Commits

main · .gitignore

The data role in code (ADR-035, roadmap WS-X2): roles/data/provision.sh installs and configures PostgreSQL 18, PgBouncer, pgBackRest, Valkey and their Prometheus exporters, so any machine can take the role the way this host does. Everything listens on loopback until the private network exists. PostgreSQL is tuned for the shared host (shared_buffers 1 GB, effective_cache_size 4 GB, work_mem 16 MB, 120 connections behind the pooler), uses SCRAM, pg_stat_statements, and WAL archiving through pgBackRest. PgBouncer runs transaction pooling with SCRAM through auth_query (pgbouncer.get_auth, SECURITY DEFINER), so there is no password list to maintain. Valkey uses volatile-lru (only TTL keys are evicted), AOF every second, and ACLs with default off, admin and monitor users, and service users kept in services.acl. pgBackRest keeps an encrypted repository beside ovhost's pruned backup prefix in the same B2 bucket, with a weekly full and daily differential by systemd timer and 14 days of point-in-time recovery. The exporters are bound to 127.0.0.1, because the host firewall is off. add-service.sh gives a service its database, owner role, pooled runtime role (DML only, statement_timeout 15 s, lock_timeout 5 s) and a Valkey user confined to ov:<svc>:*, and writes DATABASE_URL, DATABASE_DIRECT_URL, VALKEY_URL and VALKEY_PREFIX into its env file. Passwords are generated once into /etc/openvibe/data.env (root, 0600) and reach PostgreSQL as SCRAM secrets and Valkey as SHA-256 hashes; nothing prints a secret. .gitignore's data/ rule gains a roles/data/ exception. The Prometheus config generator takes the inventory's exporters. test/data-role.test.js (scripts parse, loopback, SCRAM, transaction pooling, volatile-lru, archiving, no printed secret) and the Prometheus config test. npm test 39/39.OpenVibers · 28 Sept 2026 3479300
Stage B tenant static hosting: the Host API service on port 4910OpenVibers · 23 Sept 2026 cf7cfcc
Stage A operator plane: ovhost validates, plans, deploys and rolls back the host's services without dropping live streams or recordingsOpenVibers · 23 Sept 2026 538a940