catalogue: one mesh-state namespace — /var/lib/mesh/<module>/ (consistency)

The review found broker own-secret paths drifting: mostly /var/lib/<module>/
broker, but grafana/redis/icecast/nextcloud carried a '-module' suffix to dodge
a collision with the service's own /var/lib/<name> data, and photos sat under
/etc. Normalized to one collision-free namespace a service never owns:
/var/lib/mesh/<module>/broker, with a mesh-state directory resource for the
parent, across 24 modules. audit-logger is grandfathered (lab-proven, referenced
by the assigned test, and it has no service to collide with). All 33 manifests
parse; no client hardcoded a path, so nothing in code moved.

Claude-Session: https://claude.ai/code/session_01LrgweAeERJYBg88c5cKDzF

modules/bazarr/module.json

@@ -8,7 +8,7 @@
     "module.bazarr.subtitle.downloaded"
   ],
   "own-secrets": {
-    "broker": "/var/lib/bazarr/broker"
+    "broker": "/var/lib/mesh/bazarr/broker"
   },
   "listens": [
     {
@@ -19,6 +19,12 @@
     }
   ],
   "resources": [
+    {
+      "id": "mesh-state",
+      "type": "directory",
+      "path": "/var/lib/mesh/bazarr",
+      "mode": "0700"
+    },
     {
       "id": "config",
       "type": "directory",

modules/cloudflare-dns/module.json

@@ -18,13 +18,19 @@
   },
   "own-secrets": {
     "token": "/var/lib/cloudflare-dns/token",
-    "broker": "/var/lib/cloudflare-dns/broker"
+    "broker": "/var/lib/mesh/cloudflare-dns/broker"
   },
   "emits": [
     "module.cloudflare-dns.record.created",
     "module.cloudflare-dns.record.removed"
   ],
   "resources": [
+    {
+      "id": "mesh-state",
+      "type": "directory",
+      "path": "/var/lib/mesh/cloudflare-dns",
+      "mode": "0700"
+    },
     {
       "id": "state",
       "type": "directory",
@@ -61,7 +67,7 @@
         "/var/lib/cloudflare-dns/config.json:/run/config/config.json:ro",
         "/var/lib/cloudflare-dns/grants:/grants",
         "/var/lib/cloudflare-dns/token:/run/secrets/token:ro",
-        "/var/lib/cloudflare-dns/broker:/run/secrets/broker:ro"
+        "/var/lib/mesh/cloudflare-dns/broker:/run/secrets/broker:ro"
       ]
     }
   ]

modules/dnsmasq/module.json

@@ -12,7 +12,7 @@
     "module.dnsmasq.name.removed"
   ],
   "own-secrets": {
-    "broker": "/var/lib/dnsmasq/broker"
+    "broker": "/var/lib/mesh/dnsmasq/broker"
   },
   "claims": [
     {
@@ -30,6 +30,12 @@
     }
   ],
   "resources": [
+    {
+      "id": "mesh-state",
+      "type": "directory",
+      "path": "/var/lib/mesh/dnsmasq",
+      "mode": "0700"
+    },
     {
       "id": "package",
       "type": "package",

modules/gitea/module.json

@@ -39,9 +39,15 @@
   ],
   "own-secrets": {
     "internal-token": "/var/lib/gitea/internal-token.secret",
-    "broker": "/var/lib/gitea/broker"
+    "broker": "/var/lib/mesh/gitea/broker"
   },
   "resources": [
+    {
+      "id": "mesh-state",
+      "type": "directory",
+      "path": "/var/lib/mesh/gitea",
+      "mode": "0700"
+    },
     {
       "id": "state",
       "type": "directory",

modules/grafana/module.json

@@ -6,7 +6,7 @@
   ],
   "own-secrets": {
     "admin": "/var/lib/grafana-module/admin.secret",
-    "broker": "/var/lib/grafana-module/broker"
+    "broker": "/var/lib/mesh/grafana/broker"
   },
   "capabilities": [
     "container-runtime"
@@ -20,6 +20,12 @@
     }
   ],
   "resources": [
+    {
+      "id": "mesh-state",
+      "type": "directory",
+      "path": "/var/lib/mesh/grafana",
+      "mode": "0700"
+    },
     {
       "id": "state",
       "type": "directory",

modules/home-assistant/module.json

@@ -8,7 +8,7 @@
     "module.home-assistant.state.changed"
   ],
   "own-secrets": {
-    "broker": "/var/lib/home-assistant/broker"
+    "broker": "/var/lib/mesh/home-assistant/broker"
   },
   "listens": [
     {
@@ -19,6 +19,12 @@
     }
   ],
   "resources": [
+    {
+      "id": "mesh-state",
+      "type": "directory",
+      "path": "/var/lib/mesh/home-assistant",
+      "mode": "0700"
+    },
     {
       "id": "config",
       "type": "directory",

