snapshot of https://github.com/seaweedfs/seaweedfs.git (master, 2026-09-16; blobs > 131072B omitted)

terraform/modules/core/templates/cloud-init.yaml.tftpl

@@ -0,0 +1,44 @@
+#cloud-config
+# Rendered by the SeaweedFS Terraform core module for node ${name} (role ${role}).
+# When render_secret_files=false, secret-bearing files are NOT here; they are
+# fetched at boot by fetch-secrets.sh from the cloud secret store.
+users:
+  - name: ${run_as_user}
+    system: true
+    shell: /usr/sbin/nologin
+write_files:
+%{ for path, content in config_files ~}
+  - path: ${path}
+    owner: "${run_as_user}:${run_as_user}"
+    permissions: '${lookup(file_modes, path, "0644")}'
+    content: |
+      ${indent(6, content)}
+%{ endfor ~}
+%{ if mount_script != "" ~}
+  - path: /opt/seaweedfs/mount-disks.sh
+    permissions: '0755'
+    content: |
+      ${indent(6, mount_script)}
+%{ endif ~}
+%{ if fetch_script != "" ~}
+  - path: /opt/seaweedfs/fetch-secrets.sh
+    permissions: '0755'
+    content: |
+      ${indent(6, fetch_script)}
+%{ endif ~}
+  - path: /etc/systemd/system/weed-${role}.service
+    permissions: '0644'
+    content: |
+      ${indent(6, systemd_unit)}
+runcmd:
+%{ if mount_script != "" ~}
+  - /opt/seaweedfs/mount-disks.sh
+%{ endif ~}
+%{ if fetch_script != "" ~}
+  - /opt/seaweedfs/fetch-secrets.sh
+%{ endif ~}
+%{ for cmd in pre_runcmd ~}
+  - ${cmd}
+%{ endfor ~}
+  - systemctl daemon-reload
+  - systemctl enable --now weed-${role}.service

terraform/modules/core/templates/mount-disks.sh.tftpl

@@ -0,0 +1,73 @@
+#!/usr/bin/env bash
+# Rendered by the SeaweedFS Terraform core module. Formats (only if blank) and
+# mounts each data disk, persisting by UUID to /etc/fstab. Safe to re-run.
+set -euo pipefail
+
+run_as_user="${run_as_user}"
+
+# Base block device backing "/" so auto-discovery never touches the root disk.
+root_src="$(findmnt -no SOURCE / 2>/dev/null || true)"
+root_base="$(lsblk -no pkname "$root_src" 2>/dev/null || true)"
+[ -n "$root_base" ] && root_base="/dev/$root_base"
+
+is_mounted() { findmnt -rno TARGET "$1" >/dev/null 2>&1; }
+
+# Pick the first unmounted, non-root whole disk (single-data-disk node).
+discover_dev() {
+  local d base
+  for d in /dev/nvme*n1 /dev/xvd[b-z] /dev/sd[b-z] /dev/vd[b-z]; do
+    [ -b "$d" ] || continue
+    [ "$d" = "$root_src" ] && continue
+    [ "$d" = "$root_base" ] && continue
+    base="/dev/$(lsblk -no pkname "$d" 2>/dev/null || true)"
+    [ "$base" = "$root_base" ] && continue
+    is_mounted "$d" && continue
+    echo "$d"; return 0
+  done
+  return 1
+}
+
+# Wait up to ~120s for one of the explicit candidate devices to appear.
+wait_dev() {
+  local i d
+  for i in $(seq 1 60); do
+    for d in "$@"; do [ -b "$d" ] && { echo "$d"; return 0; }; done
+    sleep 2
+  done
+  return 1
+}
+
+mount_one() {
+  local mountpoint="$1" fstype="$2"; shift 2
+  local dev=""
+  if [ "$#" -gt 0 ]; then
+    dev="$(wait_dev "$@" || true)"
+  fi
+  if [ -z "$dev" ]; then
+    dev="$(discover_dev || true)"
+  fi
+  if [ -z "$dev" ]; then
+    echo "mount-disks: no device found for $mountpoint" >&2
+    return 1
+  fi
+  if ! blkid "$dev" >/dev/null 2>&1; then
+    echo "mount-disks: formatting $dev as $fstype"
+    "mkfs.$fstype" -q "$dev"
+  fi
+  mkdir -p "$mountpoint"
+  local uuid; uuid="$(blkid -s UUID -o value "$dev")"
+  if [ -z "$uuid" ]; then
+    echo "mount-disks: failed to read a filesystem UUID for $dev" >&2
+    return 1
+  fi
+  if ! grep -q "$uuid" /etc/fstab; then
+    printf 'UUID=%s %s %s defaults,nofail 0 2\n' "$uuid" "$mountpoint" "$fstype" >> /etc/fstab
+  fi
+  is_mounted "$mountpoint" || mount "$mountpoint"
+  chown -R "$run_as_user:$run_as_user" "$mountpoint"
+  echo "mount-disks: $dev mounted at $mountpoint"
+}
+
+%{ for m in mounts ~}
+mount_one "${m.mountpoint}" "${m.fstype}"${length(m.devices) > 0 ? " ${join(" ", m.devices)}" : ""}
+%{ endfor ~}

