5 Commits

Include renames

Author	SHA1	Message	Date
jochen	fe2040c65e	Keep every password, token and API key the vault's, never a setting (hq issue 342) ... A setting outranked the vault: baserow, grafana, letta and unifi merged a layer's password over the ${secret:...} in their runtime config, and the gitea, home-assistant, icecast, influxdb, mailu and nextcloud clients read the settings file before the vault's file. A secret in a setting cannot be rotated and is read back by the settings verb. The four files now keep their password protected, so the controller refuses a setting of it. The six clients ignore a secret in the settings file and say so once, by key and never with the value; icecast reads its admin password from the vault's file. checks/secrets refuses a mergeable file whose secret a layer could replace; searxng's nested server.secret_key is listed as known until the controller protects a nested key.	2026-10-13 07:32:19 +02:00
jschoubben	d289e5a928	modules: wire tool-runtime app credentials as own-secrets ... The six modules that run a mesh-<mod> tool-runtime sidecar read an app credential from an env var the manifest never provided, so the sidecar crash-looped in the whole-mesh dry-run (e.g. "no Plex token — set MESH_PLEX_TOKEN"). These are operator-set app secrets, so deliver them the same way cloudflare-dns delivers its API token: an own-secret file mounted read-only, with a MESH_<APP>_*_FILE env pointing at the mount, and the runtime code preferring that file (falling back to the existing env so nothing regresses). - plex: own-secret token -> /run/secrets/token, MESH_PLEX_TOKEN_FILE - bazarr: own-secret api-key -> /run/secrets/api-key, MESH_BAZARR_API_KEY_FILE - ombi: own-secret api-key -> /run/secrets/api-key, MESH_OMBI_API_KEY_FILE - home-assistant: own-secret token -> /run/secrets/token, MESH_HOMEASSISTANT_TOKEN_FILE - nzbget: own-secret password -> /run/secrets/password, MESH_NZBGET_PASSWORD_FILE (URL stays plain env) - qbittorrent: own-secret password -> /run/secrets/password, MESH_QBITTORRENT_PASSWORD_FILE (URL stays plain env) The operator now completes each with `secret accept <node> <module> <name> --from <file>`. tsc passes for all six.	2026-09-08 18:40:23 +02:00
jschoubben	6e8c18afff	Resync hq ADR references 0044-0054 -> 0039-0049 after the hq record reconciliation	2026-09-05 12:49:16 +02:00
jschoubben	9e156a5b9e	Roll out the tool runtime to the remaining tools+events modules (ADR 0052/0051) ... Nineteen modules gain a broker-bound runtime container that serves the module's tools under its own scoped account: bazarr, gitea, grafana, home-assistant, icecast, influxdb, jackett, keycloak, mailu, nextcloud, nodered, nzbget, ombi, photos, portainer, qbittorrent, searxng, tautulli, verdaccio. Config is the assignment's, not the manifest's (ADR 0051): each client's fromEnv overlays a settings-merged config file (MESH_<M>_CONFIG_FILE) over its env fallbacks, so URL and credentials come from `settings set`, with the URL defaulting to the server on the node. nextcloud and mailu also mount the docker socket for their exec-based tools. Proven in the mesh-lab: assigned-grafana green — settings deliver the URL and token, the runtime reads the merged config and serves grafana's tools under the scoped account, with nothing in the manifest. Two gaps this surfaced are filed as hq issues 008 (a provider runtime's seal key) and 009 (a settings change does not restart a container runtime). Claude-Session: https://claude.ai/code/session_01LrgweAeERJYBg88c5cKDzF	2026-09-04 23:08:40 +02:00
jschoubben	aca237b2e0	home-assistant, influxdb: full nox modules (ADR 0044/0046) ... home-assistant: states/call-service/config tools, emits state.changed bounded to actuator/contact domains (not attribute ticks), overridable via a watch allowlist. influxdb: health/buckets/flux-query tools — tools-only, since a time-series DB has no lifecycle event to emit here. Typecheck; manifests parse.	2026-09-04 02:44:17 +02:00