feat: bootstrap Atom actions via YAML config, remove imperative bootstrap-actions - #3561
Open
arvindh123 wants to merge 5 commits into
Open
feat: bootstrap Atom actions via YAML config, remove imperative bootstrap-actions#3561arvindh123 wants to merge 5 commits into
arvindh123 wants to merge 5 commits into
Conversation
arvindh123
force-pushed
the
claude/magistrala-atom-bootstrap-yaml-vxg6n0
branch
from
August 4, 2026 08:13
a9acc6b to
92068df
Compare
Signed-off-by: dusan <borovcanindusan1@gmail.com>
…trap-actions Replace the Go-based imperative bootstrap-actions code path with Atom's new declarative YAML bootstrap. Atom now reads capabilities and guardrail rules directly from a config file at startup, eliminating the need for a separate init container to call its HTTP API. - Add docker/atom-bootstrap.yaml with all 14 capabilities (read, write, delete, manage, publish, subscribe, execute, list, alarm_*), their 36 applicability entries, and 2 device pub/sub assignment rules - Wire the YAML into the atom service via ATOM_BOOTSTRAP_FILE env var and a read-only bind mount - Move atom-bootstrap compose service behind profiles: [tokens] so it no longer starts on docker compose up - Retarget all downstream depends_on from atom-bootstrap to atom - Remove bootstrap-actions subcommand and default fall-through from cmd/atom-bootstrap/main.go (provision-tokens remains) - Delete pkg/atom/bootstrap.go and pkg/atom/bootstrap_test.go Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01P79iLj4z6gygnCArG7AGyA Signed-off-by: Arvindh <arvindh91@gmail.com>
Signed-off-by: Arvindh <arvindh91@gmail.com>
Replace the deleted `atom-bootstrap provision-tokens` Go binary with a
single shell script that produces both files consumed by docker compose
from the same random material:
- docker/atom-bootstrap.yaml (mounted into the atom container) — declares
the service entity's access token credentials so Atom hashes them at
first boot and stamps each row managed_by='config'. Once stamped, the
Atom API refuses to revoke or list the credential (invisible to
introspection) — see the companion atom PR.
- docker/.env.tokens (loaded by docker compose) — plain env file that
supplies ${MG_ATOM_TOKEN_*} for the ATOM_SERVICE_TOKEN of each service.
Because both files are generated together from the same tokens, `docker
compose up` needs no init container: services come up already holding
credentials that Atom has already accepted.
- Rename docker/atom-bootstrap.yaml (capabilities + guardrails only) to
docker/atom-bootstrap.template.yaml; script concatenates the credentials
block onto it to produce the final file.
- New scripts/generate-atom-secrets.sh: mints 11 tokens with openssl,
refuses to overwrite unless --force, writes both files with mode 0600.
- Makefile: atom-secrets target (one-shot), atom-secrets-rotate target
(regenerate + restart atom + reminder), and a docker/.env.tokens
prerequisite on run_latest / run_latest_ci so the stack cannot come up
without tokens. Both compose invocations now pass --env-file
docker/.env.tokens.
- Compose: strip the dead ATOM_ADMIN_TOKEN/USERNAME/SECRET and
ATOM_SERVICE_USERNAME/SECRET fallbacks from fluxmq-auth (the only
downstream service that still carried them); the pkg/atom loginAdmin
fallback path is now unreachable from stack services.
- README: document the first-time setup and the rotation flow.
- .gitignore: docker/atom-bootstrap.yaml and docker/.env.tokens are
generated per-deployment and carry live secrets.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Signed-off-by: Arvindh <arvindh91@gmail.com>
… exit 0 when idempotent Two rough edges surfaced when bringing up the full compose stack against a local Atom image: 1. The bootstrap YAML was chmod 0600, but Atom runs inside its container as uid 999 (`atom`) while the bind-mounted file preserves the host uid. Atom crash-looped with "failed to read bootstrap file: Permission denied". Bump the YAML to 0644 (the file is bind-mounted read-only and its contents are the same tokens already sitting in `.env.tokens` which docker compose reads on the host); leave `.env.tokens` at 0600 since nothing in a container ever reads it. In production, chown to the container uid and tighten to 0640. 2. The script exited 1 when both target files existed, which broke the Makefile `docker/.env.tokens:` prereq — every `make down` (or any other make invocation touching that rule) failed because the "files already present" case was treated as an error. Exit 0 in that case; the message is still printed and `--force` remains the way to actually rotate. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> Signed-off-by: Arvindh <arvindh91@gmail.com>
arvindh123
force-pushed
the
claude/magistrala-atom-bootstrap-yaml-vxg6n0
branch
from
August 4, 2026 08:14
92068df to
67250b3
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary