daemon

package
v0.1.0-alpha.8 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Jul 18, 2026 License: Apache-2.0 Imports: 74 Imported by: 0

Documentation

Overview

Package daemon is the node runtime: control plane and/or worker, selected by config roles. This file wires the subsystems; each subsystem lives in its own subpackage.

Foundation status: boots a single-node control plane (raft + state) and waits for shutdown. API server (T-06), agent (T-16), proxy (T-41) and the rest plug in here per TASKS.md.

Index

Constants

This section is empty.

Variables

This section is empty.

Functions

func Bootstrap 

func Bootstrap(ctx context.Context, rs *raftstore.Store, opts BootstrapOptions) (*secrets.Keyring, error)

Bootstrap performs first-boot initialization on the leader: it creates the org, the admin user, a personal bootstrap token, and the sealed cluster key, then returns the in-memory keyring. It is a no-op when the org already exists (a restart must not print a new token); in that case it returns a nil keyring, since the plaintext data key lives only in the memory of the process that created it (unseal-on-restart is a later flow).

Bootstrap must run only on the leader; callers gate on IsLeader.

func Commands 

func Commands() []*cobra.Command

Commands returns the daemon-side top-level commands.

func Run 

func Run(ctx context.Context, cfg config.Config) error

Run boots the node and blocks until ctx is canceled or a signal arrives.

Types

type BootstrapOptions 

type BootstrapOptions struct {
	// Out receives the one-time human-readable token/passphrase prints. When
	// nil, os.Stdout is used.
	Out io.Writer
	// RecoveryPassphraseFile, when set, supplies the recovery passphrase
	// instead of generating a random one (its trimmed contents are used).
	RecoveryPassphraseFile string
	Logger                 *slog.Logger
}

BootstrapOptions configures first-boot initialization.

