From ddb67fc095b06aea7021ca5aa44cc7a3bdd7f6bc Mon Sep 17 00:00:00 2001
From: jochen <jschoubben@novox.be>
Date: Sat, 26 Sep 2026 16:46:10 +0200
Subject: [PATCH] A bucket is the one the mesh derives, and the photos module
 named another
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The provisioner derives a consumer's bucket from the login the mesh minted — 'derived from the
login, so teardown recomputes it with nothing to persist' — and never reads the bucket a manifest
contributed. Three modules contributed one anyway, and the value was decorative in two and wrong in
the third: photos told its container MINIO_BUCKET=photos, the predecessor's bucket, while its minted
key is scoped to mesh-novox-photos. Deployed as it stood, it would have authenticated and then been
denied on every object.

photos now names the bucket the mesh actually provisions, and the contributed bucket is gone from
all three: a value nothing reads, that reads as though it decides.

Verified against the live store before changing anything: the derived names are the populated ones —
mesh-novox-ncloud (77,886 objects, 174.9 GiB), mesh-novox-photos and mesh-novox-invoice. Nothing has
to move.
---
 modules/invoicing/module.json | 3 ---
 modules/nextcloud/module.json | 3 ---
 modules/photos/module.json    | 5 +----
 3 files changed, 1 insertion(+), 10 deletions(-)

diff --git a/modules/invoicing/module.json b/modules/invoicing/module.json
index d7386ad..5337417 100644
--- a/modules/invoicing/module.json
+++ b/modules/invoicing/module.json
@@ -14,9 +14,6 @@
     "mongodb-database": {
       "name": "invoicing"
     },
-    "s3-bucket": {
-      "bucket": "invoicing"
-    },
     "route": {
       "site": {
         "label": "invoicing",
diff --git a/modules/nextcloud/module.json b/modules/nextcloud/module.json
index 1b86bea..ac0493a 100644
--- a/modules/nextcloud/module.json
+++ b/modules/nextcloud/module.json
@@ -11,9 +11,6 @@
     "postgres-database": {
       "name": "nextcloud"
     },
-    "s3-bucket": {
-      "bucket": "mesh-novox-ncloud"
-    },
     "route": {
       "label": "drive",
       "port": 80
diff --git a/modules/photos/module.json b/modules/photos/module.json
index 51b07e9..b804f99 100644
--- a/modules/photos/module.json
+++ b/modules/photos/module.json
@@ -10,9 +10,6 @@
     "route"
   ],
   "contributes": {
-    "s3-bucket": {
-      "bucket": "photos"
-    },
     "mongodb-database": {
       "name": "photos"
     },
@@ -56,7 +53,7 @@
       "type": "file",
       "path": "/var/lib/photos/server.env",
       "mode": "0600",
-      "content": "NODE_ENV=production\nPORT=9000\nMONGO_URL=mongodb://${bound:mongodb-database:as}:${secret:mongodb-database}@${bound:mongodb-database:at}:${bound:mongodb-database:port}/${bound:mongodb-database:as}?authSource=admin\nMONGO_DB=${bound:mongodb-database:as}\nMINIO_ENDPOINT=${bound:s3-bucket:at}\nMINIO_PORT=${bound:s3-bucket:port}\nMINIO_BUCKET=photos\nMINIO_ACCESSKEY=${bound:s3-bucket:as}\nMINIO_SECRET=${secret:s3-bucket}\nMINIO_USE_SSL=false\n"
+      "content": "NODE_ENV=production\nPORT=9000\nMONGO_URL=mongodb://${bound:mongodb-database:as}:${secret:mongodb-database}@${bound:mongodb-database:at}:${bound:mongodb-database:port}/${bound:mongodb-database:as}?authSource=admin\nMONGO_DB=${bound:mongodb-database:as}\nMINIO_ENDPOINT=${bound:s3-bucket:at}\nMINIO_PORT=${bound:s3-bucket:port}\nMINIO_BUCKET=mesh-novox-photos\nMINIO_ACCESSKEY=${bound:s3-bucket:as}\nMINIO_SECRET=${secret:s3-bucket}\nMINIO_USE_SSL=false\n"
     },
     {
       "id": "net",