Operate pckg
Keep database and publisher credentials in OpenBao or an approved secret manager. Do not print, commit, or expose a credential in logs.
Service contract
Section titled “Service contract”| Field | Verified value |
|---|---|
| Purpose | Rust package registry with a React catalogue client. |
| Audience | Consumers browse and download. Authorized package authors publish. Operators maintain storage. |
| Public boundary | https://pckg.beskid-lang.org; public catalogue and download routes can remain available. |
| Local boundary | The reference service listens on http://localhost:8082 and uses a local PostgreSQL service. |
| Authentication | CLI publication uses pckg bearer keys. Protected browser mutations fail closed without a trusted forward-auth boundary. |
| Persistent state | PostgreSQL stores registry records. pckg_packages stores package artifacts at /app/packages. |
| Container image | ghcr.io/cyber-nomad-collective/beskid-pckg. |
| Health check | GET /health/ready on port 8082. |
| Deployment owner | Root platform delivery builds the Rust service and web client, then Coolify runs the Compose profile. |
| Secret source | OpenBao path secret/beskid/<lane>/pckg; it supplies the canonical PCKG_DATABASE_URL. |
| Monitoring | Readiness, PostgreSQL health, and publication errors identify the failing boundary. |
| Recovery | Restore database and artifact volume as one consistent set. Roll back the image digest on a runtime regression. |
Prerequisites
Section titled “Prerequisites”Confirm that the package registry PostgreSQL service responds and that PCKG_DATABASE_URL came from the lane secret path. Confirm that the artifact volume mount exists before publication.
Actions
Section titled “Actions”- Verify the service contract at
http://localhost:8082/health/readyfrom inside the service network. - Verify the public catalogue with a read-only request before any service contract mutation.
- Check that PostgreSQL uses its documented persistent volume.
- Check that
/app/packagesuses thepckg_packagesvolume.
Expected result
Section titled “Expected result”The /health/ready request succeeds. PostgreSQL contains registry records, and the artifact volume contains the matching immutable package files.
Recovery
Section titled “Recovery”If readiness fails, inspect database connectivity without showing PCKG_DATABASE_URL. If records and files differ, stop publication and restore a consistent backup. If a new image caused the failure, redeploy the previous digest.