grafana: its InfluxDB data source comes from the influxdb-api provision

ace's grafana reads InfluxDB through a data source somebody typed into its database: a LAN address, a database InfluxDB 2 does not have, and a password for a v1 user of an earlier instance. Nothing in the mesh knew it existed, so migrating influxdb could only break it further. grafana now requires influxdb-api, contributes read access, and the mesh renders a provisioning file grafana reads at start: the address, port, org's default bucket (as the InfluxQL database) and its own login from the binding, the password by $__file from the pair credential the mesh delivers, 0400 for grafana's uid 472. It is a data source of its own name and uid, read-only in the UI and not the default, so the data source a person made is never overwritten; a changed binding or a rotated password restarts grafana, which re-reads the file. Includes #152 (merged into this branch): influxdb provides influxdb-api.
Merge feat/influxdb-for-ace (#152 ) into feat/oidc-client-provision
2026-09-30 13:02:11 +02:00 · 2026-09-30 12:55:43 +02:00 · 2026-09-30 12:55:38 +02:00 · 2026-09-30 00:49:08 +02:00 · 2026-09-30 00:39:16 +02:00 · 2026-09-30 00:39:16 +02:00
91 changed files with 1788 additions and 1141 deletions
@@ -1,56 +0,0 @@
 {
  "module": "amqp-email-forwarder",
  "version": "1",
  "slug": "emailfwd",
  "capabilities": [
    "container-runtime"
  ],
  "requires": [
    "amqp"
  ],
  "contributes": {},
  "binds": {
    "amqp": "/var/lib/amqp-email-forwarder/amqp.json"
  },
  "secrets": {
    "amqp": "/var/lib/amqp-email-forwarder/amqp.secret"
  },
  "own-secrets": {
    "smtp-user": "/var/lib/amqp-email-forwarder/smtp-user.secret",
    "smtp-password": "/var/lib/amqp-email-forwarder/smtp-password.secret"
  },
  "resources": [
    {
      "id": "state",
      "type": "directory",
      "path": "/var/lib/amqp-email-forwarder",
      "mode": "0700"
    },
    {
      "id": "app-env",
      "type": "file",
      "path": "/var/lib/amqp-email-forwarder/app.env",
      "mode": "0600",
      "content": "AMQP_HOST=${bound:amqp:at}\nAMQP_PORT=${bound:amqp:port}\nAMQP_USER=${bound:amqp:as}\nAMQP_VHOST=EMAILDELIVERY_T\nAMQP_EXCHANGE=News.TransactionalEmailing.Command\nAMQP_QUEUE=email-forwarder\nAMQP_URL=amqp://${bound:amqp:as}:${secret:amqp}@${bound:amqp:at}:${bound:amqp:port}/EMAILDELIVERY_T\nSMTP_HOST=mail.novox.be\nSMTP_PORT=587\nSMTP_USER=${secret:smtp-user}\nSMTP_PASSWORD=${secret:smtp-password}\n"
    },
    {
      "id": "net",
      "type": "network",
      "name": "amqp-email-forwarder"
    },
    {
      "id": "app",
      "type": "container",
      "name": "amqp-email-forwarder",
      "image": "registry-api.novox.be/novox/amqp-email-forwarder@sha256:f76d34646d9d3b2098c72688a63f6ae656f1888ffcb2f90a9c8dd2a44ad7f8af",
      "network": "amqp-email-forwarder",
      "env-file": [
        "/var/lib/amqp-email-forwarder/app.env"
      ],
      "restart-on": [
        "app-env"
      ],
      "secrets-in-environment": "the application's own code reads AMQP_URL, SMTP_USER and SMTP_PASSWORD from the environment (amqp-email-forwarder app.js); converting is that repository's change"
    }
  ]
 }
@@ -1,31 +0,0 @@
 # amqp-ping's runtime: the tool runtime, carrying this module's compiled code.
 #
 # **Built from this module's own directory and nothing else.** The sdk and the tool runtime are not
 # copied out of neighbouring checkouts — they are in the base image, which is published like any
 # other artifact. That is what makes this buildable by the mesh from a repository and a path
 # (novox/hq ADR 0069) rather than only on a workstation that happens to have the siblings.
 #
 # Two bases, named rather than pinned: the image this is COMPILED in, and the image it RUNS in.
 # They are different images on purpose — the first carries a compiler and the second must not, or
 # every running container would carry one it never invokes. The mesh answers both with the copies it
 # holds, because a fingerprint written here would name one particular copy and no other mesh has it
 # (novox/hq issue 044). Declared in module.json's `build.on`; deliberately no defaults, so a build
 # nobody told stops here and says which module to build first.
 ARG BUILD_BASE
 ARG RUNTIME_BASE
 FROM ${BUILD_BASE} AS build
 # Compiled under /app/modules, so resolving `@novox/mesh-sdk` walks up to the base's own
 # node_modules — the module is compiled against exactly the sdk it will run against.
 WORKDIR /app/modules/amqp-ping
 COPY . .
 # The compiler is invoked by its real path, not through node_modules/.bin. Those are symlinks to
 # a launcher that requires its library relatively, and the base image resolves them when copying —
 # leaving a launcher whose relative require no longer points at anything.
 RUN node /app/node_modules/typescript/bin/tsc client.ts index.ts \
      --module NodeNext --moduleResolution NodeNext --target ES2022 --outDir dist
 FROM ${RUNTIME_BASE}
 COPY --from=build /app/modules/amqp-ping/dist /app/modules/amqp-ping/dist
 # Declared rather than derived from which files happen to exist: the module knows what it serves.
 ENV MESH_TOOL_MODULES=/app/modules/amqp-ping/dist/index.js
@@ -1,191 +0,0 @@
 // amqp-ping's AMQP client — the demo consumer's own code (novox/hq ADR 0039). It speaks AMQP 0-9-1
 // directly over a raw TCP socket (node:net), the way redis's client speaks RESP: the module carries
 // NO npm dependency beyond @novox/mesh-sdk — no amqplib, no CLI in the image. It does exactly one
 // thing, the round-trip that proves the grant works: connect, authenticate with PLAIN to the vhost
 // the mesh named, declare a queue, publish one message and get it back.
 //
 // This is the consumer half of the `amqp` interface. It connects as the login the mesh derived
 // (`${bound:amqp:as}`) with the password the mesh minted (`${secret:amqp}`) to a vhost of that SAME
 // name — the provider named the vhost after the login, so the consumer must too. Nothing here is
 // hardcoded: user AND vhost are both the bound login, and a wrong vhost is refused by the broker.
 import { createConnection, type Socket } from "node:net";
 import { readFileSync } from "node:fs";
 const FRAME_END = 0xce;
 const PROTOCOL_HEADER = Buffer.from([0x41, 0x4d, 0x51, 0x50, 0x00, 0x00, 0x09, 0x01]); // "AMQP" 0-9-1
 export interface AmqpConn {
  readonly host: string;
  readonly port: number;
  readonly user: string;
  readonly password: string;
  readonly vhost: string;
 }
 /** Build the connection facts from the environment the mesh's env-file set (see the module manifest). */
 export function connFromEnv(env: NodeJS.ProcessEnv = process.env): AmqpConn {
  const host = env.MESH_AMQP_HOST ?? "";
  const port = Number(env.MESH_AMQP_PORT ?? "5672") || 5672;
  const user = env.MESH_AMQP_USER ?? "";
  const vhost = env.MESH_AMQP_VHOST ?? user; // the provider names the vhost after the login
  const password = env.MESH_AMQP_PASSWORD ?? readMaybe(env.MESH_AMQP_PASSWORD_FILE);
  if (!host || !user || !password) {
    throw new Error(`amqp-ping: connection is not fully set yet (host=${host} user=${user} password=${password ? "set" : "unset"})`);
  }
  return { host, port, user, password, vhost };
 }
 // --- wire helpers ---------------------------------------------------------------------------------
 function shortstr(s: string): Buffer {
  const b = Buffer.from(s, "utf8");
  const o = Buffer.alloc(1 + b.length);
  o.writeUInt8(b.length, 0);
  b.copy(o, 1);
  return o;
 }
 function longstr(s: Buffer | string): Buffer {
  const b = Buffer.isBuffer(s) ? s : Buffer.from(s, "utf8");
  const o = Buffer.alloc(4 + b.length);
  o.writeUInt32BE(b.length, 0);
  b.copy(o, 4);
  return o;
 }
 function u16(n: number): Buffer {
  const o = Buffer.alloc(2);
  o.writeUInt16BE(n, 0);
  return o;
 }
 function u32(n: number): Buffer {
  const o = Buffer.alloc(4);
  o.writeUInt32BE(n, 0);
  return o;
 }
 function frame(type: number, channel: number, payload: Buffer): Buffer {
  const o = Buffer.alloc(7 + payload.length + 1);
  o.writeUInt8(type, 0);
  o.writeUInt16BE(channel, 1);
  o.writeUInt32BE(payload.length, 3);
  payload.copy(o, 7);
  o.writeUInt8(FRAME_END, 7 + payload.length);
  return o;
 }
 function method(channel: number, classId: number, methodId: number, ...parts: Buffer[]): Buffer {
  return frame(1, channel, Buffer.concat([u16(classId), u16(methodId), ...parts]));
 }
 interface MethodWaiter {
  classId: number;
  methodId: number;
  resolve: (args: Buffer) => void;
  reject: (e: Error) => void;
 }
 /**
 * Connect, authenticate to the vhost, declare a queue, publish one message and get it back. Returns
 * the body that came back — the caller checks it equals what went out. Throws on any protocol error,
 * including the broker's `NOT_ALLOWED` refusal of a vhost the login has no permission on (the
 * isolation the provider builds, seen from the consumer's side).
