v0.2.0
This commit is contained in:
Mateusz Gruszczyński committed
1 parent
fc81ecafd6
commit
dc57aa7089
89 files changed
+5290
-1551
No files matched your search
@@ -12,7 +12,7 @@ The target architecture should allow fully stateless RustBox application nodes u
|
||||
- an optional external full-text indexer,
|
||||
- no writable node-local state required for normal cluster operation.
|
||||
|
||||
This is a follow-up to the 0.1.2 database/cluster audit. It is not implemented in 0.1.2.
|
||||
This is a follow-up to the 0.1.2 database/cluster audit. RustBox 0.2.0 implements the storage abstraction, S3/shared-POSIX support, OpenSearch backend and durable indexing pipeline. Live interoperability tests against SILO/MinIO/AWS S3/Ceph RGW and a real multi-node cluster remain release-validation work.
|
||||
|
||||
---
|
||||
|
||||
@@ -25,23 +25,22 @@ Shared through SQL:
|
||||
- application data stored in MySQL/PostgreSQL,
|
||||
- persistent sessions when SQL is selected.
|
||||
|
||||
Filesystem-backed under `data_dir/<user_hash>/`:
|
||||
Node-local data may still exist under `data_dir/<user_hash>/` for single-node features such as local Tantivy and OpenPGP private-key material. Draft attachments use the configured `[storage]` backend.
|
||||
|
||||
- `attachments/<draft_id>/<attachment_id>` — draft attachments,
|
||||
- `tantivy/` — local full-text index,
|
||||
- `pgp/private/` — OpenPGP private-key material,
|
||||
- legacy `db.sqlite` — migration source only.
|
||||
|
||||
Current cluster restrictions:
|
||||
Cluster configuration is explicit and capability-based:
|
||||
|
||||
```toml
|
||||
cluster_mode = true
|
||||
cluster_shared_data_dir = true
|
||||
search_index_backend = "disabled"
|
||||
pgp_enabled = false
|
||||
|
||||
[storage]
|
||||
backend = "s3"
|
||||
|
||||
[search]
|
||||
backend = "opensearch"
|
||||
```
|
||||
|
||||
`cluster_shared_data_dir = true` is currently required because draft attachments are path-based and local Tantivy/PGP state is not cluster-safe.
|
||||
Shared POSIX storage is also supported with `storage.backend="filesystem"` and `storage.shared=true`. Local Tantivy remains single-node only.
|
||||
|
||||
---
|
||||
|
||||
@@ -181,14 +180,7 @@ Priority should be:
|
||||
|
||||
# 2. Cluster behavior after storage abstraction
|
||||
|
||||
When `storage.backend = "s3"`, RustBox should allow:
|
||||
|
||||
```toml
|
||||
cluster_mode = true
|
||||
cluster_shared_data_dir = false
|
||||
```
|
||||
|
||||
The cluster validation should become capability-based instead of checking only `cluster_shared_data_dir`.
|
||||
When `storage.backend = "s3"`, RustBox allows cluster mode without a writable shared `data_dir`. Cluster validation is capability-based and depends on the selected storage/search backends.
|
||||
|
||||
Expected rules:
|
||||
|
||||
@@ -567,7 +559,7 @@ Requirements:
|
||||
- rotation/recovery procedure,
|
||||
- auditability.
|
||||
|
||||
Do not make `cluster_shared_data_dir` the solution for private-key consistency.
|
||||
Do not treat shared blob storage as a solution for private-key consistency.
|
||||
|
||||
---
|
||||
|
||||
@@ -587,34 +579,21 @@ This is not required for SQL cache consistency, but is required for reliable rea
|
||||
|
||||
---
|
||||
|
||||
# 8. Configuration compatibility
|
||||
# 8. Configuration model
|
||||
|
||||
Keep backward compatibility where possible.
|
||||
|
||||
Legacy:
|
||||
|
||||
```toml
|
||||
data_dir = "/var/lib/rustbox/data"
|
||||
search_index_backend = "tantivy"
|
||||
```
|
||||
|
||||
Migration target:
|
||||
RustBox 0.2.0 uses one configuration model only. There are no compatibility aliases for pre-0.2 storage/search keys.
|
||||
|
||||
```toml
|
||||
[storage]
|
||||
backend = "filesystem"
|
||||
path = "/var/lib/rustbox/data"
|
||||
shared = false
|
||||
|
||||
[search]
|
||||
backend = "local_tantivy"
|
||||
```
|
||||
|
||||
Suggested transition:
|
||||
|
||||
- accept legacy keys for at least one release,
|
||||
- emit deprecation warnings,
|
||||
- map legacy values internally to the new backend configuration,
|
||||
- document exact removal version before deleting old settings.
|
||||
Cluster deployments must select cluster-safe backends explicitly (`storage.shared=true` for shared POSIX or `storage.backend="s3"`; `search.backend="opensearch"` or `disabled`).
|
||||
|
||||
---
|
||||
|
||||
@@ -704,54 +683,57 @@ For external search:
|
||||
|
||||
## Phase 1 — storage abstraction
|
||||
|
||||
- [ ] introduce `BlobStorage` interface,
|
||||
- [ ] convert draft attachments from absolute paths to logical object keys,
|
||||
- [ ] implement filesystem backend,
|
||||
- [ ] retain existing behavior for single-node installations,
|
||||
- [ ] add storage health checks.
|
||||
- [x] introduce `BlobStorage` interface,
|
||||
- [x] convert draft attachments from absolute paths to logical object keys,
|
||||
- [x] implement filesystem backend,
|
||||
- [x] retain existing behavior for single-node installations,
|
||||
- [x] add storage health checks.
