deploy/oden-mirror/holger-c.ron
// C — the ON-PREM MIRROR, as it runs on `oden`.
//
// The estate's story has always been "A promotes to B in the cloud, C pulls it
// down on-prem", and until this file there was no C: one holger existed
// (holger.rs) and every claim about the network path, the credential and the
// change map was a claim about a machine that did not exist.
//
// WHERE C RUNS AND WHY. oden — a 32-core box on a different machine and a
// different network from holger.rs, reaching it over the real public internet
// (holger.rs:50051, 95.111.208.165). Not a second process on holger.rs: a
// downstream co-resident with its upstream proves nothing about the path, the
// credential or the mirror. Not a bought VM either, and not a KVM guest: a guest
// on oden would add a virtual NIC to the picture and prove nothing more than the
// host already does, since the property under test is "a DIFFERENT box, over the
// real internet, ends up byte-identical".
//
// C IS A CONSUMER. It reads holger.rs over the public artifact door and writes
// only into its own store. Nothing here reaches back.
//
// CREDENTIAL: none. holger.rs serves reads open (`auth: Some((methods: [],
// require_auth_for_reads: false))`), so the mirror needs no secret and this file
// says `Anonymous` rather than implying one. The CREDENTIALLED path —
// `ron_credential: Vault(ron_vault_path:, ron_entry:)`, the shape
// `agent/lib/src/creds.rs` defines — parses here and is REFUSED at boot by name,
// because holger-server links no vault. It is therefore UNPROVEN end to end.
(
repositories: [
// The two repositories holger.rs serves, same names, same types.
( ron_name: "bundles", ron_repo_type: "raw", ron_upstreams: [], ron_in: None,
ron_out: Some((ron_storage_endpoint: "store", ron_exposed_endpoint: "doors")),
ron_data_dir: Some("/home/rickard/holger-c/store/bundles") ),
( ron_name: "crates", ron_repo_type: "rust", ron_upstreams: [], ron_in: None,
ron_out: Some((ron_storage_endpoint: "store", ron_exposed_endpoint: "doors")),
ron_data_dir: Some("/home/rickard/holger-c/store/crates") ),
],
exposed_endpoints: [
// 50061, not 50051: oden already runs korp-server on 50051.
(ron_name: "doors", ron_url: "127.0.0.1:50061", ron_http_url: Some("127.0.0.1:8453")),
],
storage_endpoints: [
(ron_name: "store", ron_storage_type: "znippy", ron_path: "/home/rickard/holger-c/store"),
],
auth: Some((methods: [], require_auth_for_reads: false)),
// THE MIRROR. This block is the whole point of the lane: before it, holger
// had a change-map engine and no way to say "mirror that".
mirror: Some((
// Change maps live here, one Arrow-IPC file per (upstream, repository).
// This directory is what makes a RESTART cheap: wipe it and the next
// cycle re-fetches everything, correctly, because the mirror then has no
// evidence it holds anything.
ron_state_dir: "holger-mirror",
ron_sources: [
(
ron_name: "holger-rs",
ron_kind: Holger,
ron_endpoint: "http://holger.rs:50051",
ron_credential: Anonymous,
ron_every_secs: 300,
ron_repositories: [
// DEFAULT policy. holger's ListArtifacts publishes no digest,
// so a coordinate seen before whose size has not moved is
// `unproven` — and Refetch takes it again rather than
// assuming a same-size edit never happens. This pair pays
// bandwidth for correctness.
( ron_from: "crates", ron_to: "crates" ),
// OPT-IN. Bundles are published under immutable coordinates
// here, so this pair accepts the same-size blind spot in
// exchange for a cycle that moves nothing. The `unproven`
// count is still reported every cycle either way.
( ron_from: "bundles", ron_to: "bundles", ron_unproven: TrustSize ),
],
),
],
)),
)