mirror of
https://github.com/block/buzz.git
synced 2026-10-28 04:51:40 +00:00
f249710331
## Why Phase 1 of progressive delivery needs an explicit eligibility boundary before deployment automation can safely consume relay artifacts. Today the canonical Docker workflow can publish independently of the same-SHA CI result, the relay does not expose its source/build identity, and the Helm chart only renders mutable tags. The existing `ghcr.io/block/buzz-staging-dev` workflow in #6709 remains a manual pre-merge preview lane. It is deliberately not a canonical promotion input. ## What changed - Compile the full source SHA and GitHub Actions build identity into canonical relay binaries and expose it at `/_status`. - Gate creation of tagged multi-architecture manifests on the latest exact-SHA `CI` push run succeeding on `main` or `release`. - Preserve the signed SLSA provenance and add a signed, release-only deployment-eligibility predicate with source, build run, qualifying CI run, and exact compatible Buzz chart version. - Keep failed or pending builds untagged and without an eligibility predicate; preview-package artifacts are excluded by package and signer contract. - Add optional `image.digest` support to Buzz chart `0.1.8`, retaining the existing tag fallback. - Document verification and the intentional boundary between image/chart compatibility and backwards-compatible database migrations. ## Risk and rollout Canonical tag publication now waits for same-SHA CI and fails closed when the newest matching run fails. Per-architecture blobs may remain untagged after a failed qualification; they are not promotion inputs. Debug manifests are also CI-gated but do not receive the release eligibility predicate. There are no migration or schema-orchestration changes. The companion BuilderBot infrastructure PR will pin a separately verified canonical main digest and expose a read-only running-deployment inspection command. Signed eligibility is available only for artifacts published after this workflow lands. ## Verification - Blox: workflow contract fixtures, including stale-green rejection and predicate structure - Blox: `actionlint` for `ci.yml` and `docker.yml` - Blox: 46 Helm unit tests, chart lint, and production/quickstart render fixtures - Blox: relay status unit test, workspace Rust formatting, and workspace all-target clippy - Live evidence: exact-SHA CI selector chose successful run `32857345153` for source `9d1e4b257657f382d3111ce748f3da8d063b7671` - Existing canonical digest provenance verified with `gh attestation verify` ## References - #6709 — developer-preview precursor; intentionally separate from canonical eligibility - `docs/deployment-identity.md` *Generated with Codex* --------- Signed-off-by: Luke Tornquist <tornquist@squareup.com>
308 lines
11 KiB
JSON
308 lines
11 KiB
JSON
{
|
|
"$schema": "https://json-schema.org/draft/2020-12/schema",
|
|
"title": "Buzz Helm chart values",
|
|
"description": "Schema for values.yaml. Catches misconfiguration at `helm install` time before _validate.tpl runtime fails. Both layers are intentional: schema rejects malformed inputs; templates reject inconsistent combinations.",
|
|
"type": "object",
|
|
"additionalProperties": true,
|
|
"properties": {
|
|
"quickstart": {
|
|
"type": "boolean",
|
|
"description": "Master toggle for evaluation profile (enables postgresql + redis subcharts and chart-side autogen). Not GitOps-safe."
|
|
},
|
|
"image": {
|
|
"type": "object",
|
|
"additionalProperties": false,
|
|
"properties": {
|
|
"repository": { "type": "string", "minLength": 1 },
|
|
"tag": { "type": "string" },
|
|
"digest": {
|
|
"type": "string",
|
|
"pattern": "^$|^sha256:[0-9a-f]{64}$",
|
|
"description": "Optional immutable OCI image digest. When set, the chart renders repository@digest and ignores tag."
|
|
},
|
|
"pullPolicy": { "type": "string", "enum": ["Always", "IfNotPresent", "Never"] },
|
|
"pullSecrets": {
|
|
"type": "array",
|
|
"items": { "type": "object", "required": ["name"], "properties": { "name": { "type": "string" } } }
|
|
}
|
|
},
|
|
"required": ["repository", "pullPolicy"]
|
|
},
|
|
"replicaCount": {
|
|
"type": "integer",
|
|
"minimum": 1,
|
|
"description": "Replica count for the relay Deployment. replicaCount > 1 requires Redis (for buzz-pubsub) — enforced by _validate.tpl. Git storage does NOT need ReadWriteMany: git state is object-store-backed and repo names live in Postgres, so ReadWriteOnce is fine per replica."