modules/icecast/module.json

@@ -12,7 +12,7 @@
     "source": "/var/lib/icecast-module/source.secret",
     "admin": "/var/lib/icecast-module/admin.secret",
     "relay": "/var/lib/icecast-module/relay.secret",
-    "broker": "/var/lib/icecast-module/broker"
+    "broker": "/var/lib/mesh/icecast/broker"
   },
   "listens": [
     {
@@ -23,6 +23,12 @@
     }
   ],
   "resources": [
+    {
+      "id": "mesh-state",
+      "type": "directory",
+      "path": "/var/lib/mesh/icecast",
+      "mode": "0700"
+    },
     {
       "id": "state",
       "type": "directory",

modules/keycloak/module.json

@@ -36,9 +36,15 @@
   ],
   "own-secrets": {
     "admin": "/var/lib/keycloak/admin.secret",
-    "broker": "/var/lib/keycloak/broker"
+    "broker": "/var/lib/mesh/keycloak/broker"
   },
   "resources": [
+    {
+      "id": "mesh-state",
+      "type": "directory",
+      "path": "/var/lib/mesh/keycloak",
+      "mode": "0700"
+    },
     {
       "id": "state",
       "type": "directory",

modules/mailu/module.json

@@ -50,9 +50,15 @@
     "secret-key": "/var/lib/mailu/secret-key.secret",
     "database": "/var/lib/mailu/database.secret",
     "admin": "/var/lib/mailu/admin.secret",
-    "broker": "/var/lib/mailu/broker"
+    "broker": "/var/lib/mesh/mailu/broker"
   },
   "resources": [
+    {
+      "id": "mesh-state",
+      "type": "directory",
+      "path": "/var/lib/mesh/mailu",
+      "mode": "0700"
+    },
     {
       "id": "state",
       "type": "directory",

modules/minio/module.json

@@ -36,9 +36,15 @@
   },
   "own-secrets": {
     "root": "/var/lib/minio/root.secret",
-    "broker": "/var/lib/minio/broker"
+    "broker": "/var/lib/mesh/minio/broker"
   },
   "resources": [
+    {
+      "id": "mesh-state",
+      "type": "directory",
+      "path": "/var/lib/mesh/minio",
+      "mode": "0700"
+    },
     {
       "id": "state",
       "type": "directory",

modules/nextcloud/module.json

@@ -27,7 +27,7 @@
   ],
   "own-secrets": {
     "admin": "/var/lib/nextcloud-module/admin.secret",
-    "broker": "/var/lib/nextcloud-module/broker"
+    "broker": "/var/lib/mesh/nextcloud/broker"
   },
   "capabilities": [
     "container-runtime"
@@ -41,6 +41,12 @@
     }
   ],
   "resources": [
+    {
+      "id": "mesh-state",
+      "type": "directory",
+      "path": "/var/lib/mesh/nextcloud",
+      "mode": "0700"
+    },
     {
       "id": "state",
       "type": "directory",

modules/nodered/module.json

@@ -5,7 +5,7 @@
     "module.nodered.flows.deployed"
   ],
   "own-secrets": {
-    "broker": "/var/lib/nodered/broker"
+    "broker": "/var/lib/mesh/nodered/broker"
   },
   "capabilities": [
     "container-runtime"
@@ -19,6 +19,12 @@
     }
   ],
   "resources": [
+    {
+      "id": "mesh-state",
+      "type": "directory",
+      "path": "/var/lib/mesh/nodered",
+      "mode": "0700"
+    },
     {
       "id": "data",
       "type": "directory",

modules/nzbget/module.json

@@ -10,7 +10,7 @@
   ],
   "consumes": [],
   "own-secrets": {
-    "broker": "/var/lib/nzbget/broker"
+    "broker": "/var/lib/mesh/nzbget/broker"
   },
   "listens": [
     {
@@ -21,6 +21,12 @@
     }
   ],
   "resources": [
+    {
+      "id": "mesh-state",
+      "type": "directory",
+      "path": "/var/lib/mesh/nzbget",
+      "mode": "0700"
+    },
     {
       "id": "config",
       "type": "directory",

modules/ombi/module.json

@@ -9,7 +9,7 @@
     "module.ombi.request.approved"
   ],
   "own-secrets": {
-    "broker": "/var/lib/ombi/broker"
+    "broker": "/var/lib/mesh/ombi/broker"
   },
   "listens": [
     {
@@ -20,6 +20,12 @@
     }
   ],
   "resources": [
+    {
+      "id": "mesh-state",
+      "type": "directory",
+      "path": "/var/lib/mesh/ombi",
+      "mode": "0700"
+    },
     {
       "id": "config",
       "type": "directory",

modules/photos/module.json

@@ -19,9 +19,15 @@
     "module.photos.item.added"
   ],
   "own-secrets": {
-    "broker": "/etc/photos/broker"
+    "broker": "/var/lib/mesh/photos/broker"
   },
   "resources": [
+    {
+      "id": "mesh-state",
+      "type": "directory",
+      "path": "/var/lib/mesh/photos",
+      "mode": "0700"
+    },
     {
       "id": "config",
       "type": "directory",