 */
 export function roundTrip(conn: AmqpConn, queue = "amqp-ping", payload?: string): Promise<string> {
  const body = Buffer.from(payload ?? `ping-${Date.now()}`);
  return new Promise<string>((resolve, reject) => {
    const sock: Socket = createConnection({ host: conn.host, port: conn.port });
    let buf = Buffer.alloc(0);
    const waiters: MethodWaiter[] = [];
    let lastBody: Buffer | null = null;
    let done = false;
    const fail = (e: Error): void => {
      if (done) return;
      done = true;
      sock.destroy();
      reject(e);
    };
    const expect = (classId: number, methodId: number): Promise<Buffer> =>
      new Promise((res, rej) => waiters.push({ classId, methodId, resolve: res, reject: rej }));
    sock.on("error", (e) => fail(e));
    sock.on("close", () => fail(new Error("amqp connection closed before the round-trip completed")));
    sock.on("data", (chunk: Buffer) => {
      buf = Buffer.concat([buf, chunk]);
      for (;;) {
        if (buf.length < 7) return;
        const type = buf.readUInt8(0);
        const size = buf.readUInt32BE(3);
        if (buf.length < 7 + size + 1) return;
        const framePayload = buf.subarray(7, 7 + size);
        buf = buf.subarray(7 + size + 1);
        if (type === 1) {
          const classId = framePayload.readUInt16BE(0);
          const methodId = framePayload.readUInt16BE(2);
          const args = framePayload.subarray(4);
          const w = waiters.shift();
          if (!w) continue;
          if (w.classId === classId && w.methodId === methodId) w.resolve(args);
          else w.reject(new Error(`expected method ${w.classId}/${w.methodId}, got ${classId}/${methodId}: ${args.toString("utf8")}`));
        } else if (type === 3) {
          lastBody = framePayload; // a content body frame
        }
        // type 2 (content header) and type 8 (heartbeat) need no handling for this round-trip.
      }
    });
    sock.on("connect", () => {
      void (async () => {
        try {
          sock.write(PROTOCOL_HEADER);
          await expect(10, 10); // Connection.Start
          const response = Buffer.concat([
            Buffer.from([0]), Buffer.from(conn.user, "utf8"), Buffer.from([0]), Buffer.from(conn.password, "utf8"),
          ]);
          // Connection.Start-Ok: empty client-properties table, PLAIN, the SASL response, locale.
          sock.write(method(0, 10, 11, u32(0), shortstr("PLAIN"), longstr(response), shortstr("en_US")));
          const tune = await expect(10, 30); // Connection.Tune
          const frameMax = tune.readUInt32BE(2) || 131072;
          sock.write(method(0, 10, 31, u16(tune.readUInt16BE(0)), u32(frameMax), u16(0))); // Tune-Ok, no heartbeat
          sock.write(method(0, 10, 40, shortstr(conn.vhost), shortstr(""), Buffer.from([0]))); // Connection.Open
          await expect(10, 41); // Open-Ok — authenticated and into the vhost
          sock.write(method(1, 20, 10, shortstr(""))); // Channel.Open
          await expect(20, 11);
          // Queue.Declare: reserved, queue, bits(auto-delete=1), empty arguments table.
          sock.write(method(1, 50, 10, u16(0), shortstr(queue), Buffer.from([0b00001000]), u32(0)));
          await expect(50, 11);
          // Basic.Publish to the default exchange, routing-key = queue; then content header + body.
          sock.write(method(1, 60, 40, u16(0), shortstr(""), shortstr(queue), Buffer.from([0])));
          const bodySize = Buffer.alloc(8);
          bodySize.writeBigUInt64BE(BigInt(body.length), 0);
          sock.write(frame(2, 1, Buffer.concat([u16(60), u16(0), bodySize, u16(0)]))); // content header, no properties
          sock.write(frame(3, 1, body)); // content body
          await new Promise((r) => setTimeout(r, 200));
          lastBody = null;
          sock.write(method(1, 60, 70, u16(0), shortstr(queue), Buffer.from([1]))); // Basic.Get, no-ack
          await expect(60, 71); // Get-Ok (a Get-Empty would arrive as 60/72 and reject the expect)
          await new Promise((r) => setTimeout(r, 200));
          const received = lastBody ? (lastBody as Buffer).toString("utf8") : "";
          sock.write(method(0, 10, 50, u16(200), shortstr("bye"), u16(0), u16(0))); // Connection.Close
          await expect(10, 51).catch(() => undefined);
          done = true;
          sock.end();
          resolve(received);
        } catch (e) {
          fail(e instanceof Error ? e : new Error(String(e)));
        }
      })();
    });
  });
 }
 function readMaybe(path: string | undefined): string {
  if (!path) return "";
  try {
    return readFileSync(path, "utf8").replace(/\n$/, "");
  } catch {
    return "";
  }
 }
@@ -1,53 +0,0 @@
 // amqp-ping — a tiny demo consumer of the mesh `amqp` interface, run as a long-lived container by
 // `mesh-tools run` (it never returns, so the container stays up). It exists to PROVE the grant end to
 // end: the mesh gave it a scoped login and a vhost of that name on the lavinmq provider, and this
 // connects with exactly those and round-trips a message.
 //
 // The connection facts arrive the way every consumer's do — the mesh writes them into an env-file the
 // container reads (novox/hq ADR 0048): MESH_AMQP_HOST/PORT from the binding, MESH_AMQP_USER and
 // MESH_AMQP_VHOST both from `${bound:amqp:as}` (the provider named the vhost after the login, so the
 // consumer uses the login for both — the db-name lesson applied to AMQP), and MESH_AMQP_PASSWORD from
 // `${secret:amqp}`.
 //
 // It retries: on first boot the provider may not have provisioned this consumer yet (the reconcile is
 // asynchronous and cross-container), so a refused or unreachable connection is a "not yet", not a
 // failure — it waits and tries again until the round-trip succeeds, then holds the connection idle
 // and re-pings on a slow cadence so the container is a stable, running proof.
 import { connFromEnv, roundTrip } from "./client.js";
 async function sleep(ms: number): Promise<void> {
  await new Promise((r) => setTimeout(r, ms));
 }
 async function pingOnce(): Promise<boolean> {
  try {
    const conn = connFromEnv();
    const sent = `ping-${Date.now()}`;
    const got = await roundTrip(conn, "amqp-ping", sent);
    if (got === sent) {
      console.log(`[amqp-ping] round-trip ok as ${conn.user} on vhost ${conn.vhost} (${conn.host}:${conn.port})`);
      return true;
    }
    console.error(`[amqp-ping] round-trip mismatch: sent ${sent}, got ${got}`);
    return false;
  } catch (err) {
    console.error(`[amqp-ping] not ready yet: ${err instanceof Error ? err.message : err}`);
    return false;
  }
 }
 // Wait for the first successful round-trip — the proof this consumer's grant works — then stay up.
 let first = false;
 for (let i = 0; !first; i++) {
  first = await pingOnce();
  if (!first) await sleep(3000);
 }
 console.log("[amqp-ping] connected and round-tripped; holding steady");
 for (;;) {
  await sleep(30000);
  await pingOnce();
 }
 // changed by the one-node test at build 66e54af151df
 // changed by the one-node test at build 4fb41636cffd
 // changed by the one-node test at build a69f083bf6a6
@@ -1,89 +0,0 @@
 {
  "module": "amqp-ping",
  "slug": "ping",
  "version": "1",
  "capabilities": [
    "container-runtime"
  ],
  "requires": [
    "amqp"
  ],
  "contributes": {},
  "binds": {
    "amqp": "/var/lib/amqp-ping/amqp.json"
  },
  "secrets": {
    "amqp": "/var/lib/amqp-ping/amqp.secret"
  },
  "own-secrets": {
    "broker": "/var/lib/mesh/amqp-ping/broker"
  },
  "resources": [
    {
      "id": "mesh-state",
      "type": "directory",
      "path": "/var/lib/mesh/amqp-ping",
      "mode": "0700"
    },
    {
      "id": "state",
      "type": "directory",
      "path": "/var/lib/amqp-ping",
      "mode": "0700"
    },
    {
      "id": "amqp-env",
      "type": "file",
      "path": "/var/lib/amqp-ping/amqp.env",
      "mode": "0600",
      "content": "MESH_AMQP_HOST=${bound:amqp:at}\nMESH_AMQP_PORT=${bound:amqp:port}\nMESH_AMQP_USER=${bound:amqp:as}\nMESH_AMQP_VHOST=${bound:amqp:as}\n"
    },
    {
      "id": "net",
      "type": "network",
      "name": "amqp-ping"
    },
    {
      "id": "runtime",
      "type": "container",
      "name": "amqp-ping",
      "network": "amqp-ping",
      "volumes": [
        "/var/lib/mesh/amqp-ping/broker:/run/secrets/broker:ro",
        "/var/lib/amqp-ping/amqp.secret:/run/secrets/amqp:ro"
      ],
      "env": {
        "MESH_BROKER_FILE": "/run/secrets/broker",
        "MESH_AMQP_PASSWORD_FILE": "/run/secrets/amqp"
      },
      "env-file": [
        "/var/lib/amqp-ping/amqp.env"
      ],
      "restart-on": [
        "amqp-env"
      ],
      "artifact": "runtime"
    }
  ],
  "build": {
    "on": [
      {
        "arg": "BUILD_BASE",
        "module": "mesh-tools",
        "artifact": "build"
      },
      {
        "arg": "RUNTIME_BASE",
        "module": "mesh-tools",
        "artifact": "runtime"
      }
    ],
    "artifacts": [
      {
        "name": "runtime",
        "kind": "image",
        "from": "Dockerfile"
      }
    ]
  }
 }
@@ -1,14 +0,0 @@
 {
  "name": "@novox/module-amqp-ping",
  "version": "0.1.0",
  "description": "amqp-ping — a demo consumer of the mesh amqp interface. Connects with its scoped grant and round-trips one message to prove the broker the mesh gave it (novox/hq ADR 0039).",
  "type": "module",
  "private": true,
  "dependencies": {
    "@novox/mesh-sdk": "^0.1.0"
  },
  "devDependencies": {
    "@types/node": "^22.0.0",
    "typescript": "^5.6.0"
  }
 }
@@ -1,12 +0,0 @@
 {
  "compilerOptions": {
    "target": "ES2022",
    "module": "NodeNext",
    "moduleResolution": "NodeNext",
    "strict": true,
    "esModuleInterop": true,
    "skipLibCheck": true,
    "noEmit": true
  },
  "include": ["client.ts", "index.ts"]
 }
@@ -14,7 +14,7 @@
    },
    "route": {
      "label": "baserow",
-      "port": 80
+      "endpoint": "web"
    }
  },
  "binds": {
@@ -30,6 +30,7 @@
  },
  "listens": [
    {
      "name": "web",
      "port": 80,
      "protocol": "tcp",
      "from": "mesh",
@@ -13,6 +13,7 @@
  },
  "listens": [
    {
      "name": "web",
      "port": 6767,
      "protocol": "tcp",
      "from": "mesh",
@@ -110,7 +111,7 @@
  "contributes": {
    "route": {
      "label": "subs",
-      "port": 6767
+      "endpoint": "web"
    }
  },
  "binds": {
@@ -15,6 +15,7 @@
  },
  "listens": [
    {
      "name": "web",
      "port": 8787,
      "protocol": "tcp",
      "from": "mesh",
@@ -87,7 +88,7 @@
  "contributes": {
    "route": {
      "label": "books",
-      "port": 8787
+      "endpoint": "web"
    }
  },
  "binds": {
@@ -0,0 +1,56 @@
 {
  "module": "ca-trust",
  "version": "1",
  "slug": "catrust",
  "capabilities": [
    "service-manager"
  ],
  "requires": [
    "internal-acme-ca"
  ],
  "seats": [
    {
      "name": "the-mesh-trust-anchor",
      "scope": "node"
    }
  ],
  "claims": [
    {
      "name": "the-mesh-trust-anchor",
      "scope": "node"
    }
  ],
  "resources": [
    {
      "id": "state",
      "type": "directory",
      "mode": "0700",
      "place": "."
