4 Commits

Include renames

Author	SHA1	Message	Date
jschoubben	0e6ca453be	Say grafana's refused admin password once with its cause, and ask again hourly, not every 30 s (issue 774) ... Grafana on ace answers 401 to the vault's admin password, every 30 s since at least 2026-10-05. I think the cause is the adoption: Grafana keeps the admin password it was first given in its database and applies GF_SECURITY_ADMIN_PASSWORD__FILE only when it creates it; ace's Grafana came with its database before the mesh minted own/ace/grafana/admin (2026-09-30, generation 1, unchanged since), so the minted value never took (keycloak's admin, hq issue 179, is the same kind). Quick fix: none in code; the password in Grafana's database must become the vault's (grafana cli admin reset-admin-password in the container), an act on ace no tool offers yet. Thorough fix: a step that converges the admin password at every start, which needs a container entrypoint the node-engine's declaration does not carry. This commit does what the catalogue can now: the refusal is said once with its cause and what ends it, asked again hourly, and its end is said.	2026-10-30 18:18:16 +01:00
mesh-tools	0260ae92f6	Feature 57 (config and provisioning): release the catalogue, the reviewed release branch merged with main, on top of main	2026-10-16 09:42:45 +00:00
jochen	eb42806379	Make grafana prefer the vault's password, and let the secrets list only shrink (hq issue 342) ... grafana's client logged in with a token setting ahead of the vault's admin password, and its runtime config let a layer set token. The token setting is now ignored and said, token is protected, and the vault's password comes first. checks/secrets/known could gain a line hiding a newly unprotected key. merge-check.sh now judges it against the trunk's copy at the merge base, and refuses an added line.	2026-10-13 07:43:08 +02:00
jochen	4193eacec4	Mark grafana's and home-assistant's soft requirements optional (hq issue 166, ADR 0330) ... grafana runs without influxdb and home-assistant without the Servarr apps or a broker, yet a mesh without them could not assign either. Their requirements are now optional: bound when a provider runs, absent otherwise, with nothing installed for them. grafana's data source and its credential are delivered only while influxdb-api is bound, into directories it mounts, so an absent file never becomes a directory docker made in its place.	2026-10-13 00:41:30 +02:00