modules/plex/module.json

@@ -13,7 +13,7 @@
     "module.*.download.completed"
   ],
   "own-secrets": {
-    "broker": "/var/lib/plex/broker"
+    "broker": "/var/lib/mesh/plex/broker"
   },
   "listens": [
     {
@@ -24,6 +24,12 @@
     }
   ],
   "resources": [
+    {
+      "id": "mesh-state",
+      "type": "directory",
+      "path": "/var/lib/mesh/plex",
+      "mode": "0700"
+    },
     {
       "id": "config",
       "type": "directory",

modules/postgres/module.json

@@ -33,9 +33,15 @@
   },
   "own-secrets": {
     "superuser": "/var/lib/postgres/superuser.secret",
-    "broker": "/var/lib/postgres/broker"
+    "broker": "/var/lib/mesh/postgres/broker"
   },
   "resources": [
+    {
+      "id": "mesh-state",
+      "type": "directory",
+      "path": "/var/lib/mesh/postgres",
+      "mode": "0700"
+    },
     {
       "id": "state",
       "type": "directory",

modules/qbittorrent/module.json

@@ -10,7 +10,7 @@
   ],
   "consumes": [],
   "own-secrets": {
-    "broker": "/var/lib/qbittorrent/broker"
+    "broker": "/var/lib/mesh/qbittorrent/broker"
   },
   "listens": [
     {
@@ -21,6 +21,12 @@
     }
   ],
   "resources": [
+    {
+      "id": "mesh-state",
+      "type": "directory",
+      "path": "/var/lib/mesh/qbittorrent",
+      "mode": "0700"
+    },
     {
       "id": "config",
       "type": "directory",

modules/radarr/module.json

@@ -10,7 +10,7 @@
   ],
   "consumes": [],
   "own-secrets": {
-    "broker": "/var/lib/radarr/broker"
+    "broker": "/var/lib/mesh/radarr/broker"
   },
   "listens": [
     {
@@ -21,6 +21,12 @@
     }
   ],
   "resources": [
+    {
+      "id": "mesh-state",
+      "type": "directory",
+      "path": "/var/lib/mesh/radarr",
+      "mode": "0700"
+    },
     {
       "id": "config",
       "type": "directory",

modules/redis/module.json

@@ -25,7 +25,7 @@
   },
   "own-secrets": {
     "default": "/var/lib/redis-module/default.secret",
-    "broker": "/var/lib/redis-module/broker"
+    "broker": "/var/lib/mesh/redis/broker"
   },
   "listens": [
     {
@@ -36,6 +36,12 @@
     }
   ],
   "resources": [
+    {
+      "id": "mesh-state",
+      "type": "directory",
+      "path": "/var/lib/mesh/redis",
+      "mode": "0700"
+    },
     {
       "id": "state",
       "type": "directory",

modules/registry/module.json

@@ -20,7 +20,7 @@
     "module.registry.image.pushed"
   ],
   "own-secrets": {
-    "broker": "/var/lib/registry/broker"
+    "broker": "/var/lib/mesh/registry/broker"
   },
   "serves": {
     "artifact-store": {

modules/sonarr/module.json

@@ -10,7 +10,7 @@
   ],
   "consumes": [],
   "own-secrets": {
-    "broker": "/var/lib/sonarr/broker"
+    "broker": "/var/lib/mesh/sonarr/broker"
   },
   "listens": [
     {
@@ -21,6 +21,12 @@
     }
   ],
   "resources": [
+    {
+      "id": "mesh-state",
+      "type": "directory",
+      "path": "/var/lib/mesh/sonarr",
+      "mode": "0700"
+    },
     {
       "id": "config",
       "type": "directory",

modules/tautulli/module.json

@@ -5,7 +5,7 @@
     "module.tautulli.watch.recorded"
   ],
   "own-secrets": {
-    "broker": "/var/lib/tautulli/broker"
+    "broker": "/var/lib/mesh/tautulli/broker"
   },
   "capabilities": [
     "container-runtime"
@@ -19,6 +19,12 @@
     }
   ],
   "resources": [
+    {
+      "id": "mesh-state",
+      "type": "directory",
+      "path": "/var/lib/mesh/tautulli",
+      "mode": "0700"
+    },
     {
       "id": "config",
       "type": "directory",

modules/verdaccio/module.json

@@ -8,7 +8,7 @@
     "module.verdaccio.package.published"
   ],
   "own-secrets": {
-    "broker": "/var/lib/verdaccio/broker"
+    "broker": "/var/lib/mesh/verdaccio/broker"
   },
   "listens": [
     {
@@ -19,6 +19,12 @@
     }
   ],
   "resources": [
+    {
+      "id": "mesh-state",
+      "type": "directory",
+      "path": "/var/lib/mesh/verdaccio",
+      "mode": "0700"
+    },
     {
       "id": "conf",
       "type": "directory",