incus

type Adapter struct {
	// contains filtered or unexported fields
}

type Config struct {
	// Address is the Incus API: unix:///var/lib/incus/unix.socket, or
	// https://host:8443 with the tls_client credential.
	Address string `json:"address,omitempty"`

	// ServerCertificate is the Incus server's certificate as PEM, for an
	// https:// address. Not a secret; required, because an unverified server
	// would be handed the client certificate, which is root on the cluster.
	ServerCertificate string `json:"server_certificate,omitempty"`

	// Project is the Incus project everything the adapter makes is in.
	Project string `json:"project,omitempty"`

	// Network is the Incus network each VM's one NIC is on (R-026). It must
	// be routable from Pando's host: the proxy reaches each VM's agent on it.
	Network string `json:"network,omitempty"`

	// ProxySources are the addresses Pando's proxy connects from, as CIDRs
	// separated by commas or spaces. The only sources each VM admits.
	ProxySources string `json:"proxy_sources,omitempty"`

	// StoragePool is the pool for root disks and volumes. Empty is the
	// project's default profile's root pool.
	StoragePool string `json:"storage_pool,omitempty"`

	// Target pins every VM to one cluster member, or to a cluster group as
	// "@group". Empty leaves placement to Incus (R-256).
	Target string `json:"target,omitempty"`

	// Profiles are applied to each VM, comma-separated. Empty is none: a
	// default profile usually carries a NIC onto the LAN.
	Profiles string `json:"profiles,omitempty"`

	// AgentImage is the image of Pando each VM's forwarding agent and each
	// restricted app's egress gateway run. Required: a VM has no other way to
	// get Pando's binary.
	AgentImage string `json:"agent_image,omitempty"`

	// AgentPort is the port each VM's agent listens on. Zero is 7443.
	AgentPort int `json:"agent_port,omitempty"`

	// GuestImage is an Incus image alias or fingerprint to start VMs from,
	// instead of the one the adapter prepares. It must have Podman serving
	// its Docker-compatible API on /run/podman/podman.sock, and socat.
	GuestImage string `json:"guest_image,omitempty"`

	// RootSizeBytes is each VM's root disk. Zero is 20 GiB.
	RootSizeBytes int64 `json:"root_size_bytes,omitempty"`

	// VolumeSizeBytes is the size of each app volume, unless the app asks
	// for more. Zero is 10 GiB. Incus needs one where a project limits disk.
	VolumeSizeBytes int64 `json:"volume_size_bytes,omitempty"`

	// GuestOverheadBytes is the memory each VM has beyond its workloads'
	// limits, for the guest kernel, Podman and the agent. Zero is 512 MiB.
	GuestOverheadBytes int64 `json:"guest_overhead_bytes,omitempty"`

	// DefaultCPUs and DefaultMemoryBytes size a VM whose workloads set no
	// limits. Zero is 1 CPU and 1 GiB.
	DefaultCPUs        int   `json:"default_cpus,omitempty"`
	DefaultMemoryBytes int64 `json:"default_memory_bytes,omitempty"`

	// NetworkPool and NetworkBlockBits are the Docker adapter's settings of
	// the same names, applied inside every VM.
	NetworkPool      string `json:"network_pool,omitempty"`
	NetworkBlockBits int    `json:"network_block_bits,omitempty"`

	// TotalCPUMillis and TotalMemoryBytes cap the capacity reported, for an
	// operator giving Pando part of a cluster that runs other things.
	TotalCPUMillis   int   `json:"total_cpu_millis,omitempty"`
	TotalMemoryBytes int64 `json:"total_memory_bytes,omitempty"`

	// Credentials arrive from the encrypted adapter_credentials store and are
	// held in memory only (R-190).
	Credentials Credentials `json:"credentials"`
}

type Credentials struct {
	// TLSClient is the client certificate and its key, as PEM, for an
	// https:// address.
	TLSClient string `json:"tls_client,omitempty"`

	// AgentAuthority is the agents' certificate authority, as from
	// `pando host-agent new-authority`.
	AgentAuthority string `json:"agent_authority"`
}