name: "metapaas"
description: "Exordos MetaPaaS control-plane element"
schema_version: 1
version: "0.1.2-dev+20260827170508.a0e875af"
api_version: "v1"

resources:

  # IAM
  $core.iam.organizations:
    metapaas_organization:
      name: "MetaPaaS organization"
      description: "MetaPaaS organization"

  $core.iam.projects:
    metapaas_project:
      # Pinned so PaaS consumer manifests (and instances) can reference the
      # metapaas project by a stable id without a cross-element import.
      uuid: 4d657461-0000-0000-0000-000000000002
      name: "MetaPaaS project"
      organization: $core.iam.organizations.$metapaas_organization:uuid
      description: "MetaPaaS project"

  $core.iam.users:
    metapaas_user:
      uuid: 4d657461-0000-0000-0000-000000000001
      username: metapaas
      first_name: "MetaPaaS system user"
      last_name: "MetaPaaS system user"
      email: "noreply+metapaas@exordos.com"
      password: $core.secret.passwords.$metapaas_user_password:value

  # Read-only role for URN resolution: the plugin reconciler follows
  # artifact → element → repository across all projects, so the binding
  # is unscoped (no project) to bypass project filtering on read.
  $core.iam.roles:
    metapaas_repo_reader:
      uuid: 4d657461-0000-0000-0000-000000000003
      name: "metapaas_repo_reader"
      description: "Read-only access to repo artifacts, elements, and repositories for MetaPaaS URN resolution"

  $core.iam.permissionbinding:
    binding_metapaas_repo_reader_artifact_read:
      role: "$core.iam.roles.$metapaas_repo_reader:uuid"
      permission: "37ee8a65-ca05-54b2-a603-831511c01b3c"
    binding_metapaas_repo_reader_element_read:
      role: "$core.iam.roles.$metapaas_repo_reader:uuid"
      permission: "553648f2-0dbc-55bf-80d4-79a6938c0ebf"
    binding_metapaas_repo_reader_repository_read:
      role: "$core.iam.roles.$metapaas_repo_reader:uuid"
      permission: "3e2c70c3-6355-531d-bb59-a5727b777d3b"

  $core.iam.rolebinding:
    metapaas_role_binding:
      role: "726f6c65-0000-0000-0000-000000000002"
      user: "$core.iam.users.$metapaas_user:uuid"
      project: $core.iam.projects.$metapaas_project:uuid
    # Unscoped binding: gives metapaas_user the repo_reader permissions
    # on an unscoped token, bypassing project filtering so the reconciler
    # can resolve URNs across all projects.
    metapaas_unscoped_role_binding:
      role: "$core.iam.roles.$metapaas_repo_reader:uuid"
      user: "$core.iam.users.$metapaas_user:uuid"

  # Secret
  $core.secret.passwords:
    metapaas_user_password:
      name: metapaas_user_password
      description: "MetaPaaS system user password"
      project_id: "12345678-c625-4fee-81d5-f691897b8142"
      constructor:
        kind: plain
      method: AUTO_HEX

  # Compute (single control-plane node hosting all PaaS plugins)
  $core.compute.nodes:
    metapaas_cp:
      name: metapaas-cp
      cores: 2
      ram: 2048
      disk_spec:
        kind: "disks"
        disks:
          - size: 10
            image: "urn:images:a05f57a1-f767-5304-9916-dbfaa1d3da74"
            label: root
          # Persistent data disk: the embedded control-plane DB lives here so it
          # survives root/image replacement.
          - size: 10
            label: data

  # Config injected into the control-plane node
  $core.config.configs:
    metapaas_cp_config:
      project_id: "12345678-c625-4fee-81d5-f691897b8142"
      path: /etc/exordos_init.txt
      target:
        kind: node
        node: $core.compute.nodes.$metapaas_cp:uuid
      body:
        kind: text
        content: |
          f"
          IAM_USER_NAME={$core.iam.users.$metapaas_user:username}
          IAM_USER_PASS={$core.secret.passwords.$metapaas_user_password:value}
          PROJECT_ID={$core.iam.projects.$metapaas_project:uuid}
          GC_HS256_JWKS_ENCRYPTION_KEY={$metapaas.imports.$var_hs256_jwks_encryption_key:value}
          AUDIENCE={$metapaas.imports.$var_iam_default_client_id:value}
          "

  $metapaas.imports.$core_local_domain.records:
    metapaas_cp:
      domain: "$metapaas.imports.$core_local_domain:uuid"
      project_id: "12345678-c625-4fee-81d5-f691897b8142"
      type: "A"
      record:
        kind: "A"
        name: "metapaas-cp"
        address: "$core.compute.nodes.$metapaas_cp:default_network:ipv4"

imports:
  core_local_domain:
    element: "$core"
    kind: "resource"
    link: "$core.dns.domains.$local_domain"
  var_hs256_jwks_encryption_key:
    element: "$core"
    kind: "resource"
    link: "$core.vs.variables.$hs256_jwks_encryption_key"
  var_iam_default_client_id:
    element: "$core"
    kind: "resource"
    link: "$core.vs.variables.$iam_default_client_id"

exports:
  node:
    link: "$core.compute.nodes.$metapaas_cp"
  # The metapaas project a PaaS installs its resources into. PaaS provider
  # manifests import this instead of hardcoding the project id.
  project:
    link: "$core.iam.projects.$metapaas_project"