LocalAuthority
/
README.md
Newer
■
■
■
■
■
■
■
■
■
■
Older
94 lines
|
3.656kb
| 1 |
# Madagascar Local Authority |
|
| 2 | ||
| 3 |
Local authority for Madagascar hosts, DNS manifests, work orders, and host certificates. |
|
| 4 | ||
| 5 |
The development checkout lives locally at: |
|
| 6 | ||
| 7 |
```text |
|
| 8 |
/Users/bogdan/Documents/Workspaces/Xdev/Madagascar/LocalAuthority |
|
| 9 |
``` |
|
| 10 | ||
| 11 |
The canonical GitPrep repository is: |
|
| 12 | ||
| 13 |
```text |
|
| 14 |
git@192.168.2.102:repositories/bogdan/LocalAuthority.git |
|
| 15 |
``` |
|
| 16 | ||
| 17 |
The runtime instance lives on jumper and remains the local source for operational registry data: |
|
| 18 | ||
| 19 |
- `var/host-manager.sqlite` - runtime source of truth for host registry and Work Orders |
|
| 20 |
- `config/hosts.yaml` - seed/snapshot export for host registry compatibility |
|
| 21 |
- `config/local-hosts.tsv` - DNS manifest exported for local resolvers |
|
| 22 |
- `config/work-orders.yaml` - seed/snapshot export for confirmable operational changes |
|
| 23 |
- `scripts/host_manager.pl` - Perl-only web app |
|
| 24 |
- `scripts/sync_local_hosts.sh` - local DNS sync to jumper and as01 |
|
| 25 |
- `scripts/ca_manager.sh` - local OpenSSL CA helper for host certificates |
|
| 26 | ||
| 27 |
The public `xdev.ro` zone is maintained in the separate DNS public-zone repository. |
|
| 28 | ||
| 29 |
Runtime path: |
|
| 30 | ||
| 31 |
```text |
|
| 32 |
/usr/local/xdev-host-manager |
|
| 33 |
``` |
|
| 34 | ||
| 35 |
Secrets live outside git in `/etc/xdev/host-manager.env`. |
|
| 36 | ||
| 37 |
The product name is **Madagascar Local Authority**. The technical service, Unix user, repository path, and environment files still use `host-manager`. |
|
| 38 | ||
| 39 |
The web UI is OTP-protected for all registry data, downloads, exports, and writes. Automation should consume generated exports with dedicated read-only access, not unauthenticated HTTP. |
|
| 40 | ||
| 41 |
For agent/operator context, see: |
|
| 42 | ||
| 43 |
- [`agents.md`](agents.md) |
|
| 44 |
- [`.doc/development-log.md`](.doc/development-log.md) |
|
| 45 |
- [`.doc/host-manager.md`](.doc/host-manager.md) |
|
| 46 |
- [`.doc/local-hosts.md`](.doc/local-hosts.md) |
|
| 47 | ||
| 48 |
## Local development and live testing |
|
| 49 | ||
| 50 |
Work on application code locally. Do not leave changes parked in a dirty working |
|
| 51 |
tree; commit small, coherent changes so they cannot be lost during deploy, |
|
| 52 |
reset, or context switches. |
|
| 53 | ||
| 54 |
```bash |
|
| 55 |
cd /Users/bogdan/Documents/Workspaces/Xdev/Madagascar/LocalAuthority |
|
| 56 |
git status --short |
|
| 57 |
git add ... |
|
| 58 |
git commit -m "Describe the change" |
|
| 59 |
``` |
|
| 60 | ||
| 61 |
For live testing, push the committed code to the runtime checkout on jumper: |
|
| 62 | ||
| 63 |
```bash |
|
| 64 |
git push jumper-runtime HEAD:main |
|
| 65 |
``` |
|
| 66 | ||
| 67 |
The jumper receive hook validates the Perl scripts, restarts `host-manager`, |
|
| 68 |
writes `BUILD`, and checks `/healthz`. |
|
| 69 | ||
| 70 |
For archival/canonical history, push the same commits to GitPrep: |
|
| 71 | ||
| 72 |
```bash |
|
| 73 |
git push origin main |
|
| 74 |
``` |
|
| 75 | ||
| 76 |
`scripts/deploy_to_jumper.sh` remains available as an explicit rsync deploy |
|
| 77 |
tool, but the normal development loop is commit plus push: `jumper-runtime` for |
|
| 78 |
live testing, `origin`/GitPrep for archive and sharing. |
|
| 79 | ||
| 80 |
`config/` is not deployed by default. The live source of truth is `var/host-manager.sqlite`; `hosts.yaml`, `local-hosts.tsv`, and `work-orders.yaml` are seed/snapshot/export files that should not replace runtime data during normal code pushes. Deploy config only when intentionally replacing seed/export files: |
|
| 81 | ||
| 82 |
```bash |
|
| 83 |
scripts/deploy_to_jumper.sh --include-config |
|
| 84 |
``` |
|
| 85 | ||
| 86 |
The default internal domain is `madagascar.xdev.ro`. Short aliases are derived automatically from FQDNs, so `autonas01.madagascar.xdev.ro` also publishes `autonas01` without declaring it separately. |
|
| 87 | ||
| 88 |
Name removals with operational impact go through a Work Order. A WO records intent first; the operational checklist must be completed before confirmation can update the SQLite registry, mark the WO as confirmed, and regenerate `local-hosts.tsv`. Resolver sync remains an explicit operator step. |
|
| 89 | ||
| 90 |
The local host CA stores private material outside git under `var/ca`. Initialize it on jumper with: |
|
| 91 | ||
| 92 |
```bash |
|
| 93 |
sudo scripts/ca_manager.sh init |
|
| 94 |
``` |