mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-06 19:01:54 +00:00
kevinveenbirkenbachandClaude Opus 5
d80cad478a
Under swarm an unpinned role's volumes are rewritten onto the shared NFS
export while its services run one task per node. A role that declares no
RDBMS keeps its state in-process, so several replicas then write the same
SQLite file, Mnesia store or search index over NFS and corrupt it. This
already cost a deploy: openclaw ran three replicas against one shared
export and its state directory answered "file is not a database".
The existing unpinned-no-engine-volume lint states the right rule but
detects state through a hardcoded path list, so app-specific paths slip
through and each case gets pinned reactively after it fails. Add a lint
that joins three facts the roles already declare: the volume is NFS
backed (asked of the production swarm_nfs_backed, not re-derived), it is
mounted read-write, and the role runs no RDBMS. Share-safe payloads carry
a justification marker.
Replicas resolve service-first and fall back to the primary entity, and
a role whose swarm mode is disabled is skipped; both cases exist in tree.
Also correct the requirement and the design doc, which still described
the per-volume opt-in model that b09598dc8 replaced with placement
derived backing. Requirement 023 contradicted itself: line 76 already
described the implemented behaviour.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
27 lines
773 B
YAML
27 lines
773 B
YAML
---
|
|
# nocheck: embedded-state-on-nfs runs with --static-auth-secret and no --userdb, so no SQLite store is opened here
|
|
data:
|
|
name: coturn_data
|
|
type: volume
|
|
mounts:
|
|
- service: coturn
|
|
target: /var/lib/coturn
|
|
|
|
tls_cert:
|
|
type: config
|
|
source: "{{ lookup('cert', 'web-svc-coturn', 'files.cert') }}"
|
|
mode: "0444"
|
|
mounts:
|
|
- service: coturn
|
|
target: "{{ lookup('cert', 'web-svc-coturn', 'files.cert') }}"
|
|
when: "{{ lookup('tls', 'web-svc-coturn', 'enabled') | bool }}"
|
|
|
|
tls_key:
|
|
type: secret
|
|
source: "{{ lookup('cert', 'web-svc-coturn', 'files.key') }}"
|
|
mode: "0400"
|
|
mounts:
|
|
- service: coturn
|
|
target: "{{ lookup('cert', 'web-svc-coturn', 'files.key') }}"
|
|
when: "{{ lookup('tls', 'web-svc-coturn', 'enabled') | bool }}"
|