|
|
},
|
|
"relayUrl": {
|
|
"type": "string",
|
|
"pattern": "^(wss?://.+)?$",
|
|
"description": "Public wss:// URL clients connect to. Required (validated by _validate.tpl). Drives RELAY_URL, default mediaBaseUrl, default ingress host."
|
|
},
|
|
"mediaBaseUrl": {
|
|
"type": "string",
|
|
"pattern": "^(https?://.+)?$"
|
|
},
|
|
"ownerPubkey": {
|
|
"type": "string",
|
|
"pattern": "^([0-9a-f]{64})?$",
|
|
"description": "64-char lowercase hex Nostr pubkey of the relay operator. Required when relay.requireRelayMembership=true."
|
|
},
|
|
"secrets": {
|
|
"type": "object",
|
|
"additionalProperties": false,
|
|
"properties": {
|
|
"existingSecret": { "type": "string", "description": "Name of an externally managed Secret. Production / GitOps path." },
|
|
"relayPrivateKey": { "type": "string" },
|
|
"gitHookHmacSecret": { "type": "string" }
|
|
}
|
|
},
|
|
"relay": {
|
|
"type": "object",
|
|
"additionalProperties": true,
|
|
"properties": {
|
|
"bindAddr": { "type": "string", "minLength": 1 },
|
|
"maxConnections": { "type": "integer", "minimum": 1 },
|
|
"maxConcurrentHandlers": { "type": "integer", "minimum": 1 },
|
|
"sendBuffer": { "type": "integer", "minimum": 1 },
|
|
"drainJitterMs": { "type": "integer", "minimum": 0 },
|
|
"requireAuthToken": { "type": "boolean" },
|
|
"requireRelayMembership": { "type": "boolean" },
|
|
"allowNipOaAuth": { "type": "boolean" },
|
|
"huddleAudioAvailable": {
|
|
"type": ["boolean", "null"],
|
|
"description": "Whether relay huddle audio is available. null means chart default: true for one replica, false for replicaCount > 1. Explicit true with replicaCount > 1 means the operator accepts/owns external multi-pod audio/SFU behavior."
|
|
},
|
|
"pubkeyAllowlist": { "type": "boolean" },
|
|
"corsOrigins": {
|
|
"type": "array",
|
|
"items": { "type": "string" }
|
|
},
|
|
"ephemeralTtlOverride": { "type": "integer", "minimum": 0 },
|
|
"command": {
|
|
"type": "array",
|
|
"items": { "type": "string" },
|
|
"description": "Optional relay container entrypoint override. Empty preserves the image default."
|
|
},
|
|
"args": {
|
|
"type": "array",
|
|
"items": { "type": "string" },
|
|
"description": "Optional relay container arguments override. Empty preserves the image default."
|
|
},
|
|
"extraVolumeMounts": {
|
|
"type": "array",
|
|
"items": { "type": "object" },
|
|
"description": "Raw Kubernetes volumeMount fragments appended to the relay container."
|
|
}
|
|
}
|
|
},
|
|
"extraInitContainers": {
|
|
"type": "array",
|
|
"items": { "type": "object" },
|
|
"description": "Raw Kubernetes init-container fragments appended to the relay Pod."
|
|
},
|
|
"extraVolumes": {
|
|
"type": "array",
|
|
"items": { "type": "object" },
|
|
"description": "Raw Kubernetes volume fragments appended to the relay Pod."
