Provision /etc/allod/env.json environment-capability descriptor #2

Closed
opened 2026-07-11 13:01:27 +01:00 by vnprc · 1 comment
Owner

Problem

Environment capabilities are implicit in Forgejo ACLs. The public tooling
(allod/tools#99) needs one source of truth to read. The VM's own config already
knows whether it's isolated — this issue surfaces that as a descriptor on disk.

Scope (vnprc/nexus, + vnprc/inventory if needed)

  • Ensure inventory encodes — or nexus can derive — per VM: can_read_private,
    can_push_public, forge_identity. If already derivable from
    forge_key/identity, derive in nexus; otherwise add the fields in inventory.
  • At provision/rebuild, render /etc/allod/env.json (schema per allod/tools#99:
    hostname, forge_identity, can_read_private, can_push_public, reachable_repos, summary) plus a human-readable /etc/allod/env.txt, world-readable.
  • Source all values from inventory so there is exactly one source of truth.

Done when

A provisioned VM has a correct /etc/allod/env.json + env.txt; allod env
(allod/tools#99) reads them; validated against generated artifacts / fixtures.
Rebuild is host-only — capture exact commands + expected output for the human.

Public counterpart: allod/tools#99

## Problem Environment capabilities are implicit in Forgejo ACLs. The public tooling (allod/tools#99) needs one source of truth to read. The VM's own config already knows whether it's isolated — this issue surfaces that as a descriptor on disk. ## Scope (vnprc/nexus, + vnprc/inventory if needed) - [ ] Ensure inventory encodes — or nexus can derive — per VM: `can_read_private`, `can_push_public`, `forge_identity`. If already derivable from `forge_key`/identity, derive in nexus; otherwise add the fields in inventory. - [ ] At provision/rebuild, render `/etc/allod/env.json` (schema per allod/tools#99: `hostname, forge_identity, can_read_private, can_push_public, reachable_repos, summary`) plus a human-readable `/etc/allod/env.txt`, world-readable. - [ ] Source all values from inventory so there is exactly one source of truth. ## Done when A provisioned VM has a correct `/etc/allod/env.json` + `env.txt`; `allod env` (allod/tools#99) reads them; validated against generated artifacts / fixtures. Rebuild is host-only — capture exact commands + expected output for the human. Public counterpart: allod/tools#99
Author
Owner

oops wrong repo

oops wrong repo
vnprc closed this issue 2026-07-11 13:01:51 +01:00
Sign in to join this conversation.
No labels
No milestone
No project
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
allod/nexus#2
No description provided.