Commit Graph
1699 Commits
Author SHA1 Message Date
mesh-tools c3d3194bc8 Merge pull request 'nextcloud: keep onlyoffice's jwt off argv, and re-check a failed connection every tick (issues 1831, 1832)' (#446) from fix/onlyoffice-followups into main 2026-10-22 14:51:59 +00:00
jochen 6bf054b982 Take issue 1843's owner change back out: giving the converter the module root opens a link swap to root (review), so 1843 needs its own design
mesh/check failed: unit: modules/gitea.test: ✔ the same merge, head or close announced twice has the same id, and another has another (8.058792ms) | 6…
mesh/merge-gate head 6bf054b98261 merged into trunk d0463fb5100f — pass: builds nextcloud → novox; no bus step; every machine composes with the change as i…
mesh/repo-check head 6bf054b98261 merged into trunk d0463fb5100f — pass: its merge-check.sh passed, each part in its toolchain: merge-check.sh (go), merge-…
mesh/delivery delivered
2026-10-22 16:37:35 +02:00
jochen d0a3784be2 only-office: bar every account but the converter from the state root (issue 1843)
lib (bind-mounted into the container at /var/lib/onlyoffice) was 0711 so
nginx inside the container could reach App_Data/cache, and the module
root above it stayed 0711 too, so any account on the machine could walk
through the root into lib's 0755 directories and 0644 files to read
converted documents. The container never passes through the root — only
the converter process does, to read jwt.secret and
broker-converter.secret — so the root is now 0710, owned by the
converter account: only that account and root pass through it. lib
stays 0711 (1837/AC3).
2026-10-22 16:34:06 +02:00
jschoubben 555ed4963a Read the pinned placement at its new path in the pin integration test (issue 1148)
mesh/check failed: unit: modules/gitea.test: [gitea] where the poll of merges last looked from could not be read, so none is kept — no runtime | 555ed…
mesh/merge-gate head 555ed4963a8a merged into trunk 77578a882f8a — pass: builds mesh-build-go → ace, g14, novox, shanks; no bus step; every machine compose…
mesh/repo-check head 555ed4963a8a merged into trunk 77578a882f8a — pass: its merge-check.sh passed, each part in its toolchain: merge-check.sh (go), merge-…
mesh/delivery delivered
2026-10-22 16:29:37 +02:00
jochen edb6d3b7d3 nextcloud: keep checking onlyoffice's connection while the last check failed (issue 1832)
applyOnlyOffice only ran the connection check when a setting changed, so
once it failed while settings matched, nothing checked again and the
failure was logged once and forgotten. The client now remembers whether
the last check failed and re-runs it on every tick until it passes;
index.ts logs every failing tick and one line when it recovers.
2026-10-22 16:28:35 +02:00
jochen 8928e6f972 nextcloud: keep onlyoffice's jwt_secret off every argv (issue 1831)
occ's config:app:set put the secret on the docker exec command line, so
it sat in the docker CLI's argv, the container's php argv and docker's
exec record. Apply jwt_secret through config:import on occ's stdin
instead; the other three onlyoffice keys still go through
config:app:set.
2026-10-22 16:27:15 +02:00
jschoubben 2d8c8f6d75 Share one placement per repository and commit for pins on pull heads; say a pin is on no pull request head and what go said (issue 1148) 2026-10-22 16:24:18 +02:00
jschoubben 9194e15072 Fetch a Go pin on a pull request's head: place it beside the workspace and hand it to Go by a modfile replace (issue 1148) 2026-10-22 16:19:23 +02:00
mesh-tools 77578a882f Merge pull request 'Hold a delivery's problem messages until it settles, and say a refusal only when its fresh check did not cure it (ADR 0505)' (#444) from feat/quiet-deliveries into main 2026-10-22 14:01:19 +00:00
mesh-tools 3f9081d00e Merge pull request 'Let nginx through only-office's lib directory, so OnlyOffice serves converted documents instead of answering 403 (issue 1837)' (#443) from fix/1837-lib-traverse into main 2026-10-22 13:44:06 +00:00
