mirror of
https://github.com/hanzoai/s3.git
synced 2026-10-30 14:59:09 +00:00
zeekayandHanzo Dev
af0f387bbe
The binary is s3 and the product is Hanzo S3; the rest of the tree now says so too. - Environment: WEED_* and SEAWEEDFS_* are S3_*, no aliases. fla9's flag prefix is S3, matching viper's existing "s3" prefix, so the S3_S3_SSE_* names mini.go exports are the ones viper reads (WEED_S3_SSE_KEK was never seen once viper moved to "s3"). - Java and Hadoop: packages, fs.hanzofs.* keys and the hanzofs:// scheme under the hanzofs namespace the protos already declare; classes take a neutral Filer prefix and file names match them again (the earlier pass left Seas3*.java holding Seaweed* classes). Client, hdfs3, examples, s3copier, random_access and the Spark tests compile. - Helm chart: helpers are hanzo.*, values live under global.s3; the chart renders and lints, which it did not before. - Terraform: the s3.service.tftpl reference matches the file; 12/12 render tests pass. Config paths point at /etc/hanzo, which the binary reads. - loadtest.pb.go regenerated from loadtest.proto. - Upstream logo, sponsor images and unreferenced diagrams removed from note/. Kept: NOTICE attribution, LICENSE, the erasure-coding fixture s3/storage/erasure_coding/1.dat (test bytes), and unmaintained/ and third_party/ (vendored). No on-disk format, wire protocol or metadata key changed. Co-authored-by: Hanzo Dev <[email protected]>
69 lines
2.2 KiB
Terraform
69 lines
2.2 KiB
Terraform
locals {
|
|
components = ["master", "volume", "filer", "client"]
|
|
ip_sans = distinct(concat(["127.0.0.1"], var.ip_sans))
|
|
}
|
|
|
|
# ---- CA ---------------------------------------------------------------------
|
|
resource "tls_private_key" "ca" {
|
|
algorithm = var.key_algorithm
|
|
ecdsa_curve = var.ecdsa_curve
|
|
rsa_bits = var.rsa_bits
|
|
}
|
|
|
|
resource "tls_self_signed_cert" "ca" {
|
|
private_key_pem = tls_private_key.ca.private_key_pem
|
|
is_ca_certificate = true
|
|
|
|
subject {
|
|
common_name = "Hanzo S3 CA"
|
|
organization = "Hanzo S3"
|
|
}
|
|
|
|
validity_period_hours = var.ca_validity_hours
|
|
allowed_uses = ["cert_signing", "crl_signing", "digital_signature"]
|
|
}
|
|
|
|
# ---- per-component leaf certs (distinct CN per component) --------------------
|
|
resource "tls_private_key" "component" {
|
|
for_each = toset(local.components)
|
|
algorithm = var.key_algorithm
|
|
ecdsa_curve = var.ecdsa_curve
|
|
rsa_bits = var.rsa_bits
|
|
}
|
|
|
|
resource "tls_cert_request" "component" {
|
|
for_each = toset(local.components)
|
|
private_key_pem = tls_private_key.component[each.key].private_key_pem
|
|
|
|
subject {
|
|
# Distinct CN per component so peer-identity authZ (allowed_wildcard_domain
|
|
# / allowed_commonNames) is meaningful. Do NOT use one CN for all.
|
|
common_name = "${each.key}.${var.internal_domain}"
|
|
organization = "Hanzo S3"
|
|
}
|
|
|
|
dns_names = distinct(concat(
|
|
["${each.key}.${var.internal_domain}", "localhost"],
|
|
var.extra_dns_sans,
|
|
))
|
|
ip_addresses = local.ip_sans
|
|
}
|
|
|
|
resource "tls_locally_signed_cert" "component" {
|
|
for_each = toset(local.components)
|
|
cert_request_pem = tls_cert_request.component[each.key].cert_request_pem
|
|
ca_private_key_pem = tls_private_key.ca.private_key_pem
|
|
ca_cert_pem = tls_self_signed_cert.ca.cert_pem
|
|
|
|
validity_period_hours = var.cert_validity_hours
|
|
early_renewal_hours = var.cert_early_renewal_hours
|
|
allowed_uses = ["digital_signature", "key_agreement", "server_auth", "client_auth"]
|
|
}
|
|
|
|
# ---- JWT signing keys -------------------------------------------------------
|
|
resource "random_password" "jwt" {
|
|
for_each = var.generate_jwt ? toset(["signing", "signing_read", "filer_signing", "filer_signing_read"]) : toset([])
|
|
length = var.jwt_length
|
|
special = false # TOML-safe
|
|
}
|