|
|
},
|
|
"service": {
|
|
"type": "object",
|
|
"additionalProperties": true,
|
|
"properties": {
|
|
"type": { "type": "string", "enum": ["ClusterIP", "NodePort", "LoadBalancer"] },
|
|
"port": { "type": "integer", "minimum": 1, "maximum": 65535 },
|
|
"healthPort": { "type": "integer", "minimum": 1, "maximum": 65535 },
|
|
"metricsPort": { "type": "integer", "minimum": 1, "maximum": 65535 }
|
|
}
|
|
},
|
|
"serviceAccount": {
|
|
"type": "object",
|
|
"additionalProperties": false,
|
|
"properties": {
|
|
"create": { "type": "boolean" },
|
|
"name": { "type": "string" },
|
|
"annotations": { "type": "object" }
|
|
}
|
|
},
|
|
"podDisruptionBudget": {
|
|
"type": "object",
|
|
"additionalProperties": false,
|
|
"properties": {
|
|
"enabled": { "type": "boolean" },
|
|
"minAvailable": { "oneOf": [{ "type": "integer" }, { "type": "string" }] },
|
|
"maxUnavailable": { "oneOf": [{ "type": "integer" }, { "type": "string" }] }
|
|
}
|
|
},
|
|
"ingress": {
|
|
"type": "object",
|
|
"additionalProperties": true,
|
|
"properties": {
|
|
"enabled": { "type": "boolean" },
|
|
"className": { "type": "string" },
|
|
"annotations": { "type": "object" },
|
|
"hosts": { "type": "array" },
|
|
"tls": { "type": "array" }
|
|
}
|
|
},
|
|
"httproute": {
|
|
"type": "object",
|
|
"additionalProperties": true,
|
|
"properties": {
|
|
"enabled": { "type": "boolean" },
|
|
"parentRefs": { "type": "array" },
|
|
"hostnames": { "type": "array", "items": { "type": "string" } },
|
|
"rules": { "type": "array" }
|
|
}
|
|
},
|
|
"persistence": {
|
|
"type": "object",
|
|
"additionalProperties": false,
|
|
"properties": {
|
|
"git": {
|
|
"type": "object",
|
|
"additionalProperties": false,
|
|
"properties": {
|
|
"enabled": { "type": "boolean" },
|
|
"mountPath": { "type": "string", "minLength": 1 },
|
|
"storageClass": { "type": "string" },
|
|
"accessMode": { "type": "string", "enum": ["ReadWriteOnce", "ReadWriteMany", "ReadOnlyMany", "ReadWriteOncePod"] },
|
|
"size": { "type": "string", "pattern": "^[0-9]+(\\.[0-9]+)?(E|P|T|G|M|K|Ei|Pi|Ti|Gi|Mi|Ki)?$" },
|
|
"annotations": { "type": "object" },
|
|
"existingClaim": { "type": "string" }
|
|
}
|
|
}
|
|
}
|
|
},
|
|
"postgresql": {
|
|
"type": "object",
|
|
"additionalProperties": true,
|
|
"properties": { "enabled": { "type": "boolean" } }
|
|
},
|
|
"externalPostgresql": {
|
|
"type": "object",
|
|
"additionalProperties": false,
|
|
"properties": {
|
|
"url": { "type": "string", "pattern": "^(postgres(ql)?://.+)?$" }
|
|
}
|
|
},
|
|
"redis": {
|
|
"type": "object",
|
|
"additionalProperties": true,
|
|
"properties": { "enabled": { "type": "boolean" } }
|
|
},
|
|
"externalRedis": {
|
|
"type": "object",
|
|
"additionalProperties": false,
|
|
"properties": {
|
|
"url": { "type": "string", "pattern": "^(rediss?://.+)?$" }
|
|
}
|
|
},
|
|
"s3": {
|
|
"type": "object",
|
|
"additionalProperties": false,
|
|
"properties": {
|
|
"endpoint": { "type": "string", "pattern": "^(https?://.+)?$" },
|
|
"bucket": { "type": "string", "minLength": 1 },
|
|
"region": {
|
|
"type": "string",
|
|
"minLength": 1,
|
|
"description": "S3 region used for SigV4 signing by the relay and deletion operator. Defaults to us-east-1 for bundled MinIO/local deployments; set the provider region explicitly when it differs."