    },
    {
      "id": "anchor",
      "type": "file",
      "path": "${dir:state}/anchor",
      "mode": "0755",
      "content": "#!/bin/sh\n# The mesh's internal certificate authority, trusted by this machine.\n#\n# Written by the mesh from the ca-trust module's manifest (novox/hq ADR 0147).\n# Editing it here lasts until the next apply.\n#\n# There is no prior trust to verify the fetch against \u2014 this is the thing that\n# establishes it \u2014 so it is made over the mesh's own private network, which is\n# what authenticates it (novox/hq ADR 0098, the same reasoning that lets the\n# route proxy fetch this root for itself). What comes back is checked here: a\n# body that is not a certificate is refused now, rather than believed and then\n# failed by whatever reads the trust store next.\nset -eu\n\nROOTS='https://${bound:internal-acme-ca:at}:${bound:internal-acme-ca:port}${bound:internal-acme-ca:roots}'\nANCHORS=/etc/ca-certificates/trust-source/anchors\nANCHOR=\"$ANCHORS/mesh-internal-ca.crt\"\n\n# Arch's layout, said out loud rather than assumed: a machine that keeps its\n# anchors elsewhere fails here, visibly, instead of writing a file nothing\n# reads. That failure is the signal that this belongs in the host, where one\n# operating system's difference lives (novox/hq ADR 0147, option 2).\n[ -d \"$ANCHORS\" ] || {\n\techo \"this machine keeps no trust anchors in $ANCHORS; ca-trust is written for that layout\" >&2\n\texit 1\n}\n\ncase \"${1:-}\" in\ninstall)\n\ttmp=$(mktemp)\n\ttrap 'rm -f \"$tmp\"' EXIT\n\t# The authority may still be starting, or this machine may have come up\n\t# before it: two minutes of asking, then an honest failure.\n\tn=0\n\twhile [ \"$n\" -lt 60 ]; do\n\t\tif curl --fail --silent --show-error --insecure --max-time 10 \\\n\t\t\t--output \"$tmp\" \"$ROOTS\" &&\n\t\t\tgrep -q 'BEGIN CERTIFICATE' \"$tmp\"; then\n\t\t\tinstall -m 0644 \"$tmp\" \"$ANCHOR\"\n\t\t\tupdate-ca-trust\n\t\t\texit 0\n\t\tfi\n\t\tn=$((n + 1))\n\t\tsleep 2\n\tdone\n\techo \"the authority at $ROOTS did not serve a certificate within two minutes\" >&2\n\texit 1\n\t;;\nremove)\n\t# What stopping the unit does, and therefore what being unassigned does.\n\trm -f \"$ANCHOR\"\n\tupdate-ca-trust\n\t;;\n*)\n\techo \"usage: $(basename \"$0\") install|remove\" >&2\n\texit 2\n\t;;\nesac\n"
    },
    {
      "id": "unit",
      "type": "file",
      "path": "/etc/systemd/system/mesh-ca-trust.service",
      "mode": "0644",
      "content": "[Unit]\nDescription=The mesh's internal certificate authority, trusted by this machine\n# novox/hq ADR 0147. Starting this unit places the mesh's root among this\n# machine's trust anchors; stopping it takes the root away again, which is what\n# the host does when the module is no longer assigned here.\nWants=network-online.target\nAfter=network-online.target\n\n[Service]\nType=oneshot\nRemainAfterExit=yes\nExecStart=${dir:state}/anchor install\nExecStop=${dir:state}/anchor remove\n\n[Install]\nWantedBy=multi-user.target\n"
    },
    {
      "id": "trust",
      "type": "service",
      "unit": "mesh-ca-trust.service",
      "state": "running",
      "boot": "enabled",
      "restart-on": [
        "anchor",
        "unit"
      ]
    }
  ]
 }
@@ -11,7 +11,7 @@
  "contributes": {
    "route": {
      "label": "de-spiegel",
-      "port": 35621
+      "endpoint": "web"
    }
  },
  "binds": {
@@ -23,6 +23,7 @@
  },
  "listens": [
    {
      "name": "web",
      "port": 35621,
      "protocol": "tcp",
      "from": "mesh",
@@ -29,6 +29,7 @@
  },
  "listens": [
    {
      "name": "registry",
      "port": 5000,
      "protocol": "tcp",
      "from": "mesh",
@@ -22,11 +22,20 @@
  ],
  "listens": [
    {
      "name": "dns-udp",
      "port": 53,
      "protocol": "udp",
      "from": "mesh",
      "why": "every name for this machine and what it runs \u2014 the mesh's own answered here, the rest forwarded",
      "fixed": true
    },
    {
      "name": "dns-tcp",
      "port": 53,
      "protocol": "tcp",
      "from": "mesh",
      "why": "the same names over tcp, which a resolver answers on as well and is asked for whenever an answer will not fit in a datagram. Declared because the daemon serves it: a declaration that covers one of the two protocols its own service listens on leaves the other closed while everything reports success",
      "fixed": true
    }
  ],
  "resources": [
@@ -33,7 +33,7 @@
      "type": "file",
      "path": "/etc/fail2ban/jail.local",
      "mode": "0644",
-      "content": "[INCLUDES]\n\nbefore = paths-arch.conf\n\n[DEFAULT]\n\n# Never act on the machine itself or on a tunnel peer: the mesh's private range is\n# ${machine:mesh-range}, named here rather than written as a value the module cannot\n# know (novox/hq ADR 0112). Without this, fail2ban could ban the mesh's own nodes.\nignoreip = 127.0.0.1/8 ::1 ${machine:mesh-range}\n\nbantime  = 10m\nfindtime = 10m\nmaxretry = 5\n\nbanaction = ufw\nbanaction_allports = iptables-allports\n\n[sshd]\nenabled = true\nport    = ssh\nlogpath = %(sshd_log)s\nbackend = %(sshd_backend)s\n"
+      "content": "[INCLUDES]\n\nbefore = paths-arch.conf\n\n[DEFAULT]\n\n# Never act on the machine itself or on a tunnel peer: the mesh's private range is\n# ${machine:mesh-range}, named here rather than written as a value the module cannot\n# know (novox/hq ADR 0112). Without this, fail2ban could ban the mesh's own nodes.\nignoreip = 127.0.0.1/8 ::1 ${machine:mesh-range}\n\nbantime  = 10m\nfindtime = 10m\nmaxretry = 5\n\n# Ban through iptables, not through a firewall front-end the machine may not have. ufw is\n# installed on two of this mesh's machines and absent on the other two, and fail2ban finds out\n# only at ban time: the service reports healthy, the jail counts the attempt, the ban command\n# exits 127, and nothing is blocked. Proven on 2026-09-28 -- 'ufw: command not found' on a\n# machine the mesh reported as protected.\n#\n# The action below is this module's own, already used by the recidive jail on every machine\n# here, and it bans in DOCKER-USER as well as INPUT, so a container's published port is\n# covered too.\nbanaction = iptables-allports-dualchain\nbanaction_allports = iptables-allports-dualchain\n\n[sshd]\nenabled = true\nport    = ssh\nlogpath = %(sshd_log)s\nbackend = %(sshd_backend)s\n"
    },
    {
      "id": "jail-sshd",
@@ -42,6 +42,14 @@
      "mode": "0644",
      "content": "[sshd]\nenabled = true\nport    = ssh\nlogpath = %(sshd_log)s\nbackend = %(sshd_backend)s\nmaxretry = 5\n"
    },
    {
      "id": "log",
      "type": "file",
      "path": "/var/log/fail2ban.log",
      "mode": "0640",
      "create-once": true,
      "content": ""
    },
    {
      "id": "jail-recidive",
      "type": "file",
@@ -9,6 +9,8 @@ import { ConfiguredToken, MintedToken, type TokenSource } from "./token.js";
 /** A repository, trimmed to what the mesh cares about. */
 export interface GiteaRepo {
  full_name: string;
  /** The URL a build clones — what a module records as its source. */
  clone_url?: string;
  name: string;
  owner: string;
  private: boolean;
@@ -34,6 +36,9 @@ export interface GiteaPull {
  title: string;
  state: string;
  merged: boolean;
  /** The commit the merge produced — what a build of the base branch is made from. */
  merge_commit_sha?: string;
  merged_at?: string;
  user?: string;
  head?: string;
  base?: string;
@@ -116,9 +121,23 @@ export class GiteaClient {
  // ---- Repositories ----
  /** Every repository this token can see, one page. `/user/repos` is only what the token's own
   *  user owns — for the mesh's administrator that is nothing, which is how the forge watched an
   *  empty list and announced no merge (2026-09-28). The search endpoint is the forge's whole view. */
  async listRepos(page = 1, limit = 20): Promise<GiteaRepo[]> {
-    const repos = await this.request<any[]>(`/user/repos?page=${page}&limit=${limit}`);
+    const found = await this.request<{ data?: any[] }>(`/repos/search?page=${page}&limit=${limit}`);
-    return (repos ?? []).map(GiteaClient.mapRepo);
+    return (found?.data ?? []).map(GiteaClient.mapRepo);
  }
  /** Every repository, all pages. */
  async listAllRepos(): Promise<GiteaRepo[]> {
    const all: GiteaRepo[] = [];
    for (let page = 1; page < 100; page++) {
      const batch = await this.listRepos(page, 50);
      all.push(...batch);
      if (batch.length < 50) break;
    }
    return all;
  }
  async createRepo(data: {
@@ -210,6 +229,17 @@ export class GiteaClient {
    return GiteaClient.mapPull(await this.request<any>(`/repos/${owner}/${repo}/pulls/${index}`));
  }
  /** The files a merged pull request changed, as paths from the repository's root.
