62 lines
3.6 KiB
Markdown
62 lines
3.6 KiB
Markdown
|
# Legacy actuator — the generation currently installed on yggdrasil
|
||
|
|
|
||
|
|
**These files are superseded. Do not use them for a new installation.** They are
|
||
|
|
kept because they are what is *running*, and a migration needs both sides.
|
||
|
|
|
||
|
|
`idunn-yggdrasil` is a root shell actuator reached through the narrow sudo grant
|
||
|
|
in `idunn-yggdrasil.sudoers`. It hardcodes eleven targets, their repositories
|
||
|
|
and their admitted refs, then delegates to executable manifests under
|
||
|
|
`/srv/odin/deploy-manifests/<target>`. It calls `idunn validate-release-authority`
|
||
|
|
and `idunn validate-minimum-source-revision` — subcommands the current binary
|
||
|
|
does not have.
|
||
|
|
|
||
|
|
## What replaced it
|
||
|
|
|
||
|
|
Everything this script does by convention, the current Idunn does by contract:
|
||
|
|
|
||
|
|
| Legacy mechanism | Current owner |
|
||
|
|
|---|---|
|
||
|
|
| `deployment_target_policy()` — a `case` over eleven target names | one operator binding per target, in `--bindings-dir` |
|
||
|
|
| `upstream_ref=refs/heads/...` in shell | `[repository] admitted_ref` |
|
||
|
|
| `minimum_source_revision_required` | `[repository] minimum_revision` |
|
||
|
|
| `requires_bifrost_authority` + `--release-authority-store` | `[repository] selection = "signed-release"`, per target |
|
||
|
|
| `/srv/odin/deploy-manifests/<target>` shell scripts | recipe `[[steps]]` in the target's own repository |
|
||
|
|
| `run_manifest_while_holding_authority_locks` | the deployment transaction and process write-lease |
|
||
|
|
| `flock` on a brake store | `[brakes] deployment_store` and `lifecycle_store` |
|
||
|
|
| root shell with `IDUNN_ACTUATOR=1` | `systemd-transient` workload driver under `DynamicUser` |
|
||
|
|
|
||
|
|
The structural difference is not tidiness. The legacy path admits a deployment
|
||
|
|
by *validating arguments to a root shell script*, and everything after that
|
||
|
|
validation is unverified shell running as root. The current path seals exact
|
||
|
|
source and artifacts, admits one incarnation against typed operator authority,
|
||
|
|
and hands execution to systemd — with no place to pass a command string,
|
||
|
|
enforced by `cli_exposes_only_declarative_commands`.
|
||
|
|
|
||
|
|
## The target inventory, which is still useful
|
||
|
|
|
||
|
|
This is the real migration scope, read out of `deployment_target_policy()`:
|
||
|
|
|
||
|
|
| Target | Repository | Admitted ref | Notes |
|
||
|
|
|---|---|---|---|
|
||
|
|
| `odin` | GameCult/Odin | `codex/ygg-idunn-independent-bootstrap` | ref is a branch, not main |
|
||
|
|
| `codex-connector` | GameCult/CodexConnector | `codex/ghostlight-release-binding` | minimum revision enforced |
|
||
|
|
| `ghostlight` | GameCult/Ghostlight | `codex/ghostlight-dungeon-mvp` | minimum revision enforced |
|
||
|
|
| `voidbot` | GameCult/VoidBot | `main` | |
|
||
|
|
| `heimdall` | GameCult/Heimdall | `main` | restart is `docker compose restart` |
|
||
|
|
| `epiphany` | GameCult/Epiphany | `codex/epiphany-shakedown-live` | |
|
||
|
|
| `epiphany-capstone-17` | GameCult/Epiphany | `codex/epiphany-shakedown-live` | second target, same repo |
|
||
|
|
| `bifrost-persona-feedback` | GameCult/Bifrost | `main` | **only** target requiring Bifrost release authority |
|
||
|
|
| `repixelizer` | GameCult/repixelizer | `main` | |
|
||
|
|
| `streampixels` | GameCult/StreamPixels | `main` | two units, one target |
|
||
|
|
| `gjallar` | GameCult/Gjallar | `codex/yggdrasil-aggregate-daemon` | |
|
||
|
|
|
||
|
|
Seven of eleven are pinned to a non-`main` branch. That is its own problem — the
|
||
|
|
swarm goal is everyone on `main` and current with each other — and migrating a
|
||
|
|
target is the moment to fix its ref, not to copy it forward.
|
||
|
|
|
||
|
|
## When these files die
|
||
|
|
|
||
|
|
When every target above has a binding and a recipe, and `idunn serve` owns
|
||
|
|
actuation on yggdrasil. At that point delete the sudoers grant first, then the
|
||
|
|
script, then `/srv/odin/deploy-manifests/`. The grant is the privileged half; it
|
||
|
|
should not outlive its consumer.
|