nodered: the sidecar dials the port it was given

The sidecar runs on the host network and dialled 127.0.0.1:1880, the
software's port; the mesh publishes nodered on a machine port it assigns,
so the tools reached whatever else holds 1880, or nothing (hq 088).

modules/influxdb/client.ts

@@ -24,13 +24,6 @@ function meshConfig(file?: string): Record<string, string> {
   catch { return {}; }
 }
 
-/** A secret delivered as a file, trimmed; undefined when there is none, so the caller can fall back. */
-function tokenFromFile(file?: string): string | undefined {
-  if (!file) return undefined;
-  try { return readFileSync(file, "utf8").trim() || undefined; }
-  catch { return undefined; }
-}
-
 export class InfluxDBClient {
   readonly baseUrl: string;
 
@@ -50,10 +43,8 @@ export class InfluxDBClient {
   static fromEnv(env: NodeJS.ProcessEnv = process.env): InfluxDBClient {
     const cfg = meshConfig(env.MESH_INFLUXDB_CONFIG_FILE);
     const url = cfg.url ?? env.MESH_INFLUXDB_URL ?? `http://127.0.0.1:${env.INFLUXDB_PORT ?? "8086"}`;
-    // The token reaches the process as a file (novox/hq ADR 0086); the environment variable stays
-    // only for a workstation running the tools by hand.
-    const token = cfg.token ?? tokenFromFile(env.MESH_INFLUXDB_TOKEN_FILE) ?? env.MESH_INFLUXDB_TOKEN;
-    if (!token) throw new Error("no InfluxDB token — set MESH_INFLUXDB_TOKEN_FILE");
+    const token = cfg.token ?? env.MESH_INFLUXDB_TOKEN;
+    if (!token) throw new Error("no InfluxDB token — set MESH_INFLUXDB_TOKEN");
     const org = cfg.org ?? env.MESH_INFLUXDB_ORG ?? "mesh";
     return new InfluxDBClient(url, token, org);
   }

modules/influxdb/module.json

@@ -13,7 +13,7 @@
       "port": 8086,
       "protocol": "tcp",
       "from": "mesh",
-      "why": "queries, writes and the web UI, over http; a name is a route grant"
+      "why": "queries and writes, over http"
     }
   ],
   "resources": [
@@ -26,45 +26,46 @@
     {
       "id": "state",
       "type": "directory",
-      "mode": "0700",
-      "place": "."
+      "path": "/var/lib/influxdb-module",
+      "mode": "0700"
+    },
+    {
+      "id": "server-env",
+      "type": "file",
+      "path": "/var/lib/influxdb-module/server.env",
+      "mode": "0600",
+      "content": "DOCKER_INFLUXDB_INIT_MODE=setup\nDOCKER_INFLUXDB_INIT_USERNAME=admin\nDOCKER_INFLUXDB_INIT_PASSWORD=${secret:admin}\nDOCKER_INFLUXDB_INIT_ADMIN_TOKEN=${secret:admin-token}\nDOCKER_INFLUXDB_INIT_ORG=mesh\nDOCKER_INFLUXDB_INIT_BUCKET=default\n"
     },
     {
       "id": "data",
       "type": "directory",
+      "path": "/services/influxdb/data",
       "mode": "0700",
       "owner": "1000:1000"
     },
     {
       "id": "config",
       "type": "directory",
+      "path": "/services/influxdb/config",
       "mode": "0700",
       "owner": "1000:1000"
     },
-    {
-      "id": "server-env",
-      "type": "file",
-      "path": "${dir:state}/server.env",
-      "mode": "0600",
-      "content": "DOCKER_INFLUXDB_INIT_MODE=setup\nDOCKER_INFLUXDB_INIT_USERNAME=admin\nDOCKER_INFLUXDB_INIT_PASSWORD_FILE=/run/secrets/admin\nDOCKER_INFLUXDB_INIT_ADMIN_TOKEN_FILE=/run/secrets/admin-token\nDOCKER_INFLUXDB_INIT_ORG=mesh\nDOCKER_INFLUXDB_INIT_BUCKET=default\n"
-    },
     {
       "id": "server",
       "type": "container",
       "name": "influxdb",
       "image": "influxdb@sha256:f75e48af0598e8aec7986e991a848d19a119101a7d563a2e5db1dfaac9c45daa",
       "env-file": [
-        "${dir:state}/server.env"
+        "/var/lib/influxdb-module/server.env"
       ],
       "ports": [
         "8086"
       ],
       "volumes": [
-        "${dir:data}:/var/lib/influxdb2",
-        "${dir:config}:/etc/influxdb2",
-        "${dir:state}/admin.secret:/run/secrets/admin:ro",
-        "${dir:state}/admin-token.secret:/run/secrets/admin-token:ro"
-      ]
+        "/services/influxdb/data:/var/lib/influxdb2",
+        "/services/influxdb/config:/etc/influxdb2"
+      ],
+      "secrets-in-environment": "the image honours DOCKER_INFLUXDB_INIT_PASSWORD_FILE and _ADMIN_TOKEN_FILE; convertible, awaiting a bed that proves it"
     },
     {
       "id": "runtime-config",
@@ -82,13 +83,13 @@
       "volumes": [
         "/var/lib/mesh/influxdb/broker:/run/secrets/broker:ro",
         "/var/lib/mesh/influxdb/config.json:/run/config/config.json:ro",
-        "${dir:state}/admin-token.secret:/run/secrets/admin-token:ro"
+        "/services/influxdb/config:/var/lib/influxdb/config:ro"
       ],
       "env": {
         "MESH_BROKER_FILE": "/run/secrets/broker",
-        "MESH_INFLUXDB_URL": "http://127.0.0.1:${port:8086}",
+        "MESH_INFLUXDB_URL": "http://127.0.0.1:8086",
         "MESH_INFLUXDB_CONFIG_FILE": "/run/config/config.json",
-        "MESH_INFLUXDB_TOKEN_FILE": "/run/secrets/admin-token"
+        "MESH_INFLUXDB_CONFIG_DIR": "/var/lib/influxdb/config"
       },
       "restart-on": [
         "runtime-config"
@@ -96,22 +97,6 @@
       "artifact": "runtime"
     }
   ],
-  "requires": [
-    "route",
-    "secret"
-  ],
-  "contributes": {
-    "route": {
-      "label": "influxdb",
-      "endpoint": "api"
-    }
-  },
-  "secrets": {
-    "secret": {
-      "admin": "${dir:state}/admin.secret",
-      "admin-token": "${dir:state}/admin-token.secret"
-    }
-  },
   "build": {
     "on": [
       {
@@ -132,5 +117,14 @@
         "from": "Dockerfile"
       }
     ]
+  },
+  "requires": [
+    "secret"
+  ],
+  "secrets": {
+    "secret": {
+      "admin": "/var/lib/influxdb-module/admin.secret",
+      "admin-token": "/var/lib/influxdb-module/admin-token.secret"
+    }
   }
 }