mesh-tools 7842001c53 Merge pull request 'A tool verifies the bus's snapshot, so an upgrade or a restore is checked without a docker exec (issue 1842)' (#442) from fix/1842-bus-snapshot-verify into main 2026-10-22 13:08:47 +00:00
jschoubben 09e749bc1a Format the ADR 0505 test file, so the repository check passes
mesh/repo-check head 09e749bc1a1c merged into trunk 3f9081d00eb8 beside mesh-controller#436@b7d03b68 — pass: its merge-check.sh passed, each part in its to…
mesh/check failed: g14: novox/mesh-catalog#444: checks/particulars/go.mod cannot be read to check its mesh-sdk pin: Gitea API /repos/novox/mesh-catalo…
mesh/merge-gate head 09e749bc1a1c merged into trunk 3f9081d00eb8 — pass: group feat/quiet-deliveries composed: every machine composes with the change as it…
mesh/delivery delivered
mesh/delivery-group group feat/quiet-deliveries delivered: every member is delivered
2026-10-22 15:00:37 +02:00
jschoubben ea8692b08f Say a message two walks held once, in the message of the walk whose limit is due (ADR 0505 §7) 2026-10-22 14:39:35 +02:00
jschoubben 3cf75580b5 Never hold a message past its first hold's limit, so a fault on a machine walk after walk touches still reaches the operator (ADR 0505 §7) 2026-10-22 14:36:35 +02:00
jochen a22fdd015b Let nginx through only-office's lib directory, so it can serve the converted files the document service writes there instead of answering 403 (issue 1837)
mesh/check failed: unit: i3/cmd/i3-tools.TestTheMainFileAndEveryModulesContributionLoadTogether: manifest_test.go:247: expected the launcher, clipboar…
mesh/merge-gate head a22fdd015b09 merged into trunk 7842001c53f7 — pass: builds only-office → novox; no bus step; every machine composes with the change as…
mesh/repo-check head a22fdd015b09 merged into trunk 7842001c53f7 — pass: its merge-check.sh passed, each part in its toolchain: merge-check.sh (go), merge-…
mesh/delivery delivered
2026-10-22 14:32:06 +02:00
mesh-tools dcf6e86d02 Merge pull request 'Refuse a node name of the mesh in the pacman and kernel modules (issue 1838)' (#441) from fix/1838-particulars into main 2026-10-22 12:24:35 +00:00
jschoubben 98ca97fc5b Verify the bus's snapshot with a tool, sharing the snapshot program's archive code (issue 1842)
mesh/delivery delivered
mesh/check failed: ace: novox/mesh-catalog#442: checks/particulars/go.mod cannot be read to check its mesh-sdk pin: Gitea API /repos/novox/mesh-catalo…
mesh/merge-gate head 98ca97fc5b3f merged into trunk dcf6e86d0236 — pass: builds nats, sent nowhere; merging this needs a person's bus upgrade; 1 wait(s) fo…
mesh/repo-check head 98ca97fc5b3f merged into trunk dcf6e86d0236 — pass: its merge-check.sh passed, each part in its toolchain: merge-check.sh (go), merge-…
The upgrade and restore steps told a person to docker exec the snapshot program; no mesh tool
did it. nats_snapshot_verify reads the newest bus.tar of the snapshots directory only.
2026-10-22 14:24:25 +02:00
mesh-tools db67a0e55e Merge pull request 'Pin only-office's secure-link secret, so OnlyOffice's signed download links verify across restarts (issue 1837)' (#440) from fix/1837-secure-link into main 2026-10-22 12:20:22 +00:00
jschoubben 34277ef60f Prove over the real bus that a refusal the gate answers is stalled only once its fresh check did not cure it (ADR 0505 §4) 2026-10-22 14:18:33 +02:00
jschoubben e5608f7b00 Say in the gate's README when a refused or rejected merge reaches the operator (ADR 0505 §4, §5) 2026-10-22 14:17:40 +02:00
jschoubben 5a18eb5f4a Leave a delivery that needs a new head to its author for two hours, then name the author to the operator (ADR 0505 §5) 2026-10-22 14:17:25 +02:00
jschoubben 138a1e1c4b issue 1838: refuse a node name of this mesh in the pacman and kernel modules
A module is for any mesh; the check reads the list of names at the root and the covered modules, and the kernel module's fixtures now say what they show.
