From 61e70b93951e8f3e80057f354afa3eef89a4026c Mon Sep 17 00:00:00 2001 From: jochen Date: Sun, 4 Oct 2026 11:21:35 +0200 Subject: [PATCH] Research 027: the operator's choices, the hosts file, mounts, and two DHCP clients on one interface --- .../02-candidates-and-questions.md | 45 ++++++++++++++++++- 1 file changed, 43 insertions(+), 2 deletions(-) diff --git a/01-RESEARCH/027-the-system-layer-as-modules/02-candidates-and-questions.md b/01-RESEARCH/027-the-system-layer-as-modules/02-candidates-and-questions.md index 3ea28d6..b6be40b 100644 --- a/01-RESEARCH/027-the-system-layer-as-modules/02-candidates-and-questions.md +++ b/01-RESEARCH/027-the-system-layer-as-modules/02-candidates-and-questions.md @@ -8,6 +8,19 @@ assigned **only to the two workstations**, for development work. The servers run nothing through compose. +Later the same day, on the candidates below: + +- **Yes, all of them:** `docker`, `docker-compose`, `sudo`, `pacman`, an AUR helper (question 1), + `time-sync`, `kernel` (with boot and microcode), `logrotate`, `avahi`, `cups` with the printer's + driver, and every server-only candidate. +- **Locale, time zone and keymap are one module, `localization`.** +- **`snapd` and `flatpak`** are modules, on the two workstations only. +- **`incus` is the lab's,** whose module depends on it. It is not a module of its own beside the lab. +- **The agent's and the local model server's modules are still being developed,** and are not + assigned until they are. +- **The predecessor's CI user is retired.** It was removed from the anchor the same day, with its + sudoers line, its docker membership and a dangling unit link; the backup is on the machine. + ## Candidate modules **On every machine:** @@ -18,7 +31,7 @@ | `sudo` | the operator account's escalation as a drop-in, declared | the mesh's tools rely on it (to-be 38 WP4) and nothing states it | | `pacman` | `pacman.conf`'s few keys, the mirror list and its refresher, cache cleaning | mirrors generated once and never again | | `time-sync` | timesyncd and its drop-ins | two daemons across four machines | -| `locale` | locale, time zone, console keymap | one machine differs, with no record why | +| `localization` | locale, time zone, console keymap (one module, the operator's choice) | one machine differs, with no record why | | `kernel` | the kernel packages, microcode, initramfs presets | two machines without microcode | | `logrotate` | the timer and the base configuration | rotation runs on one machine of four | | `avahi` | the daemon and name-service switch entry | on all four, owned by none | @@ -76,12 +89,40 @@ filter, which is ADR 0100's ground. removes nothing it did not make. The choice is between an operator's one-off removal and a server-side `absent` declaration. +5. **The hosts file.** ADR 0199 (decided on an open change, not yet merged) + gives `/etc/hosts` to one module through a seat, `node-hosts-file`, with an operator region and + three verbs. It is not built. Today the private network's foundation writes only its own block, and + the rest of each file is a predecessor's stale blocks (both servers) or the operator's development + names (both workstations). The candidate module is that seat's first holder. It takes the + private-network block as a contribution, and its operator region replaces the hand-kept lines. + +6. **Mounts.** The host has no shape for a filesystem mount; ADR 0091 is about what a container + mounts. One workstation mounts a share of the home server over NFS, and a second share over SMB. + That second one fails, and its credential sits in clear in `/etc/fstab`. + + | | option | for | against | + |---|---|---|---| + | M1 | **A module owns `/etc/fstab`** and other modules contribute lines | one file, as people know it | the file also carries the root and boot filesystems the installer wrote, which no module should rewrite; a slot contribution into a file that can stop a machine booting | + | M2 | **Each client module writes its own systemd mount (and automount) unit**, which is the service manager's drop-in for exactly this. The `nfs-client` or `smb-client` module declares the unit file and the service shape enables it. `/etc/fstab` stays the machine's | no new host shape, and no shared file; the unit names its own dependencies (network online, the private network) and an automount does not hang a boot when the server is away; unassigning removes the mount | a mount reads as a unit, not a line | + | M3 | A new `mount` shape in the host | the host knows what a mount is | a second way to say what M2 says | + + Starting position: **M2.** The credential an SMB mount needs is a secret, written by the module's + own process from the vault, mode 0600, which is question 2's mechanism. The pair is a server + module exporting (`nfs-server`, `samba`) and a client module mounting. The client requires the + share the server provides, so the mount is resolved, not hand-typed. + +7. **Two DHCP clients on one interface.** The home server runs `dhcpcd`, a DHCP *client* (no machine + runs a DHCP server), next to the network manager, which is its assigned networking module. Both + lease an address on the same interface, which therefore carries two LAN addresses. The catalogue's + `dhcpcd` module is assigned nowhere, and this unit is a leftover. The network manager is the + machine's one DHCP client, and `dhcpcd` should be disabled there. + ## Security findings, independent of any module 1. A filesystem credential in clear text in a workstation's `/etc/fstab`, for a mount that is failing anyway. 2. A predecessor CI user with passwordless sudo and docker membership on the anchor, and a - predecessor sudoers drop-in. + predecessor sudoers drop-in. *The user was removed on 2026-10-04; the drop-in remains.* 3. The operator account in the `root` group on one workstation. Each is one small change. None waits for a module.