Source Files

View all Source files

Directories

Path Synopsis
Package agent is the node-side runtime that keeps a node in sync with the control plane.
 Package agent is the node-side runtime that keeps a node in sync with the control plane.
Package api hosts the public control-plane API.
 Package api hosts the public control-plane API.
Package archive gives audit entries and events durability beyond their in-state rings (T-92).
 Package archive gives audit entries and events durability beyond their in-state rings (T-92).
Package backup implements full-platform disaster recovery (spec §3.11, T-66): a leader backs up the raft state, the cluster CA material and the sealed data key to the same S3 object store the volume snapshots use; `zatterad restore` rebuilds a fresh single-node cluster from the latest backup.
 Package backup implements full-platform disaster recovery (spec §3.11, T-66): a leader backs up the raft state, the cluster CA material and the sealed data key to the same S3 object store the volume snapshots use; `zatterad restore` rebuilds a fresh single-node cluster from the latest backup.
Package builder builds container images from source using a managed buildkitd (spec §3.4).
 Package builder builds container images from source using a managed buildkitd (spec §3.4).
Package ca implements the embedded cluster certificate authority.
 Package ca implements the embedded cluster certificate authority.
Package github implements push-to-deploy: a webhook endpoint that turns GitHub push events into builds, and GitHub App authentication for cloning private repos and posting commit statuses (spec F9, T-37).
 Package github implements push-to-deploy: a webhook endpoint that turns GitHub push events into builds, and GitHub App authentication for cloning private repos and posting commit statuses (spec F9, T-37).
Package intdns is the per-node internal DNS resolver (F26).
 Package intdns is the per-node internal DNS resolver (F26).
Package leaderrunner factors the "run this loop only while we hold raft leadership" boilerplate shared by every leader-gated control-plane loop (scheduler, orchestrator, dispatcher, janitors).
 Package leaderrunner factors the "run this loop only while we hold raft leadership" boilerplate shared by every leader-gated control-plane loop (scheduler, orchestrator, dispatcher, janitors).
Package livestate holds the leader's in-memory view of connected nodes: presence, last heartbeat time and the most recent live sample.
 Package livestate holds the leader's in-memory view of connected nodes: presence, last heartbeat time and the most recent live sample.
Package logstore defines the per-node log storage contract (spec §3.10).
 Package logstore defines the per-node log storage contract (spec §3.10).
Package mesh owns the WireGuard overlay (ADR-0003).
 Package mesh owns the WireGuard overlay (ADR-0003).
meshsock
Package meshsock is the custom wireguard-go conn.Bind (ADR-0003 Phase C/D): one UDP socket multiplexes WireGuard transport packets and disco probe frames, a per-peer path state machine upgrades hub-routed peers to direct or hole-punched UDP paths, and (Phase D) falls back to a TCP relay when no UDP path works.
 Package meshsock is the custom wireguard-go conn.Bind (ADR-0003 Phase C/D): one UDP socket multiplexes WireGuard transport packets and disco probe frames, a per-peer path state machine upgrades hub-routed peers to direct or hole-punched UDP paths, and (Phase D) falls back to a TCP relay when no UDP path works.
relay
Package relay is the Phase D DERP-lite fallback (ADR-0003): every control node runs an mTLS TCP relay; a meshsock node with no working UDP path frames its already-encrypted WireGuard packets as (dst node, payload) and the relay forwards them to the destination's connection.
 Package relay is the Phase D DERP-lite fallback (ADR-0003): every control node runs an mTLS TCP relay; a meshsock node with no working UDP path frames its already-encrypted WireGuard packets as (dst node, payload) and the relay forwards them to the destination's connection.
Package nodehealth holds the pure node-liveness decision types shared by the gossip failure detector (internal/daemon/mesh) and the liveness monitor (internal/daemon/api).
 Package nodehealth holds the pure node-liveness decision types shared by the gossip failure detector (internal/daemon/mesh) and the liveness monitor (internal/daemon/api).
Package nodeinfo detects a node's static capacity (CPU / memory / disk) for registration in state.
 Package nodeinfo detects a node's static capacity (CPU / memory / disk) for registration in state.
Package notify is the alert engine (T-74): the leader evaluates AlertRules against metrics (TSDB/livestate) and cluster events, and delivers firing and resolved notifications to NotificationChannels (webhook, Slack, email) with per-rule dedupe.
 Package notify is the alert engine (T-74): the leader evaluates AlertRules against metrics (TSDB/livestate) and cluster events, and delivers firing and resolved notifications to NotificationChannels (webhook, Slack, email) with per-rule dedupe.
Package proxy hosts the embedded L7/L4 proxy (tasks T-41..T-48).
 Package proxy hosts the embedded L7/L4 proxy (tasks T-41..T-48).
Package raftstore wires hashicorp/raft to the in-memory state store (ADR-0004).
 Package raftstore wires hashicorp/raft to the in-memory state store (ADR-0004).
Package registry implements Zattera's embedded OCI image registry (spec §3.5).
 Package registry implements Zattera's embedded OCI image registry (spec §3.5).
docker.go is the ONLY file permitted to import the Docker SDK (spec rule 3).
 docker.go is the ONLY file permitted to import the Docker SDK (spec rule 3).
Package scheduler runs on the leader and reconciles desired replica counts into Assignments: it decides WHAT should run WHERE, writing only desired state (agents converge it, T-15).
 Package scheduler runs on the leader and reconciles desired replica counts into Assignments: it decides WHAT should run WHERE, writing only desired state (agents converge it, T-15).
Package secrets implements envelope encryption for cluster secrets (spec §3.13, design §2.10):
 Package secrets implements envelope encryption for cluster secrets (spec §3.13, design §2.10):
Package tlsmgr manages TLS certificates for the ingress: ACME issuance via certmagic backed by the raft KV (cluster-wide, one issuer serialized by a distributed lock), and a dev mode that mints self-signed certs from the cluster CA on demand (T-44).
 Package tlsmgr manages TLS certificates for the ingress: ACME issuance via certmagic backed by the raft KV (cluster-wide, one issuer serialized by a distributed lock), and a dev mode that mints self-signed certs from the cluster CA on demand (T-44).
Package tsdb defines the embedded time-series store contract (spec §3.10): per-series ring buffers, 15s raw resolution for 24h + 5m downsampled for 30d.
 Package tsdb defines the embedded time-series store contract (spec §3.10): per-series ring buffers, 15s raw resolution for 24h + 5m downsampled for 30d.
Package upgrade resolves release artifacts for a rolling cluster upgrade (T-95).
 Package upgrade resolves release artifacts for a rolling cluster upgrade (T-95).
Package volumes implements the content-addressed snapshot engine (spec §3.11): a deterministic tar of a volume's host path is content-defined-chunked (FastCDC), each chunk is deduplicated by sha256, compressed (zstd), encrypted (AES-GCM), and stored as an object; a per-snapshot manifest lists the ordered chunk hashes.
 Package volumes implements the content-addressed snapshot engine (spec §3.11): a deterministic tar of a volume's host path is content-defined-chunked (FastCDC), each chunk is deduplicated by sha256, compressed (zstd), encrypted (AES-GCM), and stored as an object; a per-snapshot manifest lists the ordered chunk hashes.

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.