| 1 |
# Bento daemon-local config (machine paths + listen). Install at |
| 2 |
# ~/.config/bento/bento-daemon.toml. The build matrix lives in the separate |
| 3 |
# topology file (bento.toml). |
| 4 |
# |
| 5 |
# These paths are NOT tilde-expanded by the daemon (it runs without a shell) — |
| 6 |
# use absolute paths. Replace /home/max with the daemon user's home. |
| 7 |
# |
| 8 |
# Auth (CF2): with a non-loopback `listen`, bentod REFUSES to start unless |
| 9 |
# BENTO_API_TOKEN is set (via the service's environment). On the loopback bind |
| 10 |
# below, build triggers are reachable only from this host, so no token is |
| 11 |
# required. To operate over the tailnet, bind the tailnet IP and set |
| 12 |
# BENTO_API_TOKEN (mirror Sando's sando.env model). |
| 13 |
|
| 14 |
listen = "127.0.0.1:8765" |
| 15 |
db_path = "/home/max/.local/state/bento/bento.db" |
| 16 |
topology_path = "/home/max/.config/bento/bento.toml" |
| 17 |
|
| 18 |
# Root of the Syncthing private layer; the recipe `secret()` host function reads |
| 19 |
# credential files (signing keys, notary creds) relative to here. Never logged. |
| 20 |
secrets_root = "/home/max/Code/_private" |
| 21 |
|
| 22 |
# Collected artifacts land at <dist_root>/<app>/<version>/<target>/ on this box. |
| 23 |
dist_root = "/home/max/Dist" |
| 24 |
|
| 25 |
# Per-step run logs: <logs_root>/<app>/<version>/<target>/<step>.<run_id>.log |
| 26 |
logs_root = "/home/max/.local/state/bento/logs" |
| 27 |
|
| 28 |
# Where finished artifacts end up for good, whichever host built them. Each |
| 29 |
# target's collect is deposited at <root>/<app>/<version>/<target>/ — the same |
| 30 |
# layout as dist_root above, so the local copy and the archived one are one tree |
| 31 |
# at two addresses. This is what makes "where is the AppImage for goingson 1.4.0" |
| 32 |
# have a single answer covering the macOS and Windows targets too. |
| 33 |
# |
| 34 |
# astra: always on, on the tailnet, already the aarch64 build host and the git |
| 35 |
# mirror, so it is the one box every other build host can reliably reach. `local` |
| 36 |
# deposits on this machine instead. The root is a path ON THE ARCHIVE HOST and is |
| 37 |
# never tilde-expanded. |
| 38 |
# |
| 39 |
# Leave the whole table out to skip archiving; artifacts then live only in |
| 40 |
# dist_root on whichever box runs bentod, and retention eventually prunes them. |
| 41 |
# With it set, a failed deposit fails that target's collect step — before sign |
| 42 |
# and publish — because a silently-skipped deposit makes the archive path wrong |
| 43 |
# for exactly the release nobody was watching. |
| 44 |
[archive] |
| 45 |
host = "astra" |
| 46 |
root = "/var/lib/bento/artifacts" |
| 47 |
|
| 48 |
# Optional, one table per app: hand that app's finished artifacts to a Sando, |
| 49 |
# which decides whether they advance a stage. Bento builds and packages; a |
| 50 |
# product Sando deploys needs its bytes to reach Sando, and this is the half |
| 51 |
# that moves them. |
| 52 |
# |
| 53 |
# Per target, after the recipe finishes: rsync the collect directory to |
| 54 |
# <staging_root>/<app>-<version>-<target>/ on `host`, then POST that path plus |
| 55 |
# the artifact record to sandod, which verifies the bundle against the record |
| 56 |
# and publishes it content-addressed, or refuses it and names the file that |
| 57 |
# drifted. |
| 58 |
# |
| 59 |
# host ssh destination of the box sandod runs on; `local` stages on this |
| 60 |
# machine. Usually the same box bentod is on, and still worth going |
| 61 |
# through ssh: sandod runs as `sando` and bentod as a user unit, so |
| 62 |
# `sando@fw13` lands the bytes owned by the process that has to |
| 63 |
# rename them, with no group or ACL on the staging directory. |
| 64 |
# staging_root Sando's release_root + /staging, ON THAT HOST. Sando refuses a |
| 65 |
# bundle staged anywhere else — publishing is an atomic rename, and |
| 66 |
# a staging dir on another filesystem would silently become a copy. |
| 67 |
# Rsynced with --delete, so name it exactly. |
| 68 |
# url sandod's base URL. Tailnet address, never a public one. |
| 69 |
# sando_app the id SANDO knows this product by, when it differs. Omit for |
| 70 |
# sandod's default product (the unprefixed mount); set it to route |
| 71 |
# to /apps/<id>/intake. |
| 72 |
# token_file sandod's bearer token, as a path relative to secrets_root. Omit |
| 73 |
# only against a loopback sandod that configured none. |
| 74 |
# |
| 75 |
# A failed handoff fails that target run, at a `handoff` step. Same argument as |
| 76 |
# the archive deposit, with more at stake: a build whose artifact never reached |
| 77 |
# the deploy controller has not done the job, and a silent skip means the release |
| 78 |
# nobody watched is the one Sando never heard about. |
| 79 |
# |
| 80 |
# [handoff.pom] |
| 81 |
# host = "sando@fw13" |
| 82 |
# staging_root = "/srv/sando/staging" |
| 83 |
# url = "http://100.103.89.95:7766" |
| 84 |
# sando_app = "pom" |
| 85 |
# token_file = "sando/api-token" |
| 86 |
|
| 87 |
# Optional: override the per-step wall-clock budget (seconds) for EVERY step, |
| 88 |
# replacing the per-kind defaults (build 90m, notarize 60m, sign 15m, ...). A |
| 89 |
# step that runs past its budget fails that step and unwinds the recipe, so a |
| 90 |
# hung command can't wedge a build. Leave unset to use the defaults. |
| 91 |
# step_timeout_secs = 5400 |
| 92 |
|
| 93 |
# Pin every build host to the release tag v<version> and verify they all report |
| 94 |
# the same commit before any target builds (default true). Turn off only to |
| 95 |
# build from an untagged commit. |
| 96 |
# pin_release_sha = true |
| 97 |
|
| 98 |
# The command that installs a service binary and restarts its unit, run on the |
| 99 |
# service host with `<staged-binary> <install-path> <unit>` appended. Bento never |
| 100 |
# installs or restarts anything itself: it stages bytes and calls this, and what |
| 101 |
# it calls is a root script that re-checks its own arguments. That way the |
| 102 |
# sudoers grant on a production box is ONE auditable script rather than a broad |
| 103 |
# install + systemctl grant. Only affects `kind = "service"` apps. |
| 104 |
# deploy_installer = "sudo /usr/local/lib/bento/install-service.sh" |
| 105 |
|