admin343/run
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Keep run logs opaque and streamline transfers

Browse Source
This commit is contained in:
npc0-hue
2026-09-03 16:40:05 +08:00
parent 48dd540253
commit 330b1c0130
27 changed files with 429 additions and 673 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+5 -6
View File
@@ -60,13 +60,13 @@ go run ./cmd/run
Use `RUN_MODE=worker` when you want the executor to register, heartbeat, claim jobs, and execute lifecycle templates. Use `RUN_MODE=smoke` for a one-shot config summary.
Generated run and client-manager packages carry a secret-bearing JSON config created by platform. The config contains:
Generated run packages carry a secret-bearing JSON config created by platform. The config contains:
- component kind: `run` or `client-manager`.
- server instance ID, plugin ID, optional run endpoint ID, optional client-manager profile key.
- target OS/architecture, redacted `secret://runtime-keys/.../current` ref, key generation, and the raw current auth key needed by the remote executable.
- component kind: `run`.
- server instance ID, plugin ID, and optional run endpoint ID.
- target OS/architecture, logical `secret://runtime-keys/.../current` ref, key generation, and the raw current auth key needed by the remote executable.
The raw auth key is valid only while it matches the single current encrypted key stored in platform for that server/component. Resetting the run key or a client-manager key increments generation and makes older packages fail control hello authentication until the operator regenerates and redeploys the affected package. Local diagnostics and smoke summaries use fingerprints and secret refs, not raw keys.
The raw auth key is valid only while it matches the single current encrypted run key stored in platform for that server. Resetting the run key increments generation and makes older packages fail control hello authentication until the operator regenerates and redeploys the affected package. Local diagnostics and smoke summaries use fingerprints and secret refs, not raw keys.
In Docker, `RUN_PLATFORM_URL` must be `http://platform:8080` because `platform` is the compose service name. Locally, keep it as `http://127.0.0.1:8080`.
@@ -83,7 +83,6 @@ Run resolves plugin-declared runtime profiles using server runtime bindings supp
- `local-process`: run starts/stops the third-party server through scoped lifecycle action refs and tails stdout/stderr.
- `hosted-ftp-rcon`: run exposes only declared FTP/log/RCON adapters for hosted servers that cannot be started locally.
- `ftp-only`: run exposes declared FTP and log transfer surfaces without lifecycle or RCON control.
- `custom-client`: run coordinates with a plugin-declared companion client manager using a separate component key and profile ref.
Profile resolution returns logical capabilities, transport keys, declared log sources, discovery probes, and missing binding keys. It must not return raw host paths, FTP credentials, SQL DSNs, RCON passwords, direct sockets, or component auth keys.