   *
   *  `limit` is what is asked for, and a merge that changed more says so rather than being read
   *  page by page: what the mesh does with a partial list is treat the whole repository as changed,
   *  so more pages would buy nothing. */
  async listPullFiles(owner: string, repo: string, index: number, limit = 100): Promise<{ paths: string[]; truncated: boolean }> {
    const files = await this.request<any[]>(`/repos/${owner}/${repo}/pulls/${index}/files?limit=${limit}`);
    const paths = (files ?? []).map((f) => String(f?.filename ?? "")).filter((p) => p !== "");
    return { paths, truncated: paths.length >= limit };
  }
  async createPullRequest(
    owner: string,
    repo: string,
@@ -232,6 +262,7 @@ export class GiteaClient {
  private static mapRepo(r: any): GiteaRepo {
    return {
      full_name: r.full_name,
      clone_url: r.clone_url ?? undefined,
      name: r.name,
      owner: r.owner?.login ?? r.full_name?.split("/")[0] ?? "unknown",
      private: Boolean(r.private),
@@ -259,6 +290,8 @@ export class GiteaClient {
      title: p.title,
      state: p.state,
      merged: Boolean(p.merged),
      merge_commit_sha: p.merge_commit_sha ?? undefined,
      merged_at: p.merged_at ?? undefined,
      user: p.user?.login,
      head: p.head?.ref,
      base: p.base?.ref,
@@ -31,7 +31,7 @@ try {
 const seen = new Set<string>();
 let primed = false;
 async function pollRepos(client: GiteaClient): Promise<void> {
-  const repos = await client.listRepos(1, 50);
+  const repos = await client.listAllRepos();
  for (const repo of repos) {
    if (!seen.has(repo.full_name)) {
      if (primed) {
@@ -49,6 +49,83 @@ async function pollRepos(client: GiteaClient): Promise<void> {
  primed = true;
 }
 // **A merge is announced whoever made it.** The merge tool below emits at the instant it acts; a
 // merge made in the forge's own pages or over its API would emit nothing, and the mesh would go on
 // believing every module current with its source (novox/hq 04-ISSUES/131). So merged pull requests
 // are watched the way repositories are: what the forge holds, asked for on a tick, announced once.
 // What has been announced is kept beside the module's state, so a restart does not announce the
 // whole history again — and the first tick on a machine with no record announces nothing, because
 // everything it sees then predates the watching.
 import { existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
 const mergedRecord = process.env.MESH_GITEA_STATE_DIR ? join(process.env.MESH_GITEA_STATE_DIR, "merged-announced.json") : null;
 const announced = new Set<string>();
 let primedMerges = false;
 // since is the moment the watching began: a merge made before it is history, whatever page of the
 // forge's listing it surfaces on. Without it, an old merge past the first page — pushed into view
 // as newer pull requests were updated — was announced as if it had just happened, and the mesh
 // rebuilt everything built from that repository, once per old merge (2026-09-28).
 let since = "";
 if (mergedRecord && existsSync(mergedRecord)) {
  try {
    const kept = JSON.parse(readFileSync(mergedRecord, "utf8")) as string[] | { announced: string[]; since: string };
    const list = Array.isArray(kept) ? kept : kept.announced;
    for (const sha of list) announced.add(sha);
    since = Array.isArray(kept) ? new Date().toISOString() : kept.since;
    primedMerges = true;
  } catch {
    // An unreadable record is treated as no record: prime again rather than re-announce history.
  }
 }
 function keepAnnounced(): void {
  if (!mergedRecord) return;
  mkdirSync(join(mergedRecord, ".."), { recursive: true });
  const tmp = mergedRecord + ".tmp";
  writeFileSync(tmp, JSON.stringify({ announced: [...announced].slice(-2000), since }));
  renameSync(tmp, mergedRecord);
 }
 async function pollMerged(client: GiteaClient): Promise<void> {
  const repos = await client.listAllRepos();
  let changed = false;
  for (const repo of repos) {
    const pulls = await client.listPullRequests(repo.owner, repo.name, { state: "closed", sort: "recentupdate", limit: "20" });
    for (const pull of pulls) {
      if (!pull.merged || !pull.merge_commit_sha || announced.has(pull.merge_commit_sha)) continue;
      // Announced only if merged since the watching began; recorded either way, so it is looked
      // at once.
      const fresh = !!pull.merged_at && !!since && pull.merged_at > since;
      if (primedMerges && fresh) {
        // What it changed, asked for only now: a module is rebuilt because a file inside its own
        // directory moved, and without this every module built from a repository is rebuilt for a
        // change to any of them (novox/hq 04-ISSUES/131).
        const changed = await client.listPullFiles(repo.owner, repo.name, pull.number);
        await emit("pull.merged", {
          owner: repo.owner,
          repo: repo.name,
          number: pull.number,
          title: pull.title,
          head: pull.head,
          base: pull.base,
          merge_commit_sha: pull.merge_commit_sha,
          merged_at: pull.merged_at,
          clone_url: repo.clone_url,
          html_url: pull.html_url,
          paths: changed.paths,
          paths_truncated: changed.truncated,
        });
        // Said, because a trigger that fires silently is indistinguishable from one that did not
        // fire (novox/hq 04-ISSUES/131) — this line is how an operator knows the mesh was told.
        console.log(`[gitea] announced merge ${repo.full_name}#${pull.number} (${pull.merge_commit_sha.slice(0, 8)}) into ${pull.base}`);
      }
      announced.add(pull.merge_commit_sha);
      changed = true;
    }
  }
  if (!primedMerges) since = new Date().toISOString();
  if (!primedMerges || changed) keepAnnounced();
  primedMerges = true;
 }
 if (gitea) {
  const client = gitea;
  // A poll that fails says so once, not once a minute: the same reason repeating (the forge not up
@@ -70,5 +147,6 @@ if (gitea) {
    run();
  };
  tick(() => pollRepos(client), 60_000);
-  console.log("[gitea] watching for new repositories");
+  tick(() => pollMerged(client), 30_000);
  console.log("[gitea] watching for new repositories and merged pull requests");
 }
@@ -13,7 +13,7 @@
    "route": {
      "web": {
        "label": "git",
-        "port": 3000
+        "endpoint": "web"
      },
      "internal-api-refused": {
        "label": "git",
@@ -44,12 +44,14 @@
  ],
  "listens": [
    {
      "name": "web",
      "port": 3000,
      "protocol": "tcp",
      "from": "mesh",
      "why": "the forge, over http"
    },
    {
      "name": "ssh",
      "port": 22,
      "protocol": "tcp",
      "from": "mesh",
@@ -231,6 +231,11 @@ export function getGiteaTools(gitea: GiteaClient): ToolDefinition[] {
        // Read the PR first, so the merged event carries a title and branches, not just a number.
        const pull = await gitea.getPullRequest(owner, repo, number);
        await gitea.mergePullRequest(owner, repo, number, method, deleteBranch);
        // Read it again: the merge commit only exists now, and it is what a build is made from.
        const merged = await gitea.getPullRequest(owner, repo, number);
        // And what it changed, so the mesh rebuilds the modules whose own files moved rather than
        // every module built from the repository (novox/hq 04-ISSUES/131).
        const changed = await gitea.listPullFiles(owner, repo, number);
        await emit("pull.merged", {
          owner,
          repo,
@@ -238,8 +243,12 @@ export function getGiteaTools(gitea: GiteaClient): ToolDefinition[] {
          title: pull.title,
          head: pull.head,
          base: pull.base,
          merge_commit_sha: merged.merge_commit_sha,
          merged_at: merged.merged_at,
          method,
          html_url: pull.html_url,
          paths: changed.paths,
          paths_truncated: changed.truncated,
        });
        return { merged: true, number, method, deleted_branch: deleteBranch };
      },
@@ -5,7 +5,7 @@
    "alert.firing"
  ],
  "own-secrets": {
-    "admin": "/var/lib/grafana-module/admin.secret",
+    "admin": "/var/lib/mesh/grafana/admin",
    "broker": "/var/lib/mesh/grafana/broker"
  },
  "capabilities": [
@@ -13,6 +13,7 @@
  ],
  "listens": [
    {
      "name": "web",
      "port": 3000,
      "protocol": "tcp",
      "from": "mesh",
@@ -29,45 +30,87 @@
    {
      "id": "state",
      "type": "directory",
-      "path": "/var/lib/grafana-module",
+      "mode": "0700",
-      "mode": "0700"
+      "place": "."