2026-10-22 14:15:53 +02:00
jschoubben f1fbd91f0d Say a refusal the gate is already answering as stalled only once its fresh check did not cure it (ADR 0505 §4) 2026-10-22 14:15:49 +02:00
jschoubben 5ddc3ff312 Measure a repository's last check time from its newest verdict (ADR 0505 §4) 2026-10-22 14:13:18 +02:00
jschoubben b5908b486e Give the gate a settings file for the bounds ADR 0505 sets on saying a refusal and a needed new head 2026-10-22 14:12:31 +02:00
jschoubben aa57bbcd44 Tell a settled walk's end at the next flush, and prove the hold and the delivery line over the real bus (ADR 0505 §1-§3) 2026-10-22 14:11:16 +02:00
jschoubben 67a585600d End every problem message with whether a delivery was running on what it is about (ADR 0505 §1) 2026-10-22 14:10:06 +02:00
jschoubben 1caf728a4b Send at once what is raised on a failed walk's machines in the two minutes after it (ADR 0505 §6) 2026-10-22 14:07:51 +02:00
jschoubben 02816c0f7a Hold what a delivered walk touched until it has settled, and tell its end then (ADR 0505 §3, §7) 2026-10-22 14:07:15 +02:00
mesh-tools 7bf63b0ac5 Merge pull request 'The bus runs its upstream image with the mesh's programs mounted (issues 1640, 1641, 1642, ADR 0480 §1-§3, §5, §6; ADR 0497 §5; ADR 0506)' (#434) from feat/r4d into main 2026-10-22 12:05:13 +00:00
jschoubben 426db57d3f Hold what a walk's merges change on a machine it sends nothing to, and name only where it sent (ADR 0505 §2) 2026-10-22 14:04:06 +02:00
jschoubben 1d995d2bef Hold the controller's own lease, bus and health conditions while its delivery runs (ADR 0505 §2) 2026-10-22 14:03:09 +02:00
jschoubben 92225cd528 Make the settle after a delivered walk a setting, two minutes by default (ADR 0505 §3) 2026-10-22 14:02:17 +02:00
jochen 35e4764d35 Pin only-office's secure-link secret, so its document service and nginx sign and check Editor.bin links with one value across restarts (issue 1837)
mesh/merge-gate head 35e4764d354a merged into trunk 7bf63b0ac597 — pass: builds only-office → novox; no bus step; every machine composes with the change as…
mesh/check failed: unit: modules/gitea.test: [gitea] where the poll of merges last looked from could not be read, so none is kept — no runtime | 35e47…
mesh/repo-check head 35e4764d354a merged into trunk 7bf63b0ac597 — pass: its merge-check.sh passed, each part in its toolchain: merge-check.sh (go), merge-…
mesh/delivery delivered
2026-10-22 13:40:42 +02:00
mesh-tools b7b9f2a3da Merge pull request 'Join nextcloud to only-office through a document-server provision, so OnlyOffice opens documents again (issue 1830)' (#438) from fix/1830-onlyoffice-link into main 2026-10-22 09:49:59 +00:00
jschoubben 68183ee441 Keep n8n on its own Dockerfile: since ADR 0487 a module may ship one, and the move to the upstream image only added a config value and a uuid mount (the operator, 2026-10-22)
mesh/delivery delivered
mesh/merge-gate head 68183ee4413d merged into trunk 7bf63b0ac597 — pass: group feat/r4d composed: every machine composes with the change as it did without …
mesh/delivery-group group feat/r4d delivered: every member is delivered
mesh/check failed: unit: clipmenu/cmd/clipmenu-tools.TestTheLauncherWaitsQuietlyWhileAnotherClipmenudHoldsTheLock: manifest_test.go:199: the launcher …
mesh/repo-check head 68183ee4413d merged into trunk b7b9f2a3da78 beside mesh-controller#433@707bfba4 — pass: THE CHANGE ALTERS ITS OWN CHECK (merge-check.s…
2026-10-22 11:47:44 +02:00
jschoubben cff5ed46b7 Check an image's Dockerfile place instead of refusing the image kind (ADR 0487 clause 13)
mesh/check failed: unit: modules/gitea.test: [gitea] where the poll of merges last looked from could not be read, so none is kept — no runtime | cff5e…
mesh/merge-gate waits for its group's composed check
mesh/repo-check head cff5ed46b794 merged into trunk 529c156f6407 beside mesh-controller#433@707bfba4 — pass: THE CHANGE ALTERS ITS OWN CHECK (merge-check.s…
mesh/delivery superseded: a newer head of the same pull request
mesh/delivery-group group feat/r4d checking: composed check out of date: novox/mesh-catalog@c948f3a61c74 was judged against trunk 848249cf54b6, the trunk is no…
2026-10-22 11:44:45 +02:00
jschoubben 7451e7edf4 Merge main into feat/r4d: keep the image check beside the image builder's two checks (ADR 0487 clause 13)
mesh/merge-gate waits for its group's composed check
mesh/repo-check head 7451e7edf4e5 merged into trunk 529c156f6407 beside mesh-controller#433@499ff5c2 — pass: THE CHANGE ALTERS ITS OWN CHECK (merge-check.s…
mesh/delivery superseded: a newer head of the same pull request
