fix(grid-agent): move setup into YAML preferences (#135)

crates/metacrate-grid-agent/tests/operations_packaging.rs

@@ -1,5 +1,5 @@
 use metacrate_grid_agent::{CONFIG_SCHEMA_VERSION, ConfigLoader};
-use serde_json::Value;
+use serde_yaml_ng::Value;
 use std::fs;
 use std::path::{Path, PathBuf};
 
@@ -15,19 +15,22 @@ fn workspace() -> PathBuf {
 fn examples_are_versioned_placeholder_only_and_offline_validation_has_no_io_peer() {
     let root = workspace();
     for name in [
-        "grid-agent.example.json",
-        "grid-agent.integrated.example.json",
-        "grid-agent.split.example.json",
+        "grid-agent.example.yml",
+        "grid-agent.integrated.example.yml",
+        "grid-agent.split.example.yml",
     ] {
         let bytes = fs::read(root.join("config").join(name)).expect("example");
-        let value: Value = serde_json::from_slice(&bytes).expect("valid JSON");
-        assert_eq!(value["schema_version"], CONFIG_SCHEMA_VERSION);
+        let value: Value = serde_yaml_ng::from_slice(&bytes).expect("valid YAML");
+        assert_eq!(
+            value["schema_version"].as_u64(),
+            Some(u64::from(CONFIG_SCHEMA_VERSION))
+        );
         let text = String::from_utf8(bytes).unwrap();
         for forbidden in ["Bearer ", "sk-", "password123", "SECRET_CANARY"] {
             assert!(!text.contains(forbidden), "{name} contains {forbidden}");
         }
     }
-    let offline = root.join("config/grid-agent.example.json");
+    let offline = root.join("config/grid-agent.example.yml");
     let config = ConfigLoader::new().with_file(offline).load().unwrap();
     assert!(config.grid.is_none());
 }
@@ -46,10 +49,11 @@ fn service_and_installers_preserve_state_secrets_and_graceful_shutdown() {
         "ProtectSystem=strict",
         "NoNewPrivileges=true",
         "ReadWritePaths=/var/lib/metacrate/grid-agent",
+        "/etc/metacrate/config.yml",
     ] {
         assert!(unit.contains(required), "unit lacks {required}");
     }
-    for forbidden in ["API_KEY=", "PASSWORD=", "TOKEN="] {
+    for forbidden in ["API_KEY=", "PASSWORD=", "TOKEN=", "EnvironmentFile="] {
         assert!(!unit.contains(forbidden), "unit embeds {forbidden}");
     }
     let shell = fs::read_to_string(root.join("packaging/metacrate-grid-agent/install.sh")).unwrap();