    },
    {
      "id": "data",
      "type": "directory",
      "path": "/services/grafana/data",
      "mode": "0700",
      "owner": "472:472"
    },
    {
-      "id": "server-env",
+      "id": "admin-secret",
      "type": "file",
-      "path": "/var/lib/grafana-module/server.env",
+      "path": "${dir:state}/admin.secret",
-      "mode": "0600",
+      "mode": "0400",
-      "content": "GF_SECURITY_ADMIN_PASSWORD=${secret:admin}\n"
+      "owner": "472:472",
      "content": "${secret:admin}"
    },
    {
      "id": "oidc-secret",
      "type": "file",
      "path": "${dir:state}/oidc-client.secret",
      "mode": "0400",
      "owner": "472:472",
      "content": "${secret:oidc-client}"
    },
    {
      "id": "oidc-env",
      "type": "file",
      "path": "${dir:state}/oidc.env",
      "mode": "0644",
      "content": "GF_SERVER_ROOT_URL=https://${bound:route:name}\nGF_AUTH_GENERIC_OAUTH_ENABLED=true\nGF_AUTH_GENERIC_OAUTH_NAME=Keycloak\nGF_AUTH_GENERIC_OAUTH_CLIENT_ID=${bound:oidc-client:as}\nGF_AUTH_GENERIC_OAUTH_CLIENT_SECRET__FILE=/run/secrets/oidc-client\nGF_AUTH_GENERIC_OAUTH_SCOPES=openid email profile roles\nGF_AUTH_GENERIC_OAUTH_AUTH_URL=${bound:oidc-client:issuer}${bound:oidc-client:authorization-path}\nGF_AUTH_GENERIC_OAUTH_TOKEN_URL=${bound:oidc-client:issuer}${bound:oidc-client:token-path}\nGF_AUTH_GENERIC_OAUTH_API_URL=${bound:oidc-client:issuer}${bound:oidc-client:userinfo-path}\nGF_AUTH_GENERIC_OAUTH_ROLE_ATTRIBUTE_PATH=contains(roles[*], 'admin') && 'Admin' || contains(realm_access.roles[*], 'admin') && 'Admin' || 'Viewer'\nGF_AUTH_GENERIC_OAUTH_USE_PKCE=true\nGF_AUTH_GENERIC_OAUTH_ALLOW_SIGN_UP=true\nGF_AUTH_GENERIC_OAUTH_ALLOW_ASSIGN_GRAFANA_ADMIN=true\n"
    },
    {
      "id": "influxdb-secret",
      "type": "file",
      "path": "${dir:state}/influxdb-api.secret",
      "mode": "0400",
      "owner": "472:472",
      "content": "${secret:influxdb-api}"
    },
    {
      "id": "influxdb-datasource",
      "type": "file",
      "path": "${dir:state}/datasource-influxdb.yaml",
      "mode": "0644",
      "content": "apiVersion: 1\n# Written by the mesh from grafana's influxdb-api binding; grafana reads it at start. Its own name and\n# uid, so a data source somebody made in the UI is never overwritten, and read-only in the UI because\n# the mesh resets it. The password is read from the file the mesh delivers, never written here.\ndatasources:\n  - name: InfluxDB (mesh)\n    uid: mesh-influxdb-api\n    type: influxdb\n    access: proxy\n    url: ${bound:influxdb-api:scheme}://${bound:influxdb-api:at}:${bound:influxdb-api:port}\n    user: ${bound:influxdb-api:as}\n    isDefault: false\n    editable: false\n    jsonData:\n      dbName: ${bound:influxdb-api:bucket}\n      httpMode: POST\n    secureJsonData:\n      password: $__file{/run/secrets/influxdb-api}\n"
    },
    {
      "id": "server",
      "type": "container",
      "name": "grafana",
-      "image": "grafana/grafana@sha256:f772d434e8fab0049deb2b1b30abd43342bcfca1537614aa8d36080232cf4283",
+      "image": "grafana/grafana@sha256:ac461fb352abc50da10a51c7d02462e9c05488f11f53f14b3ad79a8145f638a0",
      "ports": [
        "3000"
      ],
      "volumes": [
-        "/services/grafana/data:/var/lib/grafana"
+        "${dir:data}:/var/lib/grafana",
        "${dir:state}/admin.secret:/run/secrets/admin:ro",
        "${dir:state}/oidc-client.secret:/run/secrets/oidc-client:ro",
        "${dir:state}/influxdb-api.secret:/run/secrets/influxdb-api:ro",
        "${dir:state}/datasource-influxdb.yaml:/etc/grafana/provisioning/datasources/mesh-influxdb.yaml:ro"
      ],
      "env": {
        "GF_SECURITY_ADMIN_PASSWORD__FILE": "/run/secrets/admin"
      },
      "env-file": [
-        "/var/lib/grafana-module/server.env"
+        "${dir:state}/oidc.env"
      ],
-      "secrets-in-environment": "grafana honours GF_SECURITY_ADMIN_PASSWORD__FILE; convertible, awaiting a bed that exercises the admin password (assigned-grafana serves tools only)"
+      "restart-on": [
        "oidc-env",
        "oidc-secret",
        "influxdb-datasource",
        "influxdb-secret"
      ]
    },
    {
      "id": "runtime-config",
      "type": "file",
      "path": "/var/lib/mesh/grafana/config.json",
      "mode": "0600",
-      "content": "{}\n",
+      "content": "{\n  \"user\": \"admin\",\n  \"password\": \"${secret:admin}\"\n}\n",
      "merge": "json"
    },
    {
@@ -81,7 +124,7 @@
      ],
      "env": {
        "MESH_BROKER_FILE": "/run/secrets/broker",
-        "MESH_GRAFANA_URL": "http://127.0.0.1:3000",
+        "MESH_GRAFANA_URL": "http://127.0.0.1:${port:3000}",
        "MESH_GRAFANA_CONFIG_FILE": "/run/config/config.json"
      },
      "restart-on": [
@@ -91,16 +134,32 @@
    }
  ],
  "requires": [
-    "route"
+    "route",
    "oidc-client",
    "influxdb-api"
  ],
  "contributes": {
    "route": {
      "label": "grafana",
-      "port": 3000
+      "endpoint": "web"
    },
    "oidc-client": {
      "label": "grafana",
      "endpoint": "web",
      "callback": "/login/generic_oauth"
    },
    "influxdb-api": {
      "access": "read"
    }
  },
  "binds": {
-    "route": "/var/lib/mesh/grafana/route.json"
+    "route": "${dir:state}/route.json",
    "oidc-client": "${dir:state}/oidc.json",
    "influxdb-api": "${dir:state}/influxdb.json"
  },
  "secrets": {
    "oidc-client": "/var/lib/mesh/grafana/oidc-client",
    "influxdb-api": "/var/lib/mesh/grafana/influxdb-api"
  },
  "build": {
    "on": [
@@ -11,7 +11,7 @@
  "contributes": {
    "route": {
      "label": "hello",
-      "port": 8080
+      "endpoint": "web"
    }
  },
  "binds": {
@@ -19,6 +19,7 @@
  },
  "listens": [
    {
      "name": "web",
      "port": 8080,
      "protocol": "tcp",
      "from": "mesh",
@@ -14,6 +14,7 @@
  },
  "listens": [
    {
      "name": "web",
      "port": 8123,
      "protocol": "tcp",
      "from": "mesh",
@@ -85,7 +86,7 @@
  "contributes": {
    "route": {
      "label": "home-assistant",
-      "port": 8123
+      "endpoint": "web"
    }
  },
  "binds": {
@@ -13,6 +13,7 @@
  },
  "listens": [
    {
      "name": "stream",
      "port": 8000,
      "protocol": "tcp",
      "from": "mesh",
@@ -13,7 +13,7 @@ ARG RUNTIME_BASE
 FROM ${BUILD_BASE} AS build
 WORKDIR /app/modules/influxdb
 COPY . .
-RUN node /app/node_modules/typescript/bin/tsc client.ts tools/index.ts \
+RUN node /app/node_modules/typescript/bin/tsc client.ts grants.ts provisioner/index.ts tools/index.ts \
      --module NodeNext --moduleResolution NodeNext --target ES2022 --outDir dist
 FROM ${RUNTIME_BASE}
@@ -21,4 +21,4 @@ COPY --from=build /app/modules/influxdb/dist /app/modules/influxdb/dist
 # Every serve-time entrypoint, loaded by the runtime in serve mode: tools and events serve, and a
 # provider's provisioner runs its reconcile loop in the same process, with the broker connected —
 # the convention novox/hq issues 060/061 settled.
-ENV MESH_TOOL_MODULES=/app/modules/influxdb/dist/tools/index.js
+ENV MESH_TOOL_MODULES=/app/modules/influxdb/dist/tools/index.js,/app/modules/influxdb/dist/provisioner/index.js
@@ -17,6 +17,25 @@ export interface InfluxBucket {
  retentionSeconds?: number;
 }
 /** One permission of an authorization, as InfluxDB represents it: an action on a resource type,
 *  in one org, optionally narrowed to one resource by id (no id = every resource of that type). */
 export interface InfluxPermission {
  action: "read" | "write";
  resource: { type: string; orgID?: string; id?: string; name?: string; org?: string };
 }
 /** A v1-compatibility ("legacy") authorization: a username (InfluxDB calls it `token`) and a
 *  password the caller chooses, scoped by permissions. The one credential InfluxDB 2.x lets a
 *  caller set to a value it did not generate — which is what a mesh-minted password needs. */
 export interface LegacyAuthorization {
  id: string;
  token: string;
  orgID: string;
  status?: "active" | "inactive";
  description?: string;
  permissions: InfluxPermission[];
 }
 /** The settings-merged config the mesh delivers (novox/hq ADR 0046): { url, apiKey, token, password, user, ... }. */
 function meshConfig(file?: string): Record<string, string> {
  if (!file) return {};
@@ -24,13 +43,20 @@ function meshConfig(file?: string): Record<string, string> {
  catch { return {}; }
 }
 /** A secret delivered as a file, trimmed; undefined when there is none, so the caller can fall back. */
 function tokenFromFile(file?: string): string | undefined {
  if (!file) return undefined;
  try { return readFileSync(file, "utf8").trim() || undefined; }
  catch { return undefined; }
 }
 export class InfluxDBClient {
  readonly baseUrl: string;
  constructor(
    url: string,
    private readonly token: string,
-    private readonly org: string,
+    readonly org: string,
  ) {
    this.baseUrl = url.replace(/\/$/, "");
  }
@@ -43,8 +69,10 @@ export class InfluxDBClient {
  static fromEnv(env: NodeJS.ProcessEnv = process.env): InfluxDBClient {
    const cfg = meshConfig(env.MESH_INFLUXDB_CONFIG_FILE);
    const url = cfg.url ?? env.MESH_INFLUXDB_URL ?? `http://127.0.0.1:${env.INFLUXDB_PORT ?? "8086"}`;
-    const token = cfg.token ?? env.MESH_INFLUXDB_TOKEN;
+    // The token reaches the process as a file (novox/hq ADR 0086); the environment variable stays
-    if (!token) throw new Error("no InfluxDB token — set MESH_INFLUXDB_TOKEN");
+    // only for a workstation running the tools by hand.
