:"policy" json:"policy"`
	Prefix        string `yaml:"prefix" json:"prefix"`
	Mode          string `yaml:"mode" json:"mode"`
	RetentionDays int    `yaml:"retention_days" json:"retention_days"`
}

type IdentityResult 

type IdentityResult struct {
	Role          string `json:"role"`
	AccessKey     string `json:"access_key"`
	Policy        string `json:"policy"`
	Prefix        string `json:"prefix"`
	Mode          string `json:"mode"`
	AccessKeyFile string `json:"access_key_file"`
	SecretKeyFile string `json:"secret_key_file"`
}

type Options 

type Options struct {
	Config       Config
	Apply        bool
	RootOwnerUID int
	RootOwnerGID int
	OwnerUID     int
	OwnerGID     int
}

type Requester 

type Requester interface {
	Do(context.Context, Credential, string, string, string, []byte) (Response, error)
}

type Response 

type Response struct {
	StatusCode int
	Body       []byte
}

type Result 

type Result struct {
	SchemaVersion int              `json:"schema_version"`
	Applied       bool             `json:"applied"`
	LocalState    string           `json:"local_state"`
	StateBefore   string           `json:"state_before"`
	StateAfter    string           `json:"state_after"`
	Bucket        string           `json:"bucket"`
	QuotaBytes    int64            `json:"quota_bytes"`
	Actions       []string         `json:"actions"`
	Identities    []IdentityResult `json:"identities"`
}

type Runner 

type Runner struct {
	Requester Requester
	Random    io.Reader
	Sleep     func(context.Context, time.Duration) error
}

func (Runner) Run 

func (r Runner) Run(ctx context.Context, options Options) (Result, error)

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.