zsecrets.zlayer.yml

# zsecrets.zlayer.yml — ZLayer Secrets HA deployment spec
#
# Stands up the `zlayer serve --secrets-only` daemon as a 2-node Raft cluster
# (BlackLeafCloud + DedicatedAlpha) behind secrets.blackleafdigital.com. Each
# node persists its own secrets directory (SQLite DB + node keypair + sealed
# DEK at wrapped_dek.bin) on a per-node named volume.
#
# This spec describes the STEADY-STATE topology. The Raft cluster itself is
# bootstrapped out-of-band with `zlayer node init` (leader) + `zlayer node
# join` (follower) — see docs/RUNBOOK_zsecrets_ha.md. Once the cluster exists
# and wrapped_dek.bin is present on every node, the secrets store is
# RaftSecretsStore automatically and this deployment keeps the daemons running
# and the edge route wired.
#
# Required secrets (provision before `zlayer deploy`):
#   zlayer-jwt-secret  - HMAC secret for the daemon's HS256 session JWTs
#                        (ZLAYER_JWT_SECRET). Must be IDENTICAL on every node
#                        so a token minted on the leader validates on a
#                        follower. 64 random bytes, hex or base64.
#
# Node labels expected (set at `zlayer node init/join --labels role=secrets`):
#   role=secrets       - matched by node_selector below to keep secrets
#                        daemons off unrelated nodes.
#
# Usage:
#   zlayer deploy -f zsecrets.zlayer.yml

version: v1
deployment: zsecrets

services:
  # ===========================================================================
  # ZLayer Secrets — `zlayer serve --secrets-only`
  #
  # node_mode: dedicated + replicas: 2 ⇒ one daemon per node, pinned by the
  # `role=secrets` label to the BlackLeafCloud + DedicatedAlpha pair. Each
  # replica owns its own `zsecrets-data-<node>` volume so node identity and
  # sealed key material never collide.
  # ===========================================================================
  zsecrets:
    rtype: service
    image:
      name: forge.blackleafdigital.com/blackleafdigital/zlayer-secrets:latest
      pull_policy: always

    resources:
      cpu: 0.5
      memory: 512Mi

    # The image already CMDs `serve --secrets-only --bind 0.0.0.0:3669`; the
    # env below covers the knobs that must be set per-deployment.
    env:
      # Force secrets-only at the daemon level (belt-and-braces with the
      # image CMD/ENV).
      ZLAYER_SECRETS_ONLY: "true"

      # Shared HS256 JWT secret — IDENTICAL across both nodes (see header).
      ZLAYER_JWT_SECRET: "$S:zlayer-jwt-secret"

      # Data root. wrapped_dek.bin + SQLite + node keypair live under
      # {ZLAYER_DATA_DIR}/secrets, which the named volume below mounts over.
      ZLAYER_DATA_DIR: "/var/lib/zlayer"

      # Overlay UDP port for inter-node Raft (boringtun). Matches the
      # --overlay-port used at `node init/join` time in the runbook.
      ZLAYER_WG_PORT: "51420"

      RUST_LOG: "info,zlayer=info,zlayer_secrets=debug"

    endpoints:
      # Public secrets/RBAC API. The edge proxy routes
      # secrets.blackleafdigital.com → this endpoint.
      - name: https
        protocol: http
        port: 3669
        expose: public

      # Raft consensus channel between secrets nodes. Internal-only; rides the
      # overlay / NetBird fabric, never the public edge.
      - name: raft
        protocol: tcp
        port: 9000
        expose: internal

    # Liveness/readiness from the secrets-only router. `/health/live` and
    # `/health/ready` are mounted unauthenticated in secrets-only mode, so the
    # edge and the supervisor can probe without a token.
    health:
      start_grace: 15s
      interval: 10s
      timeout: 5s
      retries: 3
      check:
        type: http
        url: http://localhost:3669/health/ready
        expect_status: 200

    # 2 replicas, one per node (HA quorum of 2 — see runbook note on growing
    # to 3 for true fault tolerance).
    scale:
      mode: fixed
      replicas: 2

    # One dedicated node per replica (1:1 mapping), constrained to the
    # secrets-labeled nodes (BlackLeafCloud + DedicatedAlpha). `node_mode` and
    # `node_selector` are flat service keys in the ZLayer spec schema.
    node_mode: dedicated
    node_selector:
      labels:
        role: secrets

    # Per-node persistent volume covering {data_dir}/secrets. `tier: local`
    # is the SQLite-safe tier (direct local SSD/NVMe, honest fsync) — secrets
    # are stored in a SQLite DB, so NEVER use `network`.
    storage:
      - type: named
        name: zsecrets-data
        target: /var/lib/zlayer/secrets
        tier: local
        size: 5Gi

    errors:
      on_panic:
        action: restart