jochen
179fd7f83f
The runtime work of design 37 broken down the way design 28 broke down the bus: what exists measured (the host needs no change — a process and an archive are what the runtime and a bundle are; the runtime does the job for one module and must do it for a list), the order the dependencies allow, and eight packages each ending at a proof on the live mesh — the lab skipped by the operator's decision, ADR 0149 cited. WP1 the runtime serves many modules; WP2 the controller composes one per node (a node principal, bundle archives, the runtime's process, the gate); WP3 the runtime is a module and the console its serving mode; WP4 the packet filter moves first; WP5 the shell on a server; WP6 the service manager on a workstation; WP7–8 named and not broken down. Main carried two records numbered 0175 and cycle.py refused it: the one that landed last (the found front end is uninstalled) takes 0180, the next free across main and the open changes, with a dated note; design 08's citation follows it; the index is regenerated.
69 lines
4.0 KiB
Markdown
69 lines
4.0 KiB
Markdown
---
|
|
topic: the mesh
|
|
status: accepted
|
|
date: 2026-10-02
|
|
deciders: jochen
|
|
reconstructed: false
|
|
extends: 02-DECISIONS/0168-a-converged-machine-is-filtered-by-the-mesh-alone.md
|
|
---
|
|
|
|
# 180. The found front end is uninstalled once a machine is converged
|
|
|
|
> **Renumbered 2026-10-02.** Written and merged as 0175 while another record already held that number on main (one tool runtime per node, merged minutes earlier); `cycle.py` refused main. The branch that lands last renumbers: 0178 and 0179 are claimed by open changes, so this is 0180. Nothing cited it by number.
|
|
|
|
## Context
|
|
|
|
[ADR 0100](0100-a-node-in-use-is-adopted-before-it-is-converged.md) retires the firewall a machine
|
|
was found with by disabling it, never flushing it, and keeps its configuration on disk so that
|
|
returning the node to adopted can enable it again. [ADR 0168](0168-a-converged-machine-is-filtered-by-the-mesh-alone.md)
|
|
made the host keep it retired and say so. Both machines of this mesh that had a front end have been
|
|
converged for days; neither is going back. What remained of the front end on each — its package,
|
|
its unit enabled for boot on one, its empty chains still wired into the kernel's hooks, a chain of
|
|
its container integration still dropping traffic on the IPv6 path until the day before this record
|
|
— was not a rollback path. It was software nobody runs, left where a reader finds it and asks
|
|
whether the machine has two firewalls.
|
|
|
|
The operator asked on 2026-10-02 that it be disabled and uninstalled. Disabled it already was. For
|
|
uninstalled, the host had no word: a package could be declared present and not absent.
|
|
|
|
## Decision
|
|
|
|
**1. A package may be declared absent.** `absent: true` on a package resource has the host remove
|
|
the package when it is installed and leave alone a machine that never had it, through the machine's
|
|
own package manager, dependencies untouched. A declaration that stops saying a package is absent
|
|
installs nothing: there is nothing to undo.
|
|
|
|
**2. The module that holds the packet filter seat declares the front end it replaced absent**, after
|
|
its own filter is loaded, so the mesh's table is in force before the front end's package goes. On a
|
|
converged machine the front end is therefore gone, not merely off; on an adopted machine nothing of
|
|
this runs, because the filter module is assigned by the flip and not before.
|
|
|
|
**3. Returning such a machine to adopted enables nothing.** A machine with no firewall needs no
|
|
openings ([ADR 0100](0100-a-node-in-use-is-adopted-before-it-is-converged.md)); the host records the
|
|
front end as *removed*, says so once, and asks nothing of a command that is not there. What
|
|
ADR 0100 kept on disk for a return is kept only as far as the package manager keeps a changed
|
|
configuration file; the rollback path it described is given up on purpose.
|
|
|
|
## Consequences
|
|
|
|
- The host's vocabulary grows by `absent` on a package; an older host refuses a declaration
|
|
carrying it, so the host rolls before the module.
|
|
- The nftables module's declaration gains one resource; on the two machines of this mesh that were
|
|
found with ufw, the next push removes it.
|
|
- `node show` reads *found firewall: ufw, removed* on those machines from then on.
|
|
- ADR 0100's sentence about a return to adopted restoring the found firewall holds only while the
|
|
front end is installed, which after this record it is not on a converged machine.
|
|
|
|
## How this is checked
|
|
|
|
| Rule | Checked by |
|
|
|---|---|
|
|
| An absent package is removed when present, left when not, and read back | host tests over a fake package manager |
|
|
| An uninstalled front end is recorded as removed and nothing is asked of it | a host test with ufw missing on a converged apply |
|
|
| Live | the two machines report ufw gone: `pacman -Q ufw` has no answer, `node show` says removed, `status` is well |
|
|
|
|
## References
|
|
|
|
- [ADR 0100](0100-a-node-in-use-is-adopted-before-it-is-converged.md), [ADR 0168](0168-a-converged-machine-is-filtered-by-the-mesh-alone.md), [ADR 0170](0170-the-firewall-seat-serves-its-verbs.md)
|
|
- [Design 08 — Connectivity](../03-DESIGN/01-to-be/08-connectivity.md)
|