Replace zinit with hero_proc and add remote management with auth #1
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Summary
Replace
zinitprocess supervisor withhero_procin the gubuntu-installer image. The installed nodes (5 datacenter machines) must:hero_procas the process supervisorhero_procfor authenticated remote management over myceliumBackground
Current Architecture (zinit)
The installer currently bakes in
zinit+zinit_serverbinaries and the following service chain:Key files to replace:
config/zinit.service— systemd unit for zinitconfig/zinit/*.toml— zinit service definitionsconfig/zinit/call-home.sh— beacon registration scriptbuilder/lib/rootfs.sh→install_zinit()function (lines ~142-184)test/zinit_services.bats— zinit TOML validation testsNew Architecture (hero_proc)
hero_procis a Rust-based process supervisor with:requires,after,wants,conflicts)Repo: https://forge.ourworld.tf/lhumina_code/hero_proc
Detailed Requirements
Phase 1: Replace zinit with hero_proc in the image
1.1 Build System Changes (
builder/lib/rootfs.sh)install_zinit()withinstall_hero_proc()hero_procandhero_proc_serverbinaries from the Forgejo package registry (or build from source)/usr/local/bin/hero_proc_server(replacesconfig/zinit.service)/usr/local/bin/hero_proc_server/etc/hero_proc/services//run/hero_proc.socknetwork-online.targetmulti-user.target/etc/hero_proc/services/1.2 Service Definitions (new TOML format)
Convert existing zinit TOMLs to hero_proc format:
install-mycelium service:
mycelium service:
call-home service:
1.3 Update call-home.sh
hero_procendpoint informationProposed payload:
Phase 2: Remote Access & Security
The Problem
hero_proccurrently uses Unix socket permissions only for access control — no authentication, no TLS, no tokens. For remote management over the network, we need an authentication layer.Security Requirements
Proposed Approach: Pre-Shared Ed25519 Key Authentication
Recommended approach for the initial deployment:
At build time:
/etc/hero_proc/authorized_keys//etc/hero_proc/node_keyAt runtime (hero_proc_server):
Operator workflow:
Alternative Approaches to Consider
Decision Needed
Phase 3: hero_proc TCP Listener for Remote Access
3.1 Expose hero_proc over TCP
Currently hero_proc only listens on Unix sockets. For remote management we need it accessible over the network. Options:
[mycelium_ipv6]:9999to the Unix socket. This works today with no code changes to hero_proc.Recommendation: Start with Option A (xinet proxy) as it requires zero changes to hero_proc. The xinet service config:
3.2 Add hero_proc service for beacon registration
Create a new
hero-proc-remoteservice in the config that:Phase 4: Update Tests
test/zinit_services.batswith hero_proc service validation teststest/test-call-home.shE2E test for new payload formatPhase 5: Multi-Node Deployment
Boot Sequence (New)
Files to Modify
builder/lib/rootfs.shinstall_zinit()withinstall_hero_proc()config/zinit.serviceconfig/hero_proc.service(systemd unit)config/zinit/*.tomlconfig/hero_proc/*.toml(new format)config/zinit/call-home.shconfig/hero_proc/call-home.shconfig/build.confconfig/ssh-keys.listtest/zinit_services.batstest/test-call-home.shubuntu-installer-prd.mdREADME.mdNew Files
config/hero_proc.serviceconfig/hero_proc/install-mycelium.tomlconfig/hero_proc/mycelium.tomlconfig/hero_proc/call-home.tomlconfig/hero_proc/hero-proc-remote.tomlconfig/hero_proc/authorized_keys/Open Questions
hero_proc_port,hero_proc_auth_pubkey)?node-01throughnode-05)? Passed at install time via--hostname?Acceptance Criteria