From 37634de1e37b6ecdfc52386a3340ec2d3363509a Mon Sep 17 00:00:00 2001
From: jochen <jschoubben@gmail.com>
Date: Sat, 26 Sep 2026 16:12:29 +0200
Subject: [PATCH] lavinmq: the broker TLS directory is the operator's, read by
 whoever needs it
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The controller now accesses /var/lib/mesh-broker-tls (mesh-controller
#54) and the push refused whole: lavinmq declared the directory as an
owned resource, and shared data is the operator's, owned by no module
(ADR 0051). lavinmq only ever reads the certs — genesis laid them down
— so it declares a read access like the controller does, and the
directory belongs to nobody.
---
 modules/lavinmq/module.json | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/modules/lavinmq/module.json b/modules/lavinmq/module.json
index 98a6150..3304cb7 100644
--- a/modules/lavinmq/module.json
+++ b/modules/lavinmq/module.json
@@ -81,12 +81,6 @@
       "path": "/var/lib/mesh-broker",
       "mode": "0700"
     },
-    {
-      "id": "broker-tls",
-      "type": "directory",
-      "path": "/var/lib/mesh-broker-tls",
-      "mode": "0700"
-    },
     {
       "id": "server",
       "type": "container",
@@ -147,5 +141,11 @@
         "from": "Dockerfile"
       }
     ]
-  }
+  },
+  "accesses": [
+    {
+      "path": "/var/lib/mesh-broker-tls",
+      "mode": "read"
+    }
+  ]
 }