Documentation
¶
Overview ¶
Package daemon is the node runtime: control plane and/or worker, selected by config roles. This file wires the subsystems; each subsystem lives in its own subpackage.
Foundation status: boots a single-node control plane (raft + state) and waits for shutdown. API server (T-06), agent (T-16), proxy (T-41) and the rest plug in here per TASKS.md.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func Bootstrap ¶
func Bootstrap(ctx context.Context, rs *raftstore.Store, opts BootstrapOptions) (*secrets.Keyring, error)
Bootstrap performs first-boot initialization on the leader: it creates the org, the admin user, a personal bootstrap token, and the sealed cluster key, then returns the in-memory keyring. It is a no-op when the org already exists (a restart must not print a new token); in that case it returns a nil keyring, since the plaintext data key lives only in the memory of the process that created it (unseal-on-restart is a later flow).
Bootstrap must run only on the leader; callers gate on IsLeader.
Types ¶
type BootstrapOptions ¶
type BootstrapOptions struct {
// Out receives the one-time human-readable token/passphrase prints. When
// nil, os.Stdout is used.
Out io.Writer
// RecoveryPassphraseFile, when set, supplies the recovery passphrase
// instead of generating a random one (its trimmed contents are used).
RecoveryPassphraseFile string
Logger *slog.Logger
}
BootstrapOptions configures first-boot initialization.
Source Files
¶
Directories
¶
| Path | Synopsis |
|---|---|
|
Package agent is the node-side runtime that keeps a node in sync with the control plane.
|
Package agent is the node-side runtime that keeps a node in sync with the control plane. |
|
Package api hosts the public control-plane API.
|
Package api hosts the public control-plane API. |
|
Package builder builds container images from source using a managed buildkitd (spec §3.4).
|
Package builder builds container images from source using a managed buildkitd (spec §3.4). |
|
Package ca implements the embedded cluster certificate authority.
|
Package ca implements the embedded cluster certificate authority. |
|
Package github implements push-to-deploy: a webhook endpoint that turns GitHub push events into builds, and GitHub App authentication for cloning private repos and posting commit statuses (spec F9, T-37).
|
Package github implements push-to-deploy: a webhook endpoint that turns GitHub push events into builds, and GitHub App authentication for cloning private repos and posting commit statuses (spec F9, T-37). |
|
Package intdns is the per-node internal DNS resolver (F26).
|
Package intdns is the per-node internal DNS resolver (F26). |
|
Package livestate holds the leader's in-memory view of connected nodes: presence, last heartbeat time and the most recent live sample.
|
Package livestate holds the leader's in-memory view of connected nodes: presence, last heartbeat time and the most recent live sample. |
|
Package logstore defines the per-node log storage contract (spec §3.10).
|
Package logstore defines the per-node log storage contract (spec §3.10). |
|
Package mesh owns the WireGuard overlay (ADR-0003).
|
Package mesh owns the WireGuard overlay (ADR-0003). |
|
Package nodeinfo detects a node's static capacity (CPU / memory / disk) for registration in state.
|
Package nodeinfo detects a node's static capacity (CPU / memory / disk) for registration in state. |
|
Package proxy hosts the embedded L7/L4 proxy (tasks T-41..T-48).
|
Package proxy hosts the embedded L7/L4 proxy (tasks T-41..T-48). |
|
Package raftstore wires hashicorp/raft to the in-memory state store (ADR-0004).
|
Package raftstore wires hashicorp/raft to the in-memory state store (ADR-0004). |
|
Package registry implements Zattera's embedded OCI image registry (spec §3.5).
|
Package registry implements Zattera's embedded OCI image registry (spec §3.5). |
|
docker.go is the ONLY file permitted to import the Docker SDK (spec rule 3).
|
docker.go is the ONLY file permitted to import the Docker SDK (spec rule 3). |
|
Package scheduler runs on the leader and reconciles desired replica counts into Assignments: it decides WHAT should run WHERE, writing only desired state (agents converge it, T-15).
|
Package scheduler runs on the leader and reconciles desired replica counts into Assignments: it decides WHAT should run WHERE, writing only desired state (agents converge it, T-15). |
|
Package secrets implements envelope encryption for cluster secrets (spec §3.13, design §2.10):
|
Package secrets implements envelope encryption for cluster secrets (spec §3.13, design §2.10): |
|
Package tlsmgr manages TLS certificates for the ingress: ACME issuance via certmagic backed by the raft KV (cluster-wide, one issuer serialized by a distributed lock), and a dev mode that mints self-signed certs from the cluster CA on demand (T-44).
|
Package tlsmgr manages TLS certificates for the ingress: ACME issuance via certmagic backed by the raft KV (cluster-wide, one issuer serialized by a distributed lock), and a dev mode that mints self-signed certs from the cluster CA on demand (T-44). |
|
Package tsdb defines the embedded time-series store contract (spec §3.10): per-series ring buffers, 15s raw resolution for 24h + 5m downsampled for 30d.
|
Package tsdb defines the embedded time-series store contract (spec §3.10): per-series ring buffers, 15s raw resolution for 24h + 5m downsampled for 30d. |
Click to show internal directories.
Click to hide internal directories.