Meta

Description

This role deploys the Meta Infinite Graph, a browsable graph of every Infinito.Nexus role and the dependencies between them. It is served as a pre-rendered static site from a project-owned container image.

Overview

The graph is a read-only surface. It has no accounts, no login and no authenticated state, so meta/services.yml pins both sso and logout to false and the role declares PERSONA_ADMINISTRATOR_BLOCKED and PERSONA_BIBER_BLOCKED in templates/playwright.env.j2.

Everything else the role couples to is driven by group membership: a service turns on exactly when its provider role is part of the deployment. The role runs in both compose and swarm mode and is published on meta.{{ DOMAIN_PRIMARY }}.

Architecture

ARCHITECTURE.md draws Meta from its own metadata: the containers it runs under compose, what changes under swarm, how each volume is backed, and every role it depends on or is depended upon by.

Section	Drawn from
Compose	meta/services.yml
Swarm	meta/services.yml replicas and placement
Volumes	meta/volumes.yml against the NFS decision chain
Dependencies	meta/services.yml and meta/main.yml of every role

Features

• Dependency graph: renders every role and the edges between them, so the modular structure of a deployment is inspectable without reading meta/ files by hand.

• Pinned release image: ghcr.io/infinito-nexus/meta from the project’s own registry namespace, pinned to a release tag rather than a floating latest. The role declares no architectures, so the deploy matrix may place it on either.

• Live role data: when web-svc-api is in the deployment, templates/env.j2 renders MIG_API_URL from its canonical URL so the graph reads role data from the running API instead of a build-time snapshot.

• Dashboard tile: when web-app-dashboard is present, the graph is offered as a card pointing at this role’s canonical domain.

• Shared styling: when web-svc-design is present, the site consumes the central stylesheet.

• Usage statistics: when web-app-matomo is present, the tracker is injected by sys-front-inj-matomo.

• Scrape target: when web-app-prometheus is present, the role joins the monitoring closure.

• Onion surface: when svc-net-tor is present, the graph is additionally served over its onion address. Both variants in meta/variants.yml keep tor on.

• Resource envelope: 0.2 CPU, 128 MB reservation, 256 MB limit, 256 PIDs, 1224 MB minimum storage; curl healthcheck on internal port 80, locally published on 8047.

Quick Setup

Development

Clone, set up the workstation, and deploy Meta onto the local stack:

git clone https://github.com/infinito-nexus/core.git
cd core
make onboard
make compose-deploy mode=reinstall apps=web-app-meta full_cycle=false

Production

Run the published image to provision the inventory and deploy Meta to a managed server over SSH. The image logs in as root, so the server must accept root over a public key, and the two key variables are the two halves of one key pair: the private half authenticates the deploy, and the public half is what the deploy keeps authorized for root and installs for the administrator account. Naming a public half that does not belong to the private one locks the running deploy out at its next reconnect.

APP=web-app-meta
HOST="<your-server>"
DOMAIN="<your-domain>"
TLS_MODE=self_signed
SSH_PUBLIC_KEY="<your-ssh-public-key>"
SSH_PRIVATE_KEY="<your-ssh-private-key-file>"
WORKDIR="$HOME/.infinito.nexus"

mkdir -p "$WORKDIR/inventories"
docker run --rm \
  -v "$WORKDIR/inventories:/etc/infinito.nexus/inventories" \
  -v "$SSH_PRIVATE_KEY:/run/secrets/deploy_key:ro" \
  -e APP="$APP" -e HOST="$HOST" -e DOMAIN="$DOMAIN" -e TLS_MODE="$TLS_MODE" -e SSH_PUBLIC_KEY="$SSH_PUBLIC_KEY" \
  ghcr.io/infinito-nexus/core/debian:latest bash -c '
    INVENTORY=/etc/infinito.nexus/inventories/production
    infinito administration inventory provision "$INVENTORY" \
      --inventory-file "$INVENTORY/devices.yml" \
      --host "$HOST" \
      --include "$APP" \
      --vars "{\"TLS_MODE\": \"$TLS_MODE\", \"DOMAIN_PRIMARY\": \"$DOMAIN\", \"SYS_SVC_SSHD_PERMIT_ROOT_LOGIN\": \"prohibit-password\", \"users\": {\"root\": {\"authorized_keys\": [\"$SSH_PUBLIC_KEY\"]}, \"administrator\": {\"authorized_keys\": [\"$SSH_PUBLIC_KEY\"]}}}" &&
    infinito administration deploy dedicated "$INVENTORY/devices.yml" \
      --password-file "$INVENTORY/.password" \
      -u root --private-key /run/secrets/deploy_key \
      --diff -vv'

The inventory under $WORKDIR is written by the container as root, including the vault password at inventories/production/.password. Run sudo chown -R "$USER" "$WORKDIR" afterwards to read it.

Further Resources

• Meta Infinite Graph Homepage

Credits

Kevin Veen-Birkenbach

Part of the Infinito.Nexus Project and maintained by Kevin Veen-Birkenbach. Licensed under the Infinito.Nexus Community License (Non-Commercial).

That licence covers this role. The software it deploys is a separate grant: MIT, under which commercial use is allowed. You owe its authors this much: keep the copyright notice and the licence text. Permission for one of the two is not permission for the other.