    const token = cfg.token ?? tokenFromFile(env.MESH_INFLUXDB_TOKEN_FILE) ?? env.MESH_INFLUXDB_TOKEN;
    if (!token) throw new Error("no InfluxDB token — set MESH_INFLUXDB_TOKEN_FILE");
    const org = cfg.org ?? env.MESH_INFLUXDB_ORG ?? "mesh";
    return new InfluxDBClient(url, token, org);
  }
@@ -61,6 +89,93 @@ export class InfluxDBClient {
    return res;
  }
  /** Like request, but the answer is returned whatever its status, for the caller to read. */
  private async raw(path: string, init?: RequestInit): Promise<Response> {
    return fetch(`${this.baseUrl}${path}`, {
      ...init,
      headers: { Authorization: `Token ${this.token}`, ...(init?.headers ?? {}) },
    });
  }
  private async send(path: string, method: string, body?: unknown): Promise<Response> {
    return this.request(path, {
      method,
      headers: { "Content-Type": "application/json" },
      body: body === undefined ? undefined : JSON.stringify(body),
    });
  }
  /** The id of the org of this name, or undefined when there is none. */
  async orgID(name: string): Promise<string | undefined> {
    const res = await this.raw(`/api/v2/orgs?org=${encodeURIComponent(name)}`);
    if (res.status === 404) return undefined;
    if (!res.ok) throw new Error(`InfluxDB API /api/v2/orgs: ${res.status} ${await res.text()}`);
    const body = (await res.json()) as { orgs?: { id: string; name: string }[] };
    return body.orgs?.find((o) => o.name === name)?.id;
  }
  /** The bucket of exactly this name in the org, or undefined. */
  async findBucket(orgID: string, name: string): Promise<InfluxBucket | undefined> {
    const res = await this.raw(`/api/v2/buckets?orgID=${encodeURIComponent(orgID)}&name=${encodeURIComponent(name)}`);
    if (res.status === 404) return undefined;
    if (!res.ok) throw new Error(`InfluxDB API /api/v2/buckets: ${res.status} ${await res.text()}`);
    const body = (await res.json()) as { buckets?: { id: string; name: string; orgID?: string }[] };
    const b = body.buckets?.find((x) => x.name === name);
    return b ? { id: b.id, name: b.name, orgID: b.orgID } : undefined;
  }
  /** Create a bucket that keeps its data for ever — retention is the operator's choice, never the mesh's. */
  async createBucket(orgID: string, name: string, description: string): Promise<InfluxBucket> {
    const b = (await (await this.send("/api/v2/buckets", "POST", {
      orgID, name, description, retentionRules: [],
    })).json()) as { id: string; name: string; orgID?: string };
    return { id: b.id, name: b.name, orgID: b.orgID };
  }
  /** The v1 authorization whose username is exactly this, or undefined. */
  async findLegacy(username: string): Promise<LegacyAuthorization | undefined> {
    const path = `/private/legacy/authorizations?token=${encodeURIComponent(username)}`;
    const res = await this.raw(path);
    // InfluxDB answers a filter matching nothing with 404, not an empty list.
    if (res.status === 404) return undefined;
    if (!res.ok) throw new Error(`InfluxDB API ${path}: ${res.status} ${await res.text()}`);
    const body = (await res.json()) as { authorizations?: LegacyAuthorization[] };
    return body.authorizations?.find((a) => a.token === username);
  }
  async createLegacy(a: Omit<LegacyAuthorization, "id">): Promise<LegacyAuthorization> {
    return (await (await this.send("/private/legacy/authorizations", "POST", a)).json()) as LegacyAuthorization;
  }
  /** Set a v1 authorization's password. InfluxDB keeps only a hash of it, so it can be set, never read. */
  async setLegacyPassword(id: string, password: string): Promise<void> {
    await this.send(`/private/legacy/authorizations/${encodeURIComponent(id)}/password`, "POST", { password });
  }
  async updateLegacy(id: string, patch: { status?: "active" | "inactive"; description?: string }): Promise<void> {
    await this.send(`/private/legacy/authorizations/${encodeURIComponent(id)}`, "PATCH", patch);
  }
  async deleteLegacy(id: string): Promise<void> {
    await this.send(`/private/legacy/authorizations/${encodeURIComponent(id)}`, "DELETE");
  }
  /**
   * Whether this username and password sign in on the v1 API — the consumer's own view. Asked with
   * a statement that reads nothing (`SHOW DATABASES` lists only what the credential may read), sent
   * with Basic auth so the password is never in a URL. 401 is a wrong password or no such user;
   * anything else that is not a server error means InfluxDB knew who was asking.
   */
  async legacySignsIn(username: string, password: string): Promise<boolean> {
    const res = await fetch(`${this.baseUrl}/query?q=${encodeURIComponent("SHOW DATABASES")}`, {
      headers: { Authorization: `Basic ${Buffer.from(`${username}:${password}`).toString("base64")}` },
    });
    await res.arrayBuffer();
    if (res.status === 401) return false;
    if (res.status >= 500) throw new Error(`InfluxDB v1 /query: ${res.status}`);
    return true;
  }
  /** Server health — the one endpoint that needs no token, but we send it anyway. */
  async health(): Promise<InfluxHealth> {
    return (await (await this.request("/health")).json()) as InfluxHealth;
@@ -0,0 +1,186 @@
 // What the `influxdb-api` provision means in InfluxDB: one v1-compatibility authorization per
 // consumer, in the org this module serves, under the username and password the mesh gave both ends,
 // allowed exactly the access the consumer contributed. The provisioner (provisioner/index.ts) is the
 // sdk harness calling these; they are here, apart from it, so they can be exercised against a fake
 // InfluxDB without a broker or a contributions file.
 //
 // **Why a v1 authorization and not a v2 API token.** The mesh mints the consumer's password and
 // hands it to both ends (novox/hq ADR 0048); the provider sets it, and never hands one back. An
 // InfluxDB 2.x API token is generated by the server — `POST /api/v2/authorizations` ignores a token
 // the caller sends — so a token could only ever be the operator's to accept, one per pair, by hand.
 // A v1 authorization is a username and a password the caller chooses (8–72 characters; the mesh
 // mints 40), stored hashed, and it reads and writes through InfluxQL (`/query`) and line protocol
 // (`/write`), which every bucket answers under its own name as a database (InfluxDB maps each
 // bucket to a database of the same name by itself). That is what grafana's InfluxDB data source
 // speaks, and what Node-RED's influxdb nodes speak in their 1.x mode — so the mesh can make every
 // consumer's credential, rotate it and withdraw it, with no person in the loop.
 //
 // **What a consumer contributes.** `access`: "read" (the default), "write" or "read-write".
 // `buckets`: the buckets it may use, by name. A reader that names none may read every bucket of the
 // org — a dashboard is pointed at data, it does not own it. A writer must name its buckets: writing
 // everywhere, the org's system buckets included, is never what a consumer means. A named bucket
 // that does not exist is created, keeping its data for ever; the mesh never deletes a bucket.
 //
 // **Only what the mesh made is touched.** An authorization this module creates is named with the
 // mesh's identity prefix and its description starts with MARK. One with the same username that
 // lacks the mark is somebody else's: it is refused, never adopted, never updated, never deleted.
 // Every other authorization, token, user and bucket in the instance is left exactly as it was.
