Issues 143 and 144: the found firewall is neither retired nor all of it #176

2026-09-28T23:36:09Z

mesh-admin commented

2026-09-28 23:36:09 +00:00

No description provided.

mesh-admin added 1 commit 2026-09-28 23:36:10 +00:00

Issues 143 and 144: the found firewall is neither retired nor all of it 862253518f

Both found by converging the control node — the first machine with a firewall to
flip, since the two before it had none.

143: the preview and the flip both say the found firewall is disabled. The node
reported converged, 372 resources applied, nothing failed, and ufw is still
enabled and active. A converged node's declaration carries no resource that would
disable it; the sentence is printed by the command and nothing implements it.

144: ufw was never what filtered the traffic that mattered there. Fifty forwarded
openings converged through it had matched zero packets, while a chain the
predecessor installed in the container runtime's pre-accept hook did the work —
in memory only, recreated by nothing. The mesh's filter now covers that path, so
the machine no longer depends on it, but the chain remains and is the only thing
refusing the bus and the registry, which the design requires reachable from
anywhere so a machine can enrol before it has a private address.

mesh-admin merged commit 75a8f6abc7 into main

2026-09-28 23:36:11 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: novox/hq#176