30 lines
2.1 KiB
Markdown
30 lines
2.1 KiB
Markdown
# Diagnosis — 2026-09-21
|
|
|
|
1. The certificate bed already raised the same authority image with no root supplied, and it made
|
|
its own root and issued within a second. The manifest's three minted "secrets" were not needed
|
|
by the authority; they were needed by the consumer, which was handed the root as a served fact.
|
|
2. Of the three ways to get a fact made at first start to a consumer, two need a channel from a
|
|
node up to the mesh that does not exist. The third needs nothing new: the provider serves the
|
|
fact at a path, and the consumer fetches it over the mesh network in a gate before it starts.
|
|
|
|
**Located in:** the two manifests. Decided in
|
|
[ADR 0098](../../02-DECISIONS/0098-a-fact-a-provider-makes-at-first-start-is-fetched-from-it.md).
|
|
|
|
**Proven** the same day: the route-forwarding bed raises the authority, the proxy and a consumer
|
|
from the catalogue on one node and serves a public name through the proxy. Two things the run
|
|
taught, both about the bed rather than the decision:
|
|
|
|
- The authority certifies itself for the machine's private-network address, which is what a
|
|
consumer on any node dials. A machine raised from the foundation bundle has no such address
|
|
until it is placed on the overlay, so a bed must place it first — as a hub of one, the way a
|
|
real first node is.
|
|
- With the overlay's networking and the three modules in **one** push, the proxy's fetch of the
|
|
roots timed out at the private-network address; with the overlay converged first and the
|
|
modules pushed after, it passes. The order between modules is not the cause: the controller
|
|
applies a node's providers before its consumers. The overlay interface and the filter that
|
|
admits it were not there yet, and the gate, as first written, tried once with no timeout — a
|
|
fetch that hangs holds the node's whole apply. The gate now retries with a timeout and refuses
|
|
a body that is not a certificate. A consumer whose first start dials a provider still assumes
|
|
the provider's network exists; a fact fetched once per declaration is
|
|
[issue 077](../077-a-fact-fetched-at-first-start-is-fetched-once/00-report.md).
|