 import type { InfluxDBClient, InfluxPermission, LegacyAuthorization } from "./client.js";
 /** How a description marks an authorization as the mesh's own work. */
 export const MARK = "[mesh]";
 /** The prefix the mesh gives every consumer identity (novox/hq ADR 0049). */
 const IDENTITY_PREFIX = "mesh_";
 /** One consumer, as the harness hands it over. */
 export interface ApiGrant {
  readonly as: string;
  readonly password: string;
  readonly values: Readonly<Record<string, unknown>>;
  readonly consumer?: string;
 }
 export type Access = "read" | "write" | "read-write";
 /** What a contribution asks for, checked. Refused when it cannot be served as asked. */
 export function askedFor(values: Readonly<Record<string, unknown>>): { access: Access; buckets: string[] } {
  const access = values.access ?? "read";
  if (access !== "read" && access !== "write" && access !== "read-write") {
    throw new Error(`contributes an access of ${JSON.stringify(access)} — it is "read", "write" or "read-write"`);
  }
  const raw = values.buckets ?? [];
  if (!Array.isArray(raw) || raw.some((b) => typeof b !== "string" || b.trim() === "")) {
    throw new Error(`contributes buckets of ${JSON.stringify(raw)} — a list of bucket names`);
  }
  const buckets = [...new Set((raw as string[]).map((b) => b.trim()))].sort();
  if (access !== "read" && buckets.length === 0) {
    throw new Error(`asks to write and names no bucket (\`buckets\`) — a writer names what it writes to`);
  }
  if (buckets.some((b) => b.startsWith("_"))) {
    throw new Error(`names a system bucket (${buckets.filter((b) => b.startsWith("_")).join(", ")}) — those are InfluxDB's own`);
  }
  return { access: access as Access, buckets };
 }
 /** The permissions a grant resolves to, given each named bucket's id. */
 export function permissionsFor(orgID: string, access: Access, bucketIDs: string[]): InfluxPermission[] {
  const actions: ("read" | "write")[] = access === "read-write" ? ["read", "write"] : [access];
  const out: InfluxPermission[] = [];
  for (const action of actions) {
    if (bucketIDs.length === 0) {
      out.push({ action, resource: { type: "buckets", orgID } });
      continue;
    }
    for (const id of bucketIDs) out.push({ action, resource: { type: "buckets", orgID, id } });
  }
  return out;
 }
 /** A permission as a comparable string: what InfluxDB answers carries names and links besides. */
 function key(p: InfluxPermission): string {
  return `${p.action}:${p.resource.type}:${p.resource.orgID ?? ""}:${p.resource.id ?? "*"}`;
 }
 function samePermissions(a: readonly InfluxPermission[], b: readonly InfluxPermission[]): boolean {
  const x = a.map(key).sort();
  const y = b.map(key).sort();
  return x.length === y.length && x.every((v, i) => v === y[i]);
 }
 export function marked(a: Pick<LegacyAuthorization, "token" | "description">): boolean {
  return a.token.startsWith(IDENTITY_PREFIX) && (a.description ?? "").startsWith(MARK);
 }
 function describe(g: ApiGrant): string {
  return `${MARK} made by the mesh for ${g.consumer ? `a module on ${g.consumer}` : "a consumer"} — do not edit; it is reset`;
 }
 export class ApiGrants {
  constructor(private readonly influx: InfluxDBClient, readonly org: string) {}
  private async orgID(): Promise<string> {
    const id = await this.influx.orgID(this.org);
    if (!id) throw new Error(`InfluxDB has no org ${JSON.stringify(this.org)} — the org this module serves must exist`);
    return id;
  }
  /** The ids of the named buckets, creating any that are missing when `create` says so. Undefined
   *  when one is missing and may not be created (a read-only question). */
  private async bucketIDs(orgID: string, names: string[], create: ApiGrant | undefined): Promise<string[] | undefined> {
    const ids: string[] = [];
    for (const name of names) {
      let b = await this.influx.findBucket(orgID, name);
      if (!b) {
        if (!create) return undefined;
        b = await this.influx.createBucket(orgID, name, `${MARK} made by the mesh for ${create.as}; the mesh never deletes it`);
      }
      ids.push(b.id);
    }
    return ids.sort();
  }
  /** Create the consumer's authorization, or bring the mesh's existing one back to what the grant
   *  says. Idempotent: a second apply of the same grant changes nothing beyond re-asserting the
   *  password, which InfluxDB can be told but never asked. */
  async ensure(g: ApiGrant): Promise<"created" | "updated" | "unchanged"> {
    if (!g.as.startsWith(IDENTITY_PREFIX)) {
      throw new Error(`${g.as} is not a mesh identity — the mesh names every consumer ${IDENTITY_PREFIX}<node>_<module>`);
    }
    const { access, buckets } = askedFor(g.values);
    const orgID = await this.orgID();
    const found = await this.influx.findLegacy(g.as);
    if (found && !marked(found)) {
      throw new Error(
        `InfluxDB already has a v1 authorization ${g.as} the mesh did not make — left alone; ` +
          `delete it if the mesh should own that name`);
    }
    const want = permissionsFor(orgID, access, (await this.bucketIDs(orgID, buckets, g))!);
    if (found && found.orgID === orgID && samePermissions(found.permissions, want)) {
      // Only what differs is written. The password cannot be read back, so it is tried instead.
      let changed = false;
      if (found.status === "inactive") {
        await this.influx.updateLegacy(found.id, { status: "active" });
        changed = true;
      }
      if (!(await this.influx.legacySignsIn(g.as, g.password))) {
        await this.influx.setLegacyPassword(found.id, g.password);
        changed = true;
      }
      return changed ? "updated" : "unchanged";
    }
    // InfluxDB cannot change an authorization's permissions in place, so the mesh's own is made
    // again. Only ever one the mesh made: a foreign one was refused above.
    if (found) await this.influx.deleteLegacy(found.id);
    const made = await this.influx.createLegacy({
      token: g.as, orgID, status: "active", description: describe(g), permissions: want,
    });
    await this.influx.setLegacyPassword(made.id, g.password);
    return found ? "updated" : "created";
  }
  /** Whether InfluxDB still holds this consumer's authorization exactly as the grant says: present,
   *  the mesh's, active, allowed what was asked and nothing more, and signing in with the mesh's
   *  password. Reads only — a missing bucket is "not held", never created here. */
  async holds(g: ApiGrant): Promise<boolean> {
    const { access, buckets } = askedFor(g.values);
    const orgID = await this.influx.orgID(this.org);
    if (!orgID) return false;
    const found = await this.influx.findLegacy(g.as);
    if (!found || !marked(found) || found.status === "inactive" || found.orgID !== orgID) return false;
    const ids = await this.bucketIDs(orgID, buckets, undefined);
    if (!ids || !samePermissions(found.permissions, permissionsFor(orgID, access, ids))) return false;
    return this.influx.legacySignsIn(g.as, g.password);
  }
  /** Withdraw a consumer's authorization — only one the mesh made. Its buckets and their data stay. */
  async remove(as: string): Promise<"removed" | "absent" | "not ours"> {
    const found = await this.influx.findLegacy(as);
    if (!found) return "absent";
    if (!marked(found)) return "not ours";
    await this.influx.deleteLegacy(found.id);
    return "removed";
  }
 }
@@ -1,6 +1,12 @@
 {
  "module": "influxdb",
  "version": "1",
  "provides": [
    {
      "name": "influxdb-api",
      "scope": "mesh"
    }
  ],
  "capabilities": [
    "container-runtime"
  ],
@@ -9,12 +15,27 @@
  },
  "listens": [
    {
      "name": "api",
      "port": 8086,
      "protocol": "tcp",
      "from": "mesh",
-      "why": "queries and writes, over http"
+      "why": "queries, writes and the web UI, over http; consumers granted influxdb-api sign in with the mesh's credential, and a name is a route grant"
    }
  ],
  "serves": {
    "influxdb-api": {
      "scheme": "http",
      "port": 8086,
      "org": "mesh",
      "bucket": "default"
    }
  },
  "receives": {
    "influxdb-api": "${dir:grants}/mesh.json"
  },
  "grants": {
    "influxdb-api": "${dir:grants}"
  },
  "resources": [
    {
      "id": "mesh-state",
@@ -25,46 +46,50 @@
    {
      "id": "state",
      "type": "directory",
-      "path": "/var/lib/influxdb-module",
+      "mode": "0700",
-      "mode": "0700"
+      "place": "."
    },
    {
      "id": "server-env",
      "type": "file",
      "path": "/var/lib/influxdb-module/server.env",
      "mode": "0600",
      "content": "DOCKER_INFLUXDB_INIT_MODE=setup\nDOCKER_INFLUXDB_INIT_USERNAME=admin\nDOCKER_INFLUXDB_INIT_PASSWORD=${secret:admin}\nDOCKER_INFLUXDB_INIT_ADMIN_TOKEN=${secret:admin-token}\nDOCKER_INFLUXDB_INIT_ORG=mesh\nDOCKER_INFLUXDB_INIT_BUCKET=default\n"
    },
    {
      "id": "data",
      "type": "directory",
      "path": "/services/influxdb/data",
      "mode": "0700",
      "owner": "1000:1000"
    },
    {
      "id": "config",
      "type": "directory",
      "path": "/services/influxdb/config",
      "mode": "0700",
      "owner": "1000:1000"
    },
    {
      "id": "grants",
      "type": "directory",
      "mode": "0700"
    },
    {
      "id": "server-env",
      "type": "file",
      "path": "${dir:state}/server.env",
      "mode": "0600",
      "content": "DOCKER_INFLUXDB_INIT_MODE=setup\nDOCKER_INFLUXDB_INIT_USERNAME=admin\nDOCKER_INFLUXDB_INIT_PASSWORD_FILE=/run/secrets/admin\nDOCKER_INFLUXDB_INIT_ADMIN_TOKEN_FILE=/run/secrets/admin-token\nDOCKER_INFLUXDB_INIT_ORG=mesh\nDOCKER_INFLUXDB_INIT_BUCKET=default\n"
    },
    {
      "id": "server",
      "type": "container",
      "name": "influxdb",
      "image": "influxdb@sha256:f75e48af0598e8aec7986e991a848d19a119101a7d563a2e5db1dfaac9c45daa",
      "env-file": [
-        "/var/lib/influxdb-module/server.env"
+        "${dir:state}/server.env"
      ],
      "ports": [
        "8086"
      ],
      "volumes": [
-        "/services/influxdb/data:/var/lib/influxdb2",
+        "${dir:data}:/var/lib/influxdb2",
-        "/services/influxdb/config:/etc/influxdb2"
+        "${dir:config}:/etc/influxdb2",
-      ],
+        "${dir:state}/admin.secret:/run/secrets/admin:ro",
-      "secrets-in-environment": "the image honours DOCKER_INFLUXDB_INIT_PASSWORD_FILE and _ADMIN_TOKEN_FILE; convertible, awaiting a bed that proves it"
+        "${dir:state}/admin-token.secret:/run/secrets/admin-token:ro"
      ]
    },
    {
      "id": "runtime-config",
@@ -82,13 +107,15 @@
      "volumes": [
        "/var/lib/mesh/influxdb/broker:/run/secrets/broker:ro",
        "/var/lib/mesh/influxdb/config.json:/run/config/config.json:ro",
-        "/services/influxdb/config:/var/lib/influxdb/config:ro"
+        "${dir:state}/admin-token.secret:/run/secrets/admin-token:ro",
        "${dir:grants}:${dir:grants}:ro"
      ],
      "env": {
        "MESH_BROKER_FILE": "/run/secrets/broker",
-        "MESH_INFLUXDB_URL": "http://127.0.0.1:8086",
+        "MESH_INFLUXDB_URL": "http://127.0.0.1:${port:8086}",
        "MESH_INFLUXDB_CONFIG_FILE": "/run/config/config.json",
-        "MESH_INFLUXDB_CONFIG_DIR": "/var/lib/influxdb/config"
+        "MESH_INFLUXDB_TOKEN_FILE": "/run/secrets/admin-token",
        "MESH_RECEIVES": "${dir:grants}/mesh.json"
      },
      "restart-on": [
        "runtime-config"
@@ -96,6 +123,22 @@
      "artifact": "runtime"
    }
  ],
  "requires": [
    "route",
    "secret"
  ],
  "contributes": {
    "route": {
      "label": "influxdb",
      "endpoint": "api"
    }
  },
  "secrets": {
    "secret": {
      "admin": "${dir:state}/admin.secret",
      "admin-token": "${dir:state}/admin-token.secret"
    }
  },
  "build": {
    "on": [
      {
@@ -116,14 +159,5 @@
        "from": "Dockerfile"
      }
    ]
  },
  "requires": [
    "secret"
  ],
  "secrets": {
    "secret": {
      "admin": "/var/lib/influxdb-module/admin.secret",
      "admin-token": "/var/lib/influxdb-module/admin-token.secret"
    }
  }
 }
@@ -1,9 +1,14 @@
 {
  "name": "@novox/module-influxdb",
  "version": "0.1.0",
-  "description": "influxdb — time-series database. Its API client and tools live here (novox/hq ADR 0039).",
+  "description": "influxdb — time-series database; provides the mesh influxdb-api interface. Its API client, provisioner and tools live here (novox/hq ADR 0039).",
  "type": "module",
  "private": true,
  "scripts": {
    "build": "tsc client.ts grants.ts provisioner/index.ts tools/index.ts --module NodeNext --moduleResolution NodeNext --target ES2022 --outDir dist",
    "typecheck": "tsc -p tsconfig.json",
    "test": "npm run build && node --test --experimental-strip-types 'test/*.test.ts'"
  },
  "dependencies": {
    "@novox/mesh-sdk": "^0.1.0"
  },
@@ -0,0 +1,54 @@
 // influxdb's provisioner — the adapter that makes influxdb a provider of the mesh `influxdb-api`
 // interface. The reconcile loop, the contributions file and reading the mesh's minted secret are the
 // sdk harness's; this writes only the per-service half: how InfluxDB creates, checks and removes a
 // consumer's credential (novox/hq ADR 0039/0040/0048). What that credential is, and why it is a v1
 // authorization, is in ../grants.ts.