modules/nodered/client.ts

@@ -3,7 +3,8 @@
 //
 // Node-RED exposes a runtime admin API under its base URL: GET/POST /flows for the whole flow
 // configuration, GET /nodes for installed node modules. A default install has no auth; when
-// adminAuth is on, a bearer token (minted at /auth/token) is required.
+// adminAuth is on, a bearer token is required — the module's settings accept the mesh-minted
+// api-token, which the runtime config file carries as `token`.
 
 import { readFileSync } from "node:fs";
 
@@ -88,8 +89,13 @@ export class NodeRedClient {
   async deployFlows(config: any[], type = "full"): Promise<{ rev?: string; nodeCount: number }> {
     const body = await this.req("/flows", {
       method: "POST",
-      headers: this.headers({ "Content-Type": "application/json", "Node-RED-Deployment-Type": type }),
-      body: JSON.stringify(config),
+      // v2 answers { rev }; v1 answers 204 with no body, which req() cannot parse.
+      headers: this.headers({
+        "Content-Type": "application/json",
+        "Node-RED-API-Version": "v2",
+        "Node-RED-Deployment-Type": type,
+      }),
+      body: JSON.stringify({ flows: config }),
     });
     return { rev: body?.rev, nodeCount: config.length };
   }

modules/nodered/module.json

@@ -5,6 +5,8 @@
     "flows.deployed"
   ],
   "own-secrets": {
+    "admin": "/var/lib/mesh/nodered/admin",
+    "api-token": "/var/lib/mesh/nodered/api-token",
     "broker": "/var/lib/mesh/nodered/broker"
   },
   "capabilities": [
@@ -26,26 +28,58 @@
       "path": "/var/lib/mesh/nodered",
       "mode": "0700"
     },
+    {
+      "id": "state",
+      "type": "directory",
+      "mode": "0700",
+      "place": "."
+    },
     {
       "id": "data",
       "type": "directory",
-      "path": "/services/nodered/data",
       "mode": "0700",
       "owner": "1000:1000"
     },
+    {
+      "id": "settings-code",
+      "type": "file",
+      "path": "${dir:state}/settings.js",
+      "mode": "0600",
+      "owner": "1000:1000",
+      "content": "// Node-RED's settings, written by the mesh from the nodered module. What an assignment may change\n// is settings.json beside this file (merged key by key); the credentials are the mesh's secrets and\n// reach Node-RED only through this file. The flows' own credentials stay encrypted in the user\n// directory under the key Node-RED keeps there (.config.runtime.json), which is data, not this.\nconst fs = require(\"fs\");\nconst path = require(\"path\");\nconst crypto = require(\"crypto\");\n\nconst ADMIN_PASSWORD = \"${secret:admin}\";\nconst API_TOKEN = \"${secret:api-token}\";\nconst ADMIN = { username: \"admin\", permissions: \"*\" };\n\nconst settings = JSON.parse(fs.readFileSync(path.join(__dirname, \"settings.json\"), \"utf8\"));\n// The mesh's keys, not Node-RED's: endpoints lands in every merged file; timeZone is the\n// assignment's way to set the zone flows schedule and format in.\nif (settings.timeZone) process.env.TZ = settings.timeZone;\ndelete settings.timeZone;\ndelete settings.endpoints;\n\nfunction same(a, b) {\n  const x = crypto.createHash(\"sha256\").update(String(a)).digest();\n  const y = crypto.createHash(\"sha256\").update(String(b)).digest();\n  return crypto.timingSafeEqual(x, y);\n}\n\n// The admin secret is a password, or, accepted from an existing install, the bcrypt hash its\n// settings held, so the password people already use keeps working.