mssql: place its directories and name the software's port, not a machine's

The manifest stated /var/lib/mssql, its grants and its SA file by path, and declared it listens on 4848 - the port one machine's predecessor published, which is an assignment's fact (ADR 0112, 0138). ace is moving its own SQL Server (80 GB of work databases) onto the mesh, so the module has to be the same on every machine. - state is the assignment's root (place "."), grants is placed, and every reference (sa.env, the env-file, the SA and grants mounts, receives, grants, own-secrets) names them as ${dir:...}. - the database endpoint listens on 1433, the port SQL Server uses; a machine that must keep an older number pins it in its assignment. - the image pin is unchanged: it is the digest ace runs today (CU27, 16.0.4295), the same as novox. novox is untouched: rendered with novox's own setting ({"ports":{"1433":4848}}) through the controller's Declaration and Rules, every resource - paths, container names, volumes, env-file, the 4848:1433 mapping, owners, modes - is byte-identical to what main renders; the only difference is the firewall rule's comment text (still port 4848, from the mesh). Verified: catalogue tests pass with MESH_CATALOGUE on this tree. The pinned image ran as a throwaway on a 0700 10001:0 data dir with a root-owned 0600 env-file (dummy SA), answered sqlcmd as sa; a scratch database stopped, copied with cp -a, checksummed and started on the copy kept its rows and CHECKSUM_AGG.
2026-09-30 11:57:45 +02:00
2 changed files with 32 additions and 53 deletions
@@ -21,23 +21,23 @@
  "listens": [
    {
      "name": "database",
-      "port": 4848,
+      "port": 1433,
      "protocol": "tcp",
      "from": "mesh",
-      "why": "modules on any machine that were granted a database. 4848, not 1433: the machine this replaces has served it there since it was installed, and every consumer was handed that number"
+      "why": "modules on any machine that were granted a database, and the people who were given its address; the machine port is the assignment's to pin"
    }
  ],
  "serves": {
    "mssql-database": {}
  },
  "receives": {
-    "mssql-database": "/var/lib/mssql/grants/mesh.json"
+    "mssql-database": "${dir:grants}/mesh.json"
  },
  "grants": {
-    "mssql-database": "/var/lib/mssql/grants"
+    "mssql-database": "${dir:grants}"
  },
  "own-secrets": {
-    "sa": "/var/lib/mssql/sa.secret",
+    "sa": "${dir:state}/sa.secret",
    "broker": "/var/lib/mesh/mssql/broker"
  },
  "resources": [
@@ -50,19 +50,18 @@
    {
      "id": "state",
      "type": "directory",
-      "path": "/var/lib/mssql",
-      "mode": "0700"
+      "mode": "0700",
+      "place": "."
    },
    {
      "id": "grants",
      "type": "directory",
-      "path": "/var/lib/mssql/grants",
      "mode": "0700"
    },
    {
      "id": "sa-env",
      "type": "file",
-      "path": "/var/lib/mssql/sa.env",
+      "path": "${dir:state}/sa.env",
      "mode": "0600",
      "content": "ACCEPT_EULA=Y\nMSSQL_SA_PASSWORD=${secret:sa}\n"
    },
@@ -84,7 +83,7 @@
      "image": "mcr.microsoft.com/mssql/server@sha256:4402d880dd4c34bfa7d8705e56a86cd6c88da80a1f6bbbe741f999e76264a090",
      "network": "mssql",
      "env-file": [
-        "/var/lib/mssql/sa.env"
+        "${dir:state}/sa.env"
      ],
      "ports": [
        "1433"
@@ -101,8 +100,8 @@
      "network": "mssql",
      "volumes": [
        "/var/lib/mesh/mssql/broker:/run/secrets/broker:ro",
-        "/var/lib/mssql/grants:/var/lib/mssql/grants:ro",
-        "/var/lib/mssql/sa.secret:/run/secrets/sa:ro"
+        "${dir:grants}:/var/lib/mssql/grants:ro",
+        "${dir:state}/sa.secret:/run/secrets/sa:ro"
      ],
      "env": {
        "MESH_PROVISION_MSSQL": "mssql://sa@mssql:1433/master",
@@ -10,35 +10,35 @@
      "port": 8443,
      "protocol": "tcp",
      "from": "mesh",
-      "why": "the controller web UI and API, over its own self-signed tls; named through the proxy as an https route"
