4 Commits

Include renames

Author	SHA1	Message	Date
mesh-tools	652b00b25b	Say on every directory how it treats files it does not know, and check it (issue 1024, ADR 0422) ... Every directory and archive resource carries `unknown`: move-out for a home folder whose program writes nothing there (the node-engine, delivered in mesh-host #117, moves the rest to ~/.local/state/mesh-moved/<module>/ with a list), module for ~/.ssh and ~/.claude, program elsewhere; `knows` keeps what a program or the operator relies on (powerlevel10k's compiled files, i3's scripts and the asus/g14 drop-ins, dunst's slack rule, betterbird's records, node-env's forge credential, issue 1033). Two shared folders are no longer declared. Each module's README says it. checks/owned holds every manifest to it; checks/sshdir stays while main's merge check runs it (issue 1035). Tests that pin a manifest follow the new key only. Reviewed in three rounds.	2026-10-17 16:23:03 +00:00
jschoubben	48850ebf90	The mesh's own files for a module are placed by the mesh, not the definition (issue 174) ... 48 definitions stop naming /var/lib/mesh/<module>: the directory says `place: "mesh"`, the two subdirectories beneath it (gitea's runtime state, anthropic-manager's output) state their path beneath it, and every credential, binding, merged file and mount names it as ${dir:mesh-state}. Resolved on the default root, every definition names exactly the paths it named before — TestPlacedDirectoriesKeepTheirPaths in mesh-controller, run over both checkouts. Needs the controller that knows the word (mesh-controller, same branch) one release ahead.	2026-09-30 22:29:28 +02:00
jschoubben	f118344246	Every module names its endpoints, and every route names the one it serves ... 75 endpoints across 50 modules, named from what each one is for rather than by a rule: mail's seven protocol ports are smtp, imaps, submission and the rest; unifi's nine are inform, stun, discovery, the two portal ports and syslog; minio's two are s3 and console; the resolver's two are dns-udp and dns-tcp. And 35 route contributions name the endpoint they serve instead of repeating its port. A route and a listen both carried a port and nothing said they were the same thing; now one of them does. gitea's path-level deny rule names neither, because it is a rule about a name rather than an endpoint. novox/hq ADR 0138. The words shipped a release ahead in mesh-controller #138 and #139, and the control plane running today is built from that merge — checked before this was written, because an unknown manifest key is refused and a catalogue using one against an older control plane would stop resolving.	2026-09-29 11:51:39 +02:00
jschoubben	229c6a83d1	Convert four more hal modules: bookshelf, unifi, fail2ban, marrytts ... - bookshelf: Servarr v1 fork on the radarr template (4 tools). - unifi: portainer-shaped tooled app (7 tools, 9 ports), settings-merged config. - fail2ban: host-level security module mirroring firewall (service + restart-on, no container); ban actions preserved as source ufw/iptables and FLAGGED to be rewritten nftables-native before it actually bans. - marrytts: manifest-only plain container (no tools), like resolv-conf. All typecheck against the built @novox/mesh-sdk; service images digest-pinned. Held from merge pending the hq initialization reconciliation. Claude-Session: https://claude.ai/code/session_01LrgweAeERJYBg88c5cKDzF	2026-09-05 12:04:14 +02:00