|
|
},
|
|
"addressingStyle": {
|
|
"type": "string",
|
|
"enum": ["path", "virtual"],
|
|
"description": "S3 URL style shared by media and Git/CAS clients. Defaults to path for bundled MinIO compatibility."
|
|
},
|
|
"accessKey": { "type": "string" },
|
|
"secretKey": { "type": "string" }
|
|
}
|
|
},
|
|
"minio": {
|
|
"type": "object",
|
|
"additionalProperties": false,
|
|
"properties": {
|
|
"enabled": { "type": "boolean" },
|
|
"image": { "type": "string", "minLength": 1 },
|
|
"mcImage": { "type": "string", "minLength": 1 },
|
|
"persistence": {
|
|
"type": "object",
|
|
"additionalProperties": false,
|
|
"properties": {
|
|
"enabled": { "type": "boolean" },
|
|
"size": { "type": "string", "pattern": "^[0-9]+(\\.[0-9]+)?(E|P|T|G|M|K|Ei|Pi|Ti|Gi|Mi|Ki)?$" }
|
|
}
|
|
}
|
|
}
|
|
},
|
|
"git": {
|
|
"type": "object",
|
|
"additionalProperties": false,
|
|
"properties": {
|
|
"maxPackBytes": { "type": "integer", "minimum": 1 },
|
|
"packCachePath": { "type": "string", "minLength": 1 },
|
|
"packCacheMaxBytes": { "type": "integer", "minimum": 0 },
|
|
"packCacheMaxConcurrentPopulations": { "type": "integer", "minimum": 1 },
|
|
"packCacheVolumeSize": { "type": "string", "pattern": "^[0-9]+(\\.[0-9]+)?(E|P|T|G|M|K|Ei|Pi|Ti|Gi|Mi|Ki)?$" },
|
|
"maxReposPerPubkey": { "type": "integer", "minimum": 1 },
|
|
"maxConcurrentOps": { "type": "integer", "minimum": 1 }
|
|
}
|
|
},
|
|
"migrate": {
|
|
"type": "object",
|
|
"additionalProperties": false,
|
|
"properties": {
|
|
"autoMigrate": { "type": "boolean" },
|
|
"preUpgradeJob": {
|
|
"type": "object",
|
|
"additionalProperties": false,
|
|
"properties": {
|
|
"enabled": { "type": "boolean" },
|
|
"resources": { "type": "object" },
|
|
"backoffLimit": { "type": "integer", "minimum": 0 },
|
|
"activeDeadlineSeconds": { "type": "integer", "minimum": 1 }
|
|
}
|
|
}
|
|
}
|
|
},
|
|
"serviceMonitor": {
|
|
"type": "object",
|
|
"additionalProperties": false,
|
|
"properties": {
|
|
"enabled": { "type": "boolean" },
|
|
"namespace": { "type": "string" },
|
|
"interval": { "type": "string" },
|
|
"scrapeTimeout": { "type": "string" },
|
|
"labels": { "type": "object" }
|
|
}
|
|
},
|
|
"pairingRelay": {
|
|
"type": "object",
|
|
"additionalProperties": false,
|
|
"properties": {
|
|
"enabled": { "type": "boolean" },
|
|
"url": {
|
|
"type": "string",
|
|
"pattern": "^(wss?://.+)?$",
|
|
"description": "Public WebSocket URL advertised to clients for NIP-AB device pairing."
|
|
},
|
|
"replicaCount": { "type": "integer", "minimum": 1 },
|
|
"service": {
|
|
"type": "object",
|
|
"additionalProperties": false,
|
|
"properties": {
|
|
"type": { "type": "string", "enum": ["ClusterIP", "NodePort", "LoadBalancer"] },
|
|
"port": { "type": "integer", "minimum": 1, "maximum": 65535 },
|
|
"annotations": { "type": "object" }
|
|
}
|
|
},
|
|
"podAnnotations": { "type": "object" },
|
|
"podLabels": { "type": "object" },
|
|
"resources": { "type": "object" }
|
|
}
|
|
},
|
|
"extraManifests": {
|
|
"type": "array"
|
|
}
|
|
}
|
|
}
|