teyfix/base repository overview

⁠Shared bootstrap base

teyfix/base combines the portable toolkit with Alpine, a shell, certificates, curl and the shared two-stage Process Compose entrypoint. The full contract and rendering conventions are in docs/bootstrap.md⁠.

An image extending this base declares TEYFIX_SERVICE, TEYFIX_CONFIG_DEFAULT and optionally TEYFIX_CONFIG_ENV (the environment variable containing a consumer path override; defaults to TEYFIX_CONFIG). The input can be one YAML file or a directory of .yaml/.yml files. Input files remain read-only; native export writes to /run/teyfix/input.cue.

Under /etc/teyfix/<service>/, provide schema.cue in package bootstrap, with an inputs constraint; the base preserves source filenames and combines their single documents in sorted order. Other CUE files in that directory define config, spec.runtime and an optional spec.templates output-to-template map. bootstrap_tool.cue binds the imported input to its schema, requests any secretRefs, and binds secretValues into the resolved configuration. artifacts can declare direct string/byte outputs.

The shared renderer supplies .config to gomplate. One declared output must be /run/teyfix/service.yaml, the inner Process Compose configuration. Only after preparation succeeds does the shared launcher start that configuration. TEYFIX_SERVICE_SOCKET optionally enables an inner Unix API socket. The outer supervisor has no API server. Resolved-value diagnostics are private at /run/teyfix/prepare.log on failure.

Vendor-based images copy /tools/, /etc/teyfix/base/ and /usr/local/libexec/teyfix/base/ from the Bake target:base context, install their own runtime dependencies and select the shared entrypoint. Native service data directories remain unchanged.

docker buildx bake base-smoke

The smoke test checks native YAML/defaults, secret privacy, invalid and multi-document input, inner failures, and TERM propagation through both supervisors. PostgreSQL exercises the base with real provisioning and companions.

Images list required native environment secrets in TEYFIX_NATIVE_SECRETS and optional ones in TEYFIX_OPTIONAL_NATIVE_SECRETS. Both accept NAME or NAME_FILE, reject simultaneous nonempty values, and normalize once before Process Compose starts. Missing optional values preserve native defaults; missing required values fail startup. YAML secret references remain the ordinary CUE path.

Maintained from the source documentation⁠. See published tags⁠ and the service integration guide⁠.