Operating the vault stack
An operator runs the whole SkyKeep deployment with one script:
scripts/skykeep.sh start, stop, restart, or status. Start brings every
service to healthy and applies the database migrations; stop shuts the
services down while preserving all stored data; status reports the truth
about the deployment's health and says so in its exit code, so monitoring
can rely on it. For starting over entirely there is
reinstall_complete_wipes_all_data: it destroys every document, user, and
both audit trails, then reinstalls a fresh vault with the documented
bootstrap administrator — and it demands a typed acknowledgment before
touching anything. Like everything in the vault, the script fails closed:
a missing or incomplete configuration stops it before anything runs.
An unknown command is refused with usage guidance
- Given the operator has the lifecycle script
- When they run it with a command it does not know
- Then the script refuses and explains its usage
Operating without a configuration file is refused
- Given no environment configuration file exists
- When the operator asks for the stack's status
- Then the script refuses and points at the configuration template
A configuration missing a required value names the gap
- Given an environment configuration missing the database port
- When the operator asks for the stack's status
- Then the script refuses and names the missing variable
A complete reinstall refuses without the typed acknowledgmentstack
- Given a configuration for a disposable deployment
- When the operator requests a complete reinstall but does not type the acknowledgment
- Then the script refuses the reinstall and touches nothing
A documented flag reaches the command it was documented for
- Given no environment configuration file exists
- When the operator asks for a demonstration with the accounts-only flag
- Then the script does not reject the flag as bad usage
A command that takes no arguments still refuses a second one
- Given the operator has the lifecycle script
- When they pass an extra argument to a command that takes none
- Then the script refuses and explains its usage
First-time setup generates a configuration with fresh secrets
- Given a checkout with no configuration yet
- When the operator runs the setup script
- Then a configuration exists whose secrets differ from the template
Setup never overwrites an existing configuration
- Given a configuration that already exists
- When the operator runs the setup script
- Then the setup script refuses and leaves the configuration untouched