\nfunction passwordMatches(given) {\n  if (/^\\$2[aby]\\$\\d\\d\\$/.test(ADMIN_PASSWORD)) return require(\"bcryptjs\").compare(String(given), ADMIN_PASSWORD);\n  return Promise.resolve(same(given, ADMIN_PASSWORD));\n}\n\nmodule.exports = Object.assign(settings, {\n  uiPort: 1880,\n  adminAuth: {\n    type: \"credentials\",\n    users: (username) => Promise.resolve(username === ADMIN.username ? ADMIN : null),\n    authenticate: (username, password) =>\n      username === ADMIN.username\n        ? passwordMatches(password).then((ok) => (ok ? ADMIN : null))\n        : Promise.resolve(null),\n    // The module's own tools call the admin API with this bearer token.\n    tokens: (token) => Promise.resolve(same(token, API_TOKEN) ? { username: \"mesh\", permissions: \"*\" } : null),\n  },\n});\n"
+    },
+    {
+      "id": "settings",
+      "type": "file",
+      "path": "${dir:state}/settings.json",
+      "mode": "0600",
+      "owner": "1000:1000",
+      "merge": "json",
+      "content": "{\n  \"flowFile\": \"flows.json\",\n  \"flowFilePretty\": true,\n  \"diagnostics\": { \"enabled\": true, \"ui\": true },\n  \"runtimeState\": { \"enabled\": false, \"ui\": false },\n  \"logging\": { \"console\": { \"level\": \"info\", \"metrics\": false, \"audit\": false } },\n  \"exportGlobalContextKeys\": false,\n  \"externalModules\": {},\n  \"editorTheme\": { \"projects\": { \"enabled\": false } },\n  \"functionExternalModules\": true,\n  \"debugMaxLength\": 1000,\n  \"mqttReconnectTime\": 15000,\n  \"serialReconnectTime\": 15000\n}\n"
+    },
     {
       "id": "server",
       "type": "container",
       "name": "nodered",
-      "image": "nodered/node-red@sha256:02a2b92a41b73d2bc388238b86e4fcaab7fb5466373adb24e1df6aa5845265ff",
+      "image": "nodered/node-red@sha256:a649dd711d55490151a2c39a8e48ad0c44325488fbc0e66315f2d2e19e5e1ace",
       "env": {
         "TZ": "Etc/UTC"
       },
       "ports": [
         "1880"
       ],
+      "args": [
+        "--settings",
+        "/config/settings.js"
+      ],
       "volumes": [
-        "/services/nodered/data:/data"
+        "${dir:data}:/data",
+        "${dir:state}/settings.js:/config/settings.js:ro",
+        "${dir:state}/settings.json:/config/settings.json:ro"
+      ],
+      "restart-on": [
+        "settings-code",
+        "settings"
       ]
     },
     {
@@ -53,8 +87,7 @@
       "type": "file",
       "path": "/var/lib/mesh/nodered/config.json",
       "mode": "0600",
-      "content": "{}\n",
-      "merge": "json"
+      "content": "{\n  \"token\": \"${secret:api-token}\"\n}\n"
     },
     {
       "id": "runtime",
@@ -67,7 +100,7 @@
       ],
       "env": {
         "MESH_BROKER_FILE": "/run/secrets/broker",
-        "MESH_NODERED_URL": "http://127.0.0.1:1880",
+        "MESH_NODERED_URL": "http://127.0.0.1:${port:1880}",
         "MESH_NODERED_CONFIG_FILE": "/run/config/config.json"
       },
       "restart-on": [
@@ -86,7 +119,7 @@
     }
   },
   "binds": {
-    "route": "/var/lib/mesh/nodered/route.json"
+    "route": "${dir:state}/route.json"
   },
   "build": {
     "on": [