terraform/modules/core/templates/security.toml.tftpl

@@ -0,0 +1,53 @@
+# SeaweedFS security.toml rendered by the Terraform core module.
+# Rendered when enable_security OR any non-default JWT signing option is set.
+# Presence of this file does NOT imply mTLS: the [grpc] TLS block is emitted
+# only under enable_security; a JWT-only config carries [jwt.*] and no TLS.
+
+%{ if enable_security ~}
+[grpc]
+ca = "${cert_dir}/ca/tls.crt"
+# Peer-identity authorization: without an allow-list, mTLS collapses to
+# "trusted the CA" with no authZ. Set allowed_wildcard_domain / commonNames.
+%{ if allowed_wildcard_domain != "" ~}
+allowed_wildcard_domain = "${allowed_wildcard_domain}"
+%{ endif ~}
+
+[grpc.master]
+cert = "${cert_dir}/master/tls.crt"
+key  = "${cert_dir}/master/tls.key"
+%{ if allowed_common_names != "" ~}
+allowed_commonNames = "${allowed_common_names}"
+%{ endif ~}
+
+[grpc.volume]
+cert = "${cert_dir}/volume/tls.crt"
+key  = "${cert_dir}/volume/tls.key"
+
+[grpc.filer]
+cert = "${cert_dir}/filer/tls.crt"
+key  = "${cert_dir}/filer/tls.key"
+
+[grpc.client]
+cert = "${cert_dir}/client/tls.crt"
+key  = "${cert_dir}/client/tls.key"
+%{ endif ~}
+%{ if jwt_signing_key != "" ~}
+
+[jwt.signing]
+key = "${jwt_signing_key}"
+%{ endif ~}
+%{ if jwt_signing_read_key != "" ~}
+
+[jwt.signing.read]
+key = "${jwt_signing_read_key}"
+%{ endif ~}
+%{ if jwt_filer_signing_key != "" ~}
+
+[jwt.filer_signing]
+key = "${jwt_filer_signing_key}"
+%{ endif ~}
+%{ if jwt_filer_signing_read_key != "" ~}
+
+[jwt.filer_signing.read]
+key = "${jwt_filer_signing_read_key}"
+%{ endif ~}

terraform/modules/core/templates/weed.service.tftpl

@@ -0,0 +1,39 @@
+[Unit]
+Description=SeaweedFS ${role} (${name})
+Documentation=https://github.com/seaweedfs/seaweedfs/wiki
+After=network-online.target
+Wants=network-online.target
+%{ for path in requires_mounts_for ~}
+RequiresMountsFor=${path}
+%{ endfor ~}
+
+[Service]
+Type=simple
+User=${run_as_user}
+Group=${run_as_user}
+ExecStart=${exec_start}
+Restart=always
+RestartSec=5
+LimitNOFILE=1048576
+TimeoutStopSec=60
+# Hardening (OpenShift SCC analogs; relax via the hardening variable)
+NoNewPrivileges=${no_new_privileges}
+%{ if protect_system ~}
+ProtectSystem=strict
+ProtectHome=true
+PrivateTmp=true
+%{ for path in read_write_paths ~}
+ReadWritePaths=${path}
+%{ endfor ~}
+%{ endif ~}
+%{ if cap_drop_all ~}
+CapabilityBoundingSet=
+AmbientCapabilities=
+%{ endif ~}
+EnvironmentFile=-${env_file}
+%{ for k, v in environment ~}
+Environment="${k}=${v}"
+%{ endfor ~}
+
+[Install]
+WantedBy=multi-user.target