Five modules keep their own secrets from the vault, under local names; route-proxy declares its bases

gitea, umami, influxdb, icecast and mailu require a secret and keep each of theirs
under a local name (novox/hq ADR 0094); the broker account stays their own. The
route proxy's recipe starts FROM the bases its manifest declares (ADR 0097).

modules/route-proxy/Dockerfile

@@ -1,3 +1,5 @@
+ARG ALPINE_BASE=alpine:3.20
+ARG GO_BASE=golang:1.25
 # The route-proxy module's runtime image: the reference reverse proxy compiled into a container.
 #
 # **The proxy source is not vendored here.** The canonical proxy — the contract written as something
@@ -10,7 +12,7 @@
 #
 # The mesh pins the digest of what this produces; the committed module.json carries the placeholder
 # digest every mesh-built image does, replaced at publish.
-FROM golang:1.25 AS build
+FROM ${GO_BASE} AS build
 WORKDIR /src
 COPY go.mod go.sum ./
 RUN go mod download
@@ -19,7 +21,7 @@ RUN CGO_ENABLED=0 GOOS=linux go build -trimpath -o /mesh-route-proxy ./examples/
 
 # A small runtime with the public CA roots the ACME client needs to reach a real authority, and run
 # as root so it can bind :80 and :443 — the two privileged ports a public front door listens on.
-FROM alpine:3.20
+FROM ${ALPINE_BASE}
 RUN apk add --no-cache ca-certificates
 COPY --from=build /mesh-route-proxy /usr/local/bin/mesh-route-proxy
 ENTRYPOINT ["/usr/local/bin/mesh-route-proxy"]

modules/route-proxy/module.json

@@ -98,5 +98,17 @@
         "ACME_CA_BUNDLE": "/ca/root.crt"
       }
     }
-  ]
+  ],
+  "build": {
+    "on": [
+      {
+        "arg": "GO_BASE",
+        "image": "golang@sha256:699337d620559a59b4a2bb298ad59611e535d2ee755a34cf2d2a98f37578dc80"
+      },
+      {
+        "arg": "ALPINE_BASE",
+        "image": "alpine@sha256:d9e853e87e55526f6b2917df91a2115c36dd7c696a35be12163d44e6e2a4b6bc"
+      }
+    ]
+  }
 }