mesh/check failed: unit: modules/gitea.test: ✔ the same merge, head or close announced twice has the same id, and another has another (6.449977ms) | 7…
2026-10-22 11:41:14 +02:00
mesh-tools 529c156f64 Merge pull request 'Hold a config value for the pull request that introduces its key (issue 1826, ADR 0502)' (#437) from fix/1826-held-config into main 2026-10-22 09:38:31 +00:00
jochen 47df3a4d60 Merge remote-tracking branch 'origin/main' into fix/1830-onlyoffice-link
mesh/check failed: unit: modules/gitea.test: [gitea] where the poll of merges last looked from could not be read, so none is kept — no runtime | 47df3…
mesh/merge-gate head 47df3a4d607a merged into trunk 529c156f6407 — pass: builds nextcloud, only-office → novox; no bus step; every machine composes with th…
mesh/delivery delivered
mesh/repo-check head 47df3a4d607a merged into trunk 529c156f6407 — pass: its merge-check.sh passed, each part in its toolchain: merge-check.sh (go), merge-…
2026-10-22 11:30:58 +02:00
jochen 2d2e831659 Apply only-office's bound address and secret to onlyoffice settings every tick (issue 1830) 2026-10-22 11:30:26 +02:00
jochen d3ebaf72eb Require only-office's document server and carry its address and secret into nextcloud's config (issue 1830) 2026-10-22 11:27:49 +02:00
jochen 183b9680c1 Offer only-office's document server with its JWT as the shared credential (issue 1830) 2026-10-22 11:20:08 +02:00
jschoubben 332aa75afd mesh-config: read the pull request's commit from head_sha (issue 1826)
mesh/delivery delivered
mesh/merge-gate head 332aa75afd19 merged into trunk 74baa5378716 — pass: group fix/1826-held-config composed: every machine composes with the change as it …
mesh/delivery-group group fix/1826-held-config delivered: every member is delivered
mesh/check failed: g14: novox/mesh-catalog#437: checks/imagebuild/go.mod cannot be read to check its mesh-sdk pin: Gitea API /repos/novox/mesh-catalog…
mesh/repo-check head 332aa75afd19 merged into trunk 74baa5378716 beside mesh-controller#434@4357b368 — pass: its merge-check.sh passed, each part in its to…
2026-10-22 11:09:48 +02:00
jschoubben 9e2d1164f0 Give mesh-build-image the registry's address as the seat's reach, which the provisioner's client fills (issue 1703)
mesh/merge-gate head 9e2d1164f06e merged into trunk 5a6d082e8c55 — pass: builds mesh-build-image, sent nowhere; no bus step; every machine composes with th…
mesh/repo-check head 9e2d1164f06e merged into trunk 5a6d082e8c55 — pass: its merge-check.sh passed, each part in its toolchain: merge-check.sh (go), merge-…
mesh/delivery delivered
mesh/check failed: unit: modules/gitea.test: [gitea] where the poll of merges last looked from could not be read, so none is kept — no runtime | 9e2d1…
2026-10-22 11:07:50 +02:00
jschoubben 48b08c74ab mesh-config: apply a held value only at the merged head; a close the forge cannot confirm drops nothing (issue 1826) 2026-10-22 11:07:19 +02:00
jschoubben 260be1c3e6 mesh-delivery-gate: ask a pull request's check again when a config value is held or dropped for it (issue 1826)
mesh-config raises config-changed (hold, drop) naming the pull request; the delivery, or its group's
composed check, is asked again on the gate's own path, with why in the transition. Not the recheck verb.
2026-10-22 11:01:07 +02:00
jschoubben 224a7a66a5 mesh-config: hold a value for the open pull request that introduces its key (issue 1826)
A key a pull request adds is declared by no registered manifest, so its value was refused and the
group's composed check could not pass. A proposal may now name the pull request: judged against what
the controller told of its head, asked of the operator, kept apart on Approve, applied at the merge,
dropped at a close.
2026-10-22 10:58:28 +02:00
jschoubben 7b5f7f84ac List mesh-build-image among the issue tracker's owners
mesh/repo-check head 7b5f7f84acb7 merged into trunk 848249cf54b6 — pass: THE CHANGE ALTERS ITS OWN CHECK (merge-check.sh): main's version judged it; the ch…
mesh/check failed: unit: modules/gitea.test: ✔ the same merge, head or close announced twice has the same id, and another has another (6.882981ms) | 7…
mesh/merge-gate head 7b5f7f84acb7 merged into trunk 848249cf54b6 — pass: group feat/r4c9-image-build composed: every machine composes with the change as it…
mesh/delivery delivered
mesh/delivery-group group feat/r4c9-image-build delivered: every member is delivered
2026-10-22 10:51:40 +02:00
jschoubben 3508be1476 Merge origin/main into feat/r4c9-image-build 2026-10-22 10:51:24 +02:00