Modus Serverless Framework

Modus is a serverless framework that turns functions into scalable, AI-ready GraphQL endpoints. It uses WebAssembly (Wasm) to provide a sandboxed execution environment.

The Workflow

1. Development: You write a function in a supported language (Go or AssemblyScript).
2. Compilation: Modus extracts metadata, optimizes the code for the host environment, and caches the compiled module.
3. Deployment/Activation: Modus reads the app's manifest to extract connections, models, and configuration, then generates a GraphQL API schema.
4. Execution: When a GraphQL query is received, Modus loads the Wasm module into a sandboxed environment with dedicated memory, runs the code using host functions for AI/data access, and returns the result.

// Example AssemblyScript function
export function sayHello(name: string): string {
  return `Hello, ${name}!`;
}

// Example GraphQL query to call the function
query SayHello {
  sayHello(name: "World")
}

This guide demonstrates how to set up a local environment using kind to test the Modus secrets implementation.

Prerequisites

A running Kubernetes cluster is required. This example uses kind for local testing.

Steps

1. Initialize the cluster: Run the provided setup script to create a local kind cluster.
2. Build the application: Compile the Modus app using the build script.
3. Execute the runtime: Run the application using modus_runtime with Kubernetes secret flags.

Verification

To verify the implementation is working correctly:

1. Call the GetSecretValue() function with the input argument "foo".
2. Confirm that the function returns "bar".

# Setup local kind cluster for testing
bash setup.sh

# Build the Modus app
bash build.sh

# Run the Modus app
modus_runtime -appPath ./build -useKubernetesSecret -kubernetesSecretName default/example

When executed, the modus-keygen tool produces both standard output (stdout) and local files.

Standard Output (stdout)

The tool prints a JSON-encoded object and a JWT token:

1. RSA Public Key (JSON): A JSON object containing an RSA public key. This is intended to be passed to the MODUS_PEMS environment variable.
2. JWT Token: A bearer token signed with the generated RSA key. It has a 1-year expiration date and no additional claims. This is used for authorization.

Generated Files

The tool creates two files in your current working directory:

• private-key.pem: A 2048-bit RSA private key. IMPORTANT: Keep this secret and do not lose it. You need this file to issue new JWT tokens that can be validated by the public key.
• public-key.pem: The corresponding public key (this matches the JSON output provided to stdout).

Note on persistence: If private-key.pem already exists in the working directory, the tool will re-use it instead of generating a new key pair. This allows you to run the tool multiple times to generate additional JWTs from the same existing key pair.