From 8c9a2c7501247bdcfaf1e43be5d8480b7d210e86 Mon Sep 17 00:00:00 2001 From: jochen Date: Fri, 2 Oct 2026 16:27:33 +0200 Subject: [PATCH] ADR 0175: the found front end is uninstalled once a machine is converged; design 08 note --- ...uninstalled-once-a-machine-is-converged.md | 66 +++++++++++++++++++ 02-DECISIONS/README.md | 1 + 03-DESIGN/01-to-be/08-connectivity.md | 6 ++ 3 files changed, 73 insertions(+) create mode 100644 02-DECISIONS/0175-the-found-front-end-is-uninstalled-once-a-machine-is-converged.md diff --git a/02-DECISIONS/0175-the-found-front-end-is-uninstalled-once-a-machine-is-converged.md b/02-DECISIONS/0175-the-found-front-end-is-uninstalled-once-a-machine-is-converged.md new file mode 100644 index 0000000..9924f4c --- /dev/null +++ b/02-DECISIONS/0175-the-found-front-end-is-uninstalled-once-a-machine-is-converged.md @@ -0,0 +1,66 @@ +--- +topic: the mesh +status: accepted +date: 2026-10-02 +deciders: jochen +reconstructed: false +extends: 02-DECISIONS/0168-a-converged-machine-is-filtered-by-the-mesh-alone.md +--- + +# 175. The found front end is uninstalled once a machine is converged + +## Context + +[ADR 0100](0100-a-node-in-use-is-adopted-before-it-is-converged.md) retires the firewall a machine +was found with by disabling it, never flushing it, and keeps its configuration on disk so that +returning the node to adopted can enable it again. [ADR 0168](0168-a-converged-machine-is-filtered-by-the-mesh-alone.md) +made the host keep it retired and say so. Both machines of this mesh that had a front end have been +converged for days; neither is going back. What remained of the front end on each — its package, +its unit enabled for boot on one, its empty chains still wired into the kernel's hooks, a chain of +its container integration still dropping traffic on the IPv6 path until the day before this record +— was not a rollback path. It was software nobody runs, left where a reader finds it and asks +whether the machine has two firewalls. + +The operator asked on 2026-10-02 that it be disabled and uninstalled. Disabled it already was. For +uninstalled, the host had no word: a package could be declared present and not absent. + +## Decision + +**1. A package may be declared absent.** `absent: true` on a package resource has the host remove +the package when it is installed and leave alone a machine that never had it, through the machine's +own package manager, dependencies untouched. A declaration that stops saying a package is absent +installs nothing: there is nothing to undo. + +**2. The module that holds the packet filter seat declares the front end it replaced absent**, after +its own filter is loaded, so the mesh's table is in force before the front end's package goes. On a +converged machine the front end is therefore gone, not merely off; on an adopted machine nothing of +this runs, because the filter module is assigned by the flip and not before. + +**3. Returning such a machine to adopted enables nothing.** A machine with no firewall needs no +openings ([ADR 0100](0100-a-node-in-use-is-adopted-before-it-is-converged.md)); the host records the +front end as *removed*, says so once, and asks nothing of a command that is not there. What +ADR 0100 kept on disk for a return is kept only as far as the package manager keeps a changed +configuration file; the rollback path it described is given up on purpose. + +## Consequences + +- The host's vocabulary grows by `absent` on a package; an older host refuses a declaration + carrying it, so the host rolls before the module. +- The nftables module's declaration gains one resource; on the two machines of this mesh that were + found with ufw, the next push removes it. +- `node show` reads *found firewall: ufw, removed* on those machines from then on. +- ADR 0100's sentence about a return to adopted restoring the found firewall holds only while the + front end is installed, which after this record it is not on a converged machine. + +## How this is checked + +| Rule | Checked by | +|---|---| +| An absent package is removed when present, left when not, and read back | host tests over a fake package manager | +| An uninstalled front end is recorded as removed and nothing is asked of it | a host test with ufw missing on a converged apply | +| Live | the two machines report ufw gone: `pacman -Q ufw` has no answer, `node show` says removed, `status` is well | + +## References + +- [ADR 0100](0100-a-node-in-use-is-adopted-before-it-is-converged.md), [ADR 0168](0168-a-converged-machine-is-filtered-by-the-mesh-alone.md), [ADR 0170](0170-the-firewall-seat-serves-its-verbs.md) +- [Design 08 — Connectivity](../03-DESIGN/01-to-be/08-connectivity.md) diff --git a/02-DECISIONS/README.md b/02-DECISIONS/README.md index 4b3841a..4d2ecd8 100644 --- a/02-DECISIONS/README.md +++ b/02-DECISIONS/README.md @@ -182,6 +182,7 @@ python3 00-META/checks/index.py fail if stale - **0169** — [A machine joins through the tunnel, and the bus is never public](0169-a-machine-joins-through-the-tunnel-and-the-bus-is-never-public.md) - **0170** — [The firewall seat serves its verbs, and a foreign rule set is removed through one of them](0170-the-firewall-seat-serves-its-verbs.md) - **0172** — [The lab is a module, and runs a bed when the mesh asks](0172-the-lab-is-a-module-and-runs-a-bed-when-the-mesh-asks.md) +- **0175** — [The found front end is uninstalled once a machine is converged](0175-the-found-front-end-is-uninstalled-once-a-machine-is-converged.md) ### Its tiers, from the bottom up diff --git a/03-DESIGN/01-to-be/08-connectivity.md b/03-DESIGN/01-to-be/08-connectivity.md index e692647..18bf28d 100644 --- a/03-DESIGN/01-to-be/08-connectivity.md +++ b/03-DESIGN/01-to-be/08-connectivity.md @@ -9,6 +9,7 @@ code: - mesh-host internal/apply (the service that reflects a rule set) updated: 2026-10-02 decisions: + - 02-DECISIONS/0175-the-found-front-end-is-uninstalled-once-a-machine-is-converged.md - 02-DECISIONS/0170-the-firewall-seat-serves-its-verbs.md - 02-DECISIONS/0169-a-machine-joins-through-the-tunnel-and-the-bus-is-never-public.md - 02-DECISIONS/0168-a-converged-machine-is-filtered-by-the-mesh-alone.md @@ -772,6 +773,11 @@ the host reports as *other* is reached through the packet filter seat's `remove` by name on the bus; the seat also serves `rules` and `reload`, and its holder's runtime declares the `NET_ADMIN` capability on the machine's network. See design 33. +*2026-10-02, [ADR 0175](../../02-DECISIONS/0175-the-found-front-end-is-uninstalled-once-a-machine-is-converged.md):* +once a machine is converged, the front end it was found with is uninstalled, not merely disabled — the +packet filter's holder declares its package absent after the mesh's filter is loaded, and a return to +adopted then enables nothing. The rollback path ADR 0100 kept on disk is given up on purpose. + ## 5 — Certificates **Two authorities, kept separate on purpose.**