---
topic: the mesh
status: accepted
date: 2026-10-02
deciders: jochen
reconstructed: false
extends: 02-DECISIONS/0168-a-converged-machine-is-filtered-by-the-mesh-alone.md
---

# 175. The found front end is uninstalled once a machine is converged

## Context

[ADR 0100](0100-a-node-in-use-is-adopted-before-it-is-converged.md) retires the firewall a machine
was found with by disabling it, never flushing it, and keeps its configuration on disk so that
returning the node to adopted can enable it again. [ADR 0168](0168-a-converged-machine-is-filtered-by-the-mesh-alone.md)
made the host keep it retired and say so. Both machines of this mesh that had a front end have been
converged for days; neither is going back. What remained of the front end on each — its package,
its unit enabled for boot on one, its empty chains still wired into the kernel's hooks, a chain of
its container integration still dropping traffic on the IPv6 path until the day before this record
— was not a rollback path. It was software nobody runs, left where a reader finds it and asks
whether the machine has two firewalls.

The operator asked on 2026-10-02 that it be disabled and uninstalled. Disabled it already was. For
uninstalled, the host had no word: a package could be declared present and not absent.

## Decision

**1. A package may be declared absent.** `absent: true` on a package resource has the host remove
the package when it is installed and leave alone a machine that never had it, through the machine's
own package manager, dependencies untouched. A declaration that stops saying a package is absent
installs nothing: there is nothing to undo.

**2. The module that holds the packet filter seat declares the front end it replaced absent**, after
its own filter is loaded, so the mesh's table is in force before the front end's package goes. On a
converged machine the front end is therefore gone, not merely off; on an adopted machine nothing of
this runs, because the filter module is assigned by the flip and not before.

**3. Returning such a machine to adopted enables nothing.** A machine with no firewall needs no
openings ([ADR 0100](0100-a-node-in-use-is-adopted-before-it-is-converged.md)); the host records the
front end as *removed*, says so once, and asks nothing of a command that is not there. What
ADR 0100 kept on disk for a return is kept only as far as the package manager keeps a changed
configuration file; the rollback path it described is given up on purpose.

## Consequences

- The host's vocabulary grows by `absent` on a package; an older host refuses a declaration
  carrying it, so the host rolls before the module.
- The nftables module's declaration gains one resource; on the two machines of this mesh that were
  found with ufw, the next push removes it.
- `node show` reads *found firewall: ufw, removed* on those machines from then on.
- ADR 0100's sentence about a return to adopted restoring the found firewall holds only while the
  front end is installed, which after this record it is not on a converged machine.

## How this is checked

| Rule | Checked by |
|---|---|
| An absent package is removed when present, left when not, and read back | host tests over a fake package manager |
| An uninstalled front end is recorded as removed and nothing is asked of it | a host test with ufw missing on a converged apply |
| Live | the two machines report ufw gone: `pacman -Q ufw` has no answer, `node show` says removed, `status` is well |

## References

- [ADR 0100](0100-a-node-in-use-is-adopted-before-it-is-converged.md), [ADR 0168](0168-a-converged-machine-is-filtered-by-the-mesh-alone.md), [ADR 0170](0170-the-firewall-seat-serves-its-verbs.md)
- [Design 08 — Connectivity](../03-DESIGN/01-to-be/08-connectivity.md)