+      "why": "the controller web UI, over its own self-signed tls; reaching it from outside is a route grant later"
    },
    {
      "name": "inform",
      "port": 8080,
      "protocol": "tcp",
      "from": "mesh",
-      "why": "device inform, how APs and switches check in and are adopted; the controller tells devices this number, so the machine must publish it on the same one"
+      "why": "device inform \u2014 how APs and switches check in and are adopted"
    },
    {
      "name": "stun",
      "port": 3478,
      "protocol": "udp",
      "from": "mesh",
-      "why": "STUN for managed devices; the controller tells devices this number, so the machine must publish it on the same one"
+      "why": "STUN, so managed devices can find the controller through NAT"
    },
    {
      "name": "discovery",
      "port": 10001,
      "protocol": "udp",
      "from": "mesh",
-      "why": "device discovery broadcasts from unadopted devices and the UniFi apps"
+      "why": "device discovery \u2014 the controller finds unadopted devices on the network"
    },
    {
      "name": "discovery-l2",
-      "port": 1900,
+      "port": 1902,
      "protocol": "udp",
      "from": "mesh",
-      "why": "make-controller-discoverable-on-L2 (SSDP); the software listens on 1900, which machines commonly have taken by another SSDP speaker"
+      "why": "layer-2 (UBNT) discovery broadcasts; published on 1902, the container listens on 1900"
    },
    {
      "name": "portal-tls",
@@ -76,15 +76,10 @@
      "path": "/var/lib/mesh/unifi",
      "mode": "0700"
    },
-    {
-      "id": "state",
-      "type": "directory",
-      "mode": "0700",
-      "place": "."
-    },
    {
      "id": "data",
      "type": "directory",
+      "path": "/services/unifi/data",
      "mode": "0700",
      "owner": "1000:1000"
    },
@@ -92,17 +87,17 @@
      "id": "server",
      "type": "container",
      "name": "unifi-controller",
-      "image": "lscr.io/linuxserver/unifi-controller@sha256:0ae315a3a45635e443899e30e86bd507c2c48922cb27f4bc7241777885f4650e",
+      "image": "lscr.io/linuxserver/unifi-controller@sha256:fcd5d8b13a77a588c79c1b49e5fc9ad08115aa3bb1a3576c589c64908a68845f",
      "ports": [
-        "8443",
-        "8080",
-        "3478/udp",
-        "10001/udp",
-        "1900/udp",
-        "8843",
-        "8880",
-        "6789",
-        "5514/udp"
+        "8443:8443",
+        "8080:8080",
+        "3478:3478/udp",
+        "10001:10001/udp",
+        "1902:1900/udp",
+        "8843:8843",
+        "8880:8880",
+        "6789:6789",
+        "5514:5514/udp"
      ],
      "env": {
        "PUID": "1000",
@@ -112,7 +107,7 @@
        "MEM_STARTUP": "1024"
      },
      "volumes": [
-        "${dir:data}:/config"
+        "/services/unifi/data:/config"
      ]
    },
    {
@@ -120,7 +115,7 @@
      "type": "file",
      "path": "/var/lib/mesh/unifi/config.json",
      "mode": "0600",
-      "content": "{\n  \"site\": \"default\",\n  \"password\": \"${secret:controller}\"\n}\n",
+      "content": "{}\n",
      "merge": "json"
    },
    {
@@ -134,7 +129,7 @@
      ],
      "env": {
        "MESH_BROKER_FILE": "/run/secrets/broker",
-        "MESH_UNIFI_URL": "https://127.0.0.1:${port:8443}",
+        "MESH_UNIFI_URL": "https://127.0.0.1:8443",
        "MESH_UNIFI_CONFIG_FILE": "/run/config/config.json"
      },
      "restart-on": [
@@ -143,23 +138,8 @@
      "artifact": "runtime"
    }
  ],
-  "requires": [
-    "route"
-  ],
-  "contributes": {
-    "route": {
-      "label": "unifi",
-      "endpoint": "web",
-      "scheme": "https",
-      "insecure": true
-    }
-  },
-  "binds": {
-    "route": "${dir:state}/route.json"
-  },
  "own-secrets": {
-    "broker": "/var/lib/mesh/unifi/broker",
-    "controller": "/var/lib/mesh/unifi/controller"
+    "broker": "/var/lib/mesh/unifi/broker"
  },
  "build": {
    "on": [