3d9a08d0be
flyedge.service runs /opt/fly/current/fly-edge After= and Requires= flysim.service, with its metrics on loopback :9102 and a ConditionPathExists so a release without the binary leaves it inactive. It is in no target and 07-enable.sh does not enable it; the header has the switch and the way back. build-flysim.sh also builds fly-edge beside the flysim binary and package-release.sh ships it when present. 05-deploy.sh writes FLY_FEED_VIA (default direct) into fly.env, flysim.service names FLY_BUS_DIR=/run/fly/bus and tmpfiles creates it. Watchdog check 2 reads the feed counters from whoever serves the feed: flyedge when fly.env says bus. lint.sh holds all of that, and drives check 2's choice against a fixture.
39 lines
2.2 KiB
Text
39 lines
2.2 KiB
Text
# infra/config/fly-tmpfiles.conf — pushed to /etc/tmpfiles.d/fly.conf.
|
|
# docs/design/infra.md section 2, plus two additions noted inline (marked
|
|
# ADDED, not in the original design list) needed by the secrets table and
|
|
# the watchdog escalation gate in section 3.
|
|
d /run/fly 0750 fly fly -
|
|
d /run/fly/pulse 0750 fly fly -
|
|
d /run/fly/state 0750 fly fly -
|
|
d /run/fly/wd 0750 fly fly -
|
|
# ADDED: the feed bus (FLY_FEED_VIA=bus, docs/design/flybus.md): flysim's
|
|
# router socket and artifact store. flysim also creates it, 0700, on start.
|
|
d /run/fly/bus 0700 fly fly -
|
|
d /var/lib/fly 0750 fly fly -
|
|
d /var/lib/fly/chrome 0700 fly fly -
|
|
d /srv/fly/state 0750 fly fly -
|
|
d /srv/fly/media/rec 0750 fly fly -
|
|
d /srv/fly/media/highlights 0750 fly fly -
|
|
d /etc/fly 0755 root root -
|
|
d /etc/fly/creds 0700 root root -
|
|
# ADDED: bridge refresh tokens, per infra.md's secrets table
|
|
# (/var/lib/fly/bridge/tokens.json, fly:fly 0600).
|
|
d /var/lib/fly/bridge 0750 fly fly -
|
|
# ADDED: watchdog's persistent reboot-rate gate
|
|
# (/var/lib/fly/wd/last-reboot, section 3 "gated ... so it cannot reboot
|
|
# more than once an hour"). /run/fly/wd above is tmpfs and clears on
|
|
# reboot, which is correct for the per-unit fail counters but wrong for
|
|
# the reboot gate itself.
|
|
d /var/lib/fly/wd 0750 fly fly -
|
|
# ADDED: ROM staging directory (section 6: "staged to /srv/fly/rom/<sha256>.gb, mode 0400 fly:fly").
|
|
d /srv/fly/rom 0750 fly fly -
|
|
# ADDED: the watchdog's Prometheus textfile sink (section 3, "Notification":
|
|
# /var/lib/node_exporter/textfile/fly_watchdog.prom, also written by
|
|
# bin/fly-retention and bin/fly-backup-stage). Nothing created it before, and
|
|
# /var/lib/node_exporter is root-owned ground that fly-watchdog — User=fly —
|
|
# cannot make for itself: on the P0 spike run 2 the directory did not exist,
|
|
# so every watchdog pass died on its own `mkdir -p` before running a single
|
|
# check. Owned by fly because the three scripts that write here all run as
|
|
# fly; world-readable because node_exporter scrapes it as `prometheus`.
|
|
d /var/lib/node_exporter 0755 root root -
|
|
d /var/lib/node_exporter/textfile 0755 fly fly -
|