gamertan/tend
Archived
1
0
Fork 0
Code Issues Pull Requests Releases 3 Activity

feat: publish Tend v0.2 preview source

Browse Source 
Publish the reviewed allowlisted snapshot whose exact binary completed maintenance deployment, rollback, and reactivation exercises for Gamertan and Sandwich Hime.

Private-Source-Commit: 4d7094c8b7c61991bfb67b11fc1558724c874eb2

Private-Source-Tree: 54a2f74804f7acddf3755d7d4da5b97f5fc28381

AI-Assistance: OpenAI Codex assisted implementation, testing, security review, and release verification.
Signed-off-by: Cole Speelman <crspeelman@gmail.com>
This commit is contained in:
gamertan
2026-08-16 19:02:08 -04:00
parent b2cc4482f6
commit 00d1dd4209
47 changed files with 1590 additions and 124 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/ARCHITECTURE.md
+24 -9
View File
@@ -17,12 +17,26 @@ requires byte-identical output. The resulting archive contains only:
The external archive digest is the release identity used by deployment.
## Transport boundary
`tend push` sends one bounded protocol frame to a dedicated account through a
pinned OpenSSH host key. It uses an argument vector, disables config files,
forwarding, PTYs, local commands, and proxy commands, and requests exactly
`tend-receive-v1`. The account's forced command invokes only the root-owned
receiver. The receiver's root-owned policy maps an allowlisted service name to
one exact configuration path and size ceiling.
The target receives no source, repository credential, Go cache, dependency, or
arbitrary command. The artifact digest must equal both the produced digest and
the separately supplied approved digest before it is staged.
## Target-host boundary
`tend deploy` runs on the Linux target. Transfer and SSH authentication stay
outside Tend v0.1; application-local transfer commands move the artifact and
the identical Tend binary to a root-controlled staging directory. Tend then
requires the expected digest to be repeated as a separately approved digest.
Schema-2 configurations live below `/etc/tend/services/`. Secrets live only in
separate `/etc/tend/environment/*.env` files that are root-owned, non-symlink,
and mode `0600`. Configurations contain the path, never the values. Candidate
and installed units read the same file; Tend overrides only the candidate's
loopback listen address.
Dry-run validation extracts into a temporary directory and does not touch the
release tree. Activation acquires the shared lock, installs a content-addressed
@@ -39,8 +53,9 @@ Singleton mode starts the new release in a hardened transient systemd unit on a
separate loopback address, probes it, stops the candidate, changes the current
release pointer, and restarts the installed singleton unit.
Any failure before state persistence restores the previously observed Caddy
bytes and/or release pointers. Rollback is a separate explicit command over the
recorded state. It rechecks health and readiness, but deliberately does not
apply the current release's content markers to an older release whose routes
may differ. Pruning preserves both active and previous releases.
After the local post-activation probes, Tend also checks configured HTTPS public
origins. Any failure before state persistence restores the previously observed
Caddy bytes and/or release pointers. Rollback is a separate explicit command
over the recorded state. It rechecks local health/readiness and public reachability,
but deliberately does not apply a future release's content marker to an older
release whose routes may differ. Pruning preserves both active and previous releases.