|
||||
|
||||
## Phase 2 — S3 backend
|
||||
|
||||
- [ ] implement S3-compatible backend,
|
||||
- [ ] streaming upload/download,
|
||||
- [ ] retries/timeouts/checksums,
|
||||
- [x] implement S3-compatible backend,
|
||||
- [x] streaming upload/download,
|
||||
- [x] retries/timeouts/checksums,
|
||||
- [ ] SILO Compose integration validation,
|
||||
- [ ] MinIO integration validation,
|
||||
- [ ] AWS S3 integration validation,
|
||||
- [ ] Ceph RGW compatibility validation,
|
||||
- [ ] migration command from filesystem to S3,
|
||||
- [ ] remove hard `cluster_shared_data_dir` requirement when storage backend is cluster-safe.
|
||||
- [x] migration command from filesystem to S3,
|
||||
- [x] validate cluster safety directly from `storage.backend` and `storage.shared`.
|
||||
|
||||
## Phase 3 — search abstraction
|
||||
|
||||
- [ ] introduce `SearchBackend` interface,
|
||||
- [ ] move current Tantivy code behind `local_tantivy`,
|
||||
- [ ] preserve `disabled` backend,
|
||||
- [ ] reject `local_tantivy` in cluster mode,
|
||||
- [ ] define canonical indexed message document/schema.
|
||||
- [x] introduce `SearchBackend` interface,
|
||||
- [x] move current Tantivy code behind `local_tantivy`,
|
||||
- [x] preserve `disabled` backend,
|
||||
- [x] reject `local_tantivy` in cluster mode,
|
||||
- [x] define canonical indexed message document/schema.
|
||||
|
||||
## Phase 4 — durable index events
|
||||
|
||||
- [ ] add SQL search outbox/queue,
|
||||
- [ ] add index worker locking/concurrency,
|
||||
- [ ] retries/backoff,
|
||||
- [ ] delete events,
|
||||
- [ ] reindex command,
|
||||
- [ ] index lag/error metrics.
|
||||
- [x] add SQL search outbox/queue,
|
||||
- [x] add index worker locking/concurrency,
|
||||
- [x] retries/backoff,
|
||||
- [x] delete events,
|
||||
- [x] reindex command,
|
||||
- [x] index lag/error metrics.
|
||||
|
||||
## Phase 5 — external index adapters
|
||||
|
||||
Recommended evaluation order:
|
||||
|
||||
RustBox 0.2.0 selects **OpenSearch** as the supported external adapter because its update/delete/reindex semantics map directly to mutable mailbox documents. Quickwit and Solr remain optional future adapters.
|
||||
|
||||
- [ ] Quickwit proof of concept,
|
||||
- [ ] OpenSearch adapter,
|
||||
- [ ] compare update/delete/reindex behavior and operational footprint,
|
||||
- [ ] choose documented recommended backend,
|
||||
- [x] OpenSearch adapter,
|
||||
- [x] compare update/delete/reindex behavior and operational footprint,
|
||||
- [x] choose documented recommended backend,
|
||||
- [ ] Solr adapter only if there is real deployment demand.
|
||||
|
||||
## Phase 6 — cluster PGP
|
||||
|
||||
- [ ] design dedicated encrypted key backend,
|
||||
- [ ] keep PGP disabled in cluster mode until completed,
|
||||
- [x] keep PGP disabled in cluster mode until completed,
|
||||
- [ ] evaluate Vault/KMS/SQL-encrypted/S3-encrypted variants,
|
||||
- [ ] add migration procedure for existing local keys.
|
||||
|
||||
@@ -770,16 +752,16 @@ The work is complete when all of the following are true:
|
||||
|
||||
- [ ] three or more RustBox nodes can run with no writable shared POSIX filesystem,
|
||||
- [ ] nodes can be destroyed/recreated without losing attachments or search state,
|
||||
- [ ] S3-compatible storage works for draft attachments,
|
||||
- [ ] local filesystem remains supported for single-node mode,
|
||||
- [ ] `cluster_mode = true` accepts S3-backed storage without `cluster_shared_data_dir = true`,
|
||||
- [ ] local Tantivy is rejected in cluster mode,
|
||||
- [ ] external index failure does not corrupt SQL/cache state,
|
||||
- [ ] full index rebuild is possible,
|
||||
- [ ] index events are durable and retryable,
|
||||
- [ ] SQL remains the authoritative cache/data source,
|
||||
- [ ] no PGP private key depends on node-local filesystem in supported cluster mode,
|
||||
- [ ] configuration and migration paths are documented for every supported deployment variant.
|
||||
- [ ] S3-compatible storage works for draft attachments (live SILO/MinIO/AWS validation pending),
|
||||
- [x] local filesystem remains supported for single-node mode,
|
||||
- [x] `cluster_mode = true` accepts S3-backed storage without any legacy shared-data-dir switch,
|
||||
- [x] local Tantivy is rejected in cluster mode,
|
||||
- [x] external index failure does not corrupt SQL/cache state,
|
||||
- [x] full index rebuild is possible,
|
||||
- [x] index events are durable and retryable,
|
||||
- [x] SQL remains the authoritative cache/data source,
|
||||
- [x] no PGP private key depends on node-local filesystem in supported cluster mode,
|
||||
- [x] configuration and migration paths are documented for every supported deployment variant.
|
||||
|
||||
---
|
||||
|
||||
|
||||
Reference in new issue
Block a user