mirror of
https://github.com/hanzoai/s3.git
synced 2026-10-30 14:59:09 +00:00
zeekayandHanzo Dev
af0f387bbe
The binary is s3 and the product is Hanzo S3; the rest of the tree now says so too. - Environment: WEED_* and SEAWEEDFS_* are S3_*, no aliases. fla9's flag prefix is S3, matching viper's existing "s3" prefix, so the S3_S3_SSE_* names mini.go exports are the ones viper reads (WEED_S3_SSE_KEK was never seen once viper moved to "s3"). - Java and Hadoop: packages, fs.hanzofs.* keys and the hanzofs:// scheme under the hanzofs namespace the protos already declare; classes take a neutral Filer prefix and file names match them again (the earlier pass left Seas3*.java holding Seaweed* classes). Client, hdfs3, examples, s3copier, random_access and the Spark tests compile. - Helm chart: helpers are hanzo.*, values live under global.s3; the chart renders and lints, which it did not before. - Terraform: the s3.service.tftpl reference matches the file; 12/12 render tests pass. Config paths point at /etc/hanzo, which the binary reads. - loadtest.pb.go regenerated from loadtest.proto. - Upstream logo, sponsor images and unreferenced diagrams removed from note/. Kept: NOTICE attribution, LICENSE, the erasure-coding fixture s3/storage/erasure_coding/1.dat (test bytes), and unmaintained/ and third_party/ (vendored). No on-disk format, wire protocol or metadata key changed. Co-authored-by: Hanzo Dev <[email protected]>
75 lines
2.2 KiB
Terraform
75 lines
2.2 KiB
Terraform
# =============================================================================
|
|
# Local mTLS test harness: generate the CA + component certs + JWT keys with the
|
|
# security submodule, render security.toml with the core, then run a real
|
|
# master+volume+filer cluster with mTLS enabled on 127.0.0.1 and assert it works.
|
|
# Proves the generated security material is valid and accepted by s3.
|
|
# =============================================================================
|
|
|
|
terraform {
|
|
required_version = ">= 1.3.0"
|
|
}
|
|
|
|
variable "s3_binary" {
|
|
type = string
|
|
default = "/usr/bin/s3"
|
|
}
|
|
|
|
variable "workdir" {
|
|
type = string
|
|
default = "/tmp/s3-tftest-secure"
|
|
}
|
|
|
|
module "security" {
|
|
source = "../../modules/security"
|
|
internal_domain = "s3.internal"
|
|
ip_sans = ["127.0.0.1"]
|
|
cert_dir = "${var.workdir}/certs"
|
|
}
|
|
|
|
module "core" {
|
|
source = "../../modules/core"
|
|
s3_binary = var.s3_binary
|
|
enable_security = true
|
|
security = module.security.core_security
|
|
# We read security.toml back from the output and place it ourselves (under
|
|
# $HOME/.s3), so keep it in the rendered file set.
|
|
render_secret_files = true
|
|
|
|
# High, distinct ports so this never collides with a running Hanzo S3 or the
|
|
# non-secure harness.
|
|
master = {
|
|
nodes = { m0 = { address = "127.0.0.1", port = 29336, data_dir = "${var.workdir}/master-m0" } }
|
|
election_timeout = "3s"
|
|
heartbeat_interval = "200ms"
|
|
}
|
|
volume = {
|
|
nodes = { v0 = { address = "127.0.0.1", port = 28081, data_dirs = [{ path = "${var.workdir}/volume-v0", max_volumes = 20 }] } }
|
|
}
|
|
filer = {
|
|
nodes = { f0 = { address = "127.0.0.1", port = 28889, data_dir = "${var.workdir}/filer-f0" } }
|
|
}
|
|
}
|
|
|
|
output "cluster" {
|
|
sensitive = true
|
|
value = {
|
|
for name, n in module.core.nodes : name => {
|
|
role = n.role
|
|
http_port = n.ports.http
|
|
data_dirs = n.data_dirs
|
|
argv = n.argv
|
|
env = n.env
|
|
}
|
|
}
|
|
}
|
|
|
|
output "security_toml" {
|
|
sensitive = true
|
|
value = module.core.secret_files_by_node["master-m0"]["/etc/hanzo/security.toml"]
|
|
}
|
|
|
|
output "certs" {
|
|
sensitive = true
|
|
value = [for m in module.security.secret_manifest : { path = m.path, mode = m.mode, content = module.security.secret_contents[m.key] }]
|
|
}
|