feat: the lnpp layer, nginx, PostgreSQL and Python with gunicorn (0059) #1

Merged

navigator merged 3 commits from feat/recipe into main 2026-10-16 03:50:35 -03:00

Conversation 0 Commits 3 Files changed 38 +3592 -2

navigator commented 2026-10-16 03:40:12 -03:00

Owner

Copy link

The first recipe of the lnpp layer (handbook decision 0059, handbook#90). It needs keel-web 0.3.0 (keel-web#12) for the route.

• The layer: bt-layer lnpp --parent web. It adds PostgreSQL 17, Python 3, gunicorn and python3-psycopg from Debian 13, with no pip.
• The database half is copied from keel-postgresql: the role has no password in the image, the server listens on the two loopback addresses, and 36pgsqlverify checks the password.
• The manifest lnpp.yaml has base: web. It declares PostgreSQL on mesh port 5432 and the shared db_password. Thus the pair of 0054 comes from the spec: see keel/instance.pair.example.yaml.
• The check page /keel-check/: keel-lnpp-check.socket holds /run/keel-lnpp/check.sock, and systemd starts keel-lnpp-check.service (gunicorn, user keel-check, hardened, no TCP port).
  • The page reads by peer authentication and has SELECT on one table.
  • 40lnpp-check writes the row, and a standby writes nothing.
• conf.d/zz-check fails the build if Apache is present, if a second manifest is on top, or if the page does not start from its socket.
• Tests:
  • bats with kcov, 100 percent of 6 files.
  • pytest, 100 percent of the lines and branches.
  • stack: the stack on a booted trixie container, and keel's schema check of the manifest and the 2 example specs.
  • appliance: allow_unpublished, because the first images are testing pre-releases.

The first recipe of the lnpp layer (handbook decision 0059, handbook#90). It needs keel-web 0.3.0 (keel-web#12) for the route. - The layer: `bt-layer lnpp --parent web`. It adds PostgreSQL 17, Python 3, gunicorn and python3-psycopg from Debian 13, with no pip. - The database half is copied from keel-postgresql: the role has no password in the image, the server listens on the two loopback addresses, and `36pgsqlverify` checks the password. - The manifest `lnpp.yaml` has `base: web`. It declares PostgreSQL on mesh port 5432 and the shared `db_password`. Thus the pair of 0054 comes from the spec: see `keel/instance.pair.example.yaml`. - The check page `/keel-check/`: `keel-lnpp-check.socket` holds `/run/keel-lnpp/check.sock`, and systemd starts `keel-lnpp-check.service` (gunicorn, user `keel-check`, hardened, no TCP port). - The page reads by peer authentication and has SELECT on one table. - `40lnpp-check` writes the row, and a standby writes nothing. - `conf.d/zz-check` fails the build if Apache is present, if a second manifest is on top, or if the page does not start from its socket. - Tests: - bats with kcov, 100 percent of 6 files. - pytest, 100 percent of the lines and branches. - `stack`: the stack on a booted trixie container, and keel's schema check of the manifest and the 2 example specs. - `appliance`: `allow_unpublished`, because the first images are testing pre-releases.

navigator added 1 commit 2026-10-16 03:40:12 -03:00

feat: the lnpp layer, nginx, PostgreSQL and Python with gunicorn (0059) ... 1869c22a9a

A layer on the web layer (bt-layer lnpp --parent web), as handbook
decision 0059 says. The database half is copied from keel-postgresql. The
manifest lnpp.yaml (base web) declares PostgreSQL on the mesh port and
the shared db_password secret, so the pair of 0054 comes from the spec.

The check page /keel-check/ is a WSGI application that gunicorn from
Debian serves on the unix socket of keel-lnpp-check.socket, as the system
user keel-check. It reads PostgreSQL by peer authentication, with SELECT
on one table only. firstboot.d/40lnpp-check writes the row it shows, on a
writable server only. Nginx reaches the socket through keel-web's include
directory. conf.d/zz-check fails the build on Apache, on a second manifest
on top, and on a page that does not start from its socket.

navigator added 1 commit 2026-10-16 03:44:55 -03:00

ci: the stack job reads keel and the manifests from the GitHub mirrors ... 64d3aefcfb

The containers of the runner do not reach git.pop.coop on port 443.

navigator added 1 commit 2026-10-16 03:47:35 -03:00

test: the stack suite stops the cluster's own unit to see the 503 57191dbd06

navigator merged commit aa4d60fe44 into main 2026-10-16 03:50:35 -03:00

navigator referenced this pull request from a commit 2026-10-16 03:50:35 -03:00

Merge pull request 'feat: the lnpp layer, nginx, PostgreSQL and Python with gunicorn (0059)' (#1) from feat/recipe into main

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels

No items

No labels

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

Keel-Linux/keel-lnpp!1

No description provided.