A bucket is the one the mesh derives, and the photos module named another

The provisioner derives a consumer's bucket from the login the mesh minted — 'derived from the
login, so teardown recomputes it with nothing to persist' — and never reads the bucket a manifest
contributed. Three modules contributed one anyway, and the value was decorative in two and wrong in
the third: photos told its container MINIO_BUCKET=photos, the predecessor's bucket, while its minted
key is scoped to mesh-novox-photos. Deployed as it stood, it would have authenticated and then been
denied on every object.

photos now names the bucket the mesh actually provisions, and the contributed bucket is gone from
all three: a value nothing reads, that reads as though it decides.

Verified against the live store before changing anything: the derived names are the populated ones —
mesh-novox-ncloud (77,886 objects, 174.9 GiB), mesh-novox-photos and mesh-novox-invoice. Nothing has
to move.
This commit is contained in:
jochen
2026-09-26 16:46:10 +02:00
parent 36c5f87130
commit ddb67fc095
3 changed files with 1 additions and 10 deletions
-3
View File
@@ -14,9 +14,6 @@
"mongodb-database": { "mongodb-database": {
"name": "invoicing" "name": "invoicing"
}, },
"s3-bucket": {
"bucket": "invoicing"
},
"route": { "route": {
"site": { "site": {
"label": "invoicing", "label": "invoicing",
-3
View File
@@ -11,9 +11,6 @@
"postgres-database": { "postgres-database": {
"name": "nextcloud" "name": "nextcloud"
}, },
"s3-bucket": {
"bucket": "mesh-novox-ncloud"
},
"route": { "route": {
"label": "drive", "label": "drive",
"port": 80 "port": 80
+1 -4
View File
@@ -10,9 +10,6 @@
"route" "route"
], ],
"contributes": { "contributes": {
"s3-bucket": {
"bucket": "photos"
},
"mongodb-database": { "mongodb-database": {
"name": "photos" "name": "photos"
}, },
@@ -56,7 +53,7 @@
"type": "file", "type": "file",
"path": "/var/lib/photos/server.env", "path": "/var/lib/photos/server.env",
"mode": "0600", "mode": "0600",
"content": "NODE_ENV=production\nPORT=9000\nMONGO_URL=mongodb://${bound:mongodb-database:as}:${secret:mongodb-database}@${bound:mongodb-database:at}:${bound:mongodb-database:port}/${bound:mongodb-database:as}?authSource=admin\nMONGO_DB=${bound:mongodb-database:as}\nMINIO_ENDPOINT=${bound:s3-bucket:at}\nMINIO_PORT=${bound:s3-bucket:port}\nMINIO_BUCKET=photos\nMINIO_ACCESSKEY=${bound:s3-bucket:as}\nMINIO_SECRET=${secret:s3-bucket}\nMINIO_USE_SSL=false\n" "content": "NODE_ENV=production\nPORT=9000\nMONGO_URL=mongodb://${bound:mongodb-database:as}:${secret:mongodb-database}@${bound:mongodb-database:at}:${bound:mongodb-database:port}/${bound:mongodb-database:as}?authSource=admin\nMONGO_DB=${bound:mongodb-database:as}\nMINIO_ENDPOINT=${bound:s3-bucket:at}\nMINIO_PORT=${bound:s3-bucket:port}\nMINIO_BUCKET=mesh-novox-photos\nMINIO_ACCESSKEY=${bound:s3-bucket:as}\nMINIO_SECRET=${secret:s3-bucket}\nMINIO_USE_SSL=false\n"
}, },
{ {
"id": "net", "id": "net",