3.7 KiB
topic, status, date, deciders, reconstructed, extends
| topic | status | date | deciders | reconstructed | extends |
|---|---|---|---|---|---|
| the mesh | accepted | 2026-10-02 | jochen | false | 02-DECISIONS/0168-a-converged-machine-is-filtered-by-the-mesh-alone.md |
175. The found front end is uninstalled once a machine is converged
Context
ADR 0100 retires the firewall a machine was found with by disabling it, never flushing it, and keeps its configuration on disk so that returning the node to adopted can enable it again. ADR 0168 made the host keep it retired and say so. Both machines of this mesh that had a front end have been converged for days; neither is going back. What remained of the front end on each — its package, its unit enabled for boot on one, its empty chains still wired into the kernel's hooks, a chain of its container integration still dropping traffic on the IPv6 path until the day before this record — was not a rollback path. It was software nobody runs, left where a reader finds it and asks whether the machine has two firewalls.
The operator asked on 2026-10-02 that it be disabled and uninstalled. Disabled it already was. For uninstalled, the host had no word: a package could be declared present and not absent.
Decision
1. A package may be declared absent. absent: true on a package resource has the host remove
the package when it is installed and leave alone a machine that never had it, through the machine's
own package manager, dependencies untouched. A declaration that stops saying a package is absent
installs nothing: there is nothing to undo.
2. The module that holds the packet filter seat declares the front end it replaced absent, after its own filter is loaded, so the mesh's table is in force before the front end's package goes. On a converged machine the front end is therefore gone, not merely off; on an adopted machine nothing of this runs, because the filter module is assigned by the flip and not before.
3. Returning such a machine to adopted enables nothing. A machine with no firewall needs no openings (ADR 0100); the host records the front end as removed, says so once, and asks nothing of a command that is not there. What ADR 0100 kept on disk for a return is kept only as far as the package manager keeps a changed configuration file; the rollback path it described is given up on purpose.
Consequences
- The host's vocabulary grows by
absenton a package; an older host refuses a declaration carrying it, so the host rolls before the module. - The nftables module's declaration gains one resource; on the two machines of this mesh that were found with ufw, the next push removes it.
node showreads found firewall: ufw, removed on those machines from then on.- ADR 0100's sentence about a return to adopted restoring the found firewall holds only while the front end is installed, which after this record it is not on a converged machine.
How this is checked
| Rule | Checked by |
|---|---|
| An absent package is removed when present, left when not, and read back | host tests over a fake package manager |
| An uninstalled front end is recorded as removed and nothing is asked of it | a host test with ufw missing on a converged apply |
| Live | the two machines report ufw gone: pacman -Q ufw has no answer, node show says removed, status is well |