 //
 // The `influxdb-api` interface: a consumer reaches `${bound:influxdb-api:scheme}://…:at:…:port`,
 // signs in as `${bound:influxdb-api:as}` with the password the mesh minted for the pair, and reads
 // or writes the org's buckets as databases of the same name — `${bound:influxdb-api:bucket}` being
 // the one this instance serves by default. The org and the default bucket are the assignment's
 // settings, which reach both what is served and this module's config.json, so the org a consumer is
 // told and the org its credential is made in cannot disagree.
 import { runProvisioner, type Provision } from "@novox/mesh-sdk/provisioner";
 import { InfluxDBClient } from "../client.js";
 import { ApiGrants } from "../grants.js";
 let grants: ApiGrants | undefined;
 try {
  const influx = InfluxDBClient.fromEnv();
  grants = new ApiGrants(influx, influx.org);
 } catch (err) {
  // No admin token: nothing can be provisioned, and the tools loaded beside this must still serve.
  console.error(`[provisioner:influxdb-api] not started: ${err instanceof Error ? err.message : err}`);
 }
 if (grants) serve(grants);
 function serve(grants: ApiGrants): void {
  runProvisioner("influxdb-api", {
    async create(p: Provision): Promise<void> {
      const done = await grants.ensure(p);
      if (done !== "unchanged") {
        console.log(`[provisioner:influxdb-api] ${done} v1 authorization ${p.as} in org ${grants.org}`);
      }
    },
    async remove(p: { as: string }): Promise<void> {
      const done = await grants.remove(p.as);
      if (done === "not ours") {
        console.error(`[provisioner:influxdb-api] ${p.as}: an authorization of that name exists that the mesh did not make — left alone`);
      } else if (done === "removed") {
        console.log(`[provisioner:influxdb-api] removed v1 authorization ${p.as}; its buckets and their data stay`);
      }
    },
    // Asked every minute by the harness: whether InfluxDB still holds this consumer's authorization
    // exactly as the mesh gave it, so one deleted, disabled or re-passworded behind the mesh's back is
    // made whole again (hq issue 120).
    async holds(p: Provision): Promise<boolean> {
      return grants.holds(p);
    },
  });
 }
@@ -0,0 +1,246 @@
 // What holds influxdb to the `influxdb-api` provision (grants.ts): one v1 authorization per consumer,
 // under the username and password the mesh gave, allowed only what the consumer contributed; made
 // once and brought back on every apply; buckets created when missing and never deleted; and an
 // authorization the mesh did not make — same name or not — never adopted, changed or deleted.
 //
 // InfluxDB is a fake: the routes the module touches, answering with the status codes and shapes
 // InfluxDB 2.9 gives (a filter matching nothing is a 404, a password outside 8–72 characters a 400,
 // an inactive authorization or a wrong password a 401 on /query). Run against the compiled module
 // (npm test builds first), the way the runtime loads it.
 import { test, after, beforeEach } from "node:test";
 import assert from "node:assert/strict";
 import { createServer, type IncomingMessage, type ServerResponse } from "node:http";
 import { InfluxDBClient } from "../dist/client.js";
 import { ApiGrants, MARK, askedFor, marked } from "../dist/grants.js";
 type Rec = Record<string, any>;
 const ADMIN = "operator-token";
 const orgs = new Map<string, string>([["zurag", "org1"]]);
 let buckets: Rec[] = [];
 let auths: Rec[] = [];
 let calls: string[] = [];
 let seq = 0;
 function body(req: IncomingMessage): Promise<any> {
  return new Promise((resolve) => {
    let raw = "";
    req.on("data", (c) => (raw += c));
    req.on("end", () => resolve(raw ? JSON.parse(raw) : undefined));
  });
 }
 function send(res: ServerResponse, status: number, value?: unknown): void {
  res.writeHead(status, { "Content-Type": "application/json" });
  res.end(value === undefined ? "" : JSON.stringify(value));
 }
 const server = createServer(async (req, res) => {
  const url = new URL(req.url!, "http://fake");
  const p = url.pathname;
  calls.push(`${req.method} ${p}`);
  if (p === "/query") {
    const basic = (req.headers.authorization ?? "").replace(/^Basic /, "");
    const [u, pw] = Buffer.from(basic, "base64").toString().split(":");
    const a = auths.find((x) => x.token === u);
    if (!a || a.status !== "active" || a.password === undefined || a.password !== pw) {
      return send(res, 401, { code: "unauthorized", message: "Unauthorized" });
    }
    return send(res, 200, { results: [{ statement_id: 0 }] });
  }
  if (req.headers.authorization !== `Token ${ADMIN}`) return send(res, 401, { code: "unauthorized" });
  if (p === "/api/v2/orgs") {
    const id = orgs.get(url.searchParams.get("org") ?? "");
    if (!id) return send(res, 404, { code: "not found", message: "organization name not found" });
    return send(res, 200, { orgs: [{ id, name: url.searchParams.get("org") }] });
  }
  if (p === "/api/v2/buckets" && req.method === "GET") {
    const found = buckets.filter((b) => b.orgID === url.searchParams.get("orgID") && b.name === url.searchParams.get("name"));
    if (found.length === 0) return send(res, 404, { code: "not found", message: "bucket not found" });
    return send(res, 200, { buckets: found });
  }
  if (p === "/api/v2/buckets" && req.method === "POST") {
    const b = { ...(await body(req)), id: `b${++seq}` };
    buckets.push(b);
    return send(res, 201, b);
  }
  if (p === "/private/legacy/authorizations" && req.method === "GET") {
    const found = auths.filter((a) => a.token === url.searchParams.get("token"));
    if (found.length === 0) return send(res, 404, { code: "not found", message: "authorization not found" });
    // Never answers with the password: InfluxDB keeps only its hash.
    return send(res, 200, { authorizations: found.map(({ password, ...a }) => ({ ...a, links: {} })) });
  }
  if (p === "/private/legacy/authorizations" && req.method === "POST") {
    const a = await body(req);
    if (auths.some((x) => x.token === a.token)) return send(res, 409, { code: "conflict", message: "token already exists" });
    const made = { ...a, id: `a${++seq}`, status: a.status ?? "active" };
    auths.push(made);
    return send(res, 201, made);
  }
  const m = /^\/private\/legacy\/authorizations\/([^/]+)(\/password)?$/.exec(p);
  const a = m && auths.find((x) => x.id === m[1]);
  if (!a) return send(res, 404, { code: "not found" });
  if (m![2] && req.method === "POST") {
    const { password } = await body(req);
    if (typeof password !== "string" || password.length < 8 || password.length > 72) {
      return send(res, 400, { code: "invalid", message: "passwords must be between 8 and 72 characters long" });
    }
    a.password = password;
    return send(res, 204);
  }
  if (req.method === "PATCH") {
    Object.assign(a, await body(req));
    return send(res, 200, a);
  }
  if (req.method === "DELETE") {
    auths = auths.filter((x) => x !== a);
    return send(res, 204);
  }
  send(res, 405);
 });
 await new Promise<void>((r) => server.listen(0, "127.0.0.1", r));
 after(() => server.close());
 const port = (server.address() as { port: number }).port;
 const grants = new ApiGrants(new InfluxDBClient(`http://127.0.0.1:${port}`, ADMIN, "zurag"), "zurag");
 const PW = "mesh-minted-password-of-forty-characters";
 /** Grafana on ace, as the mesh hands it to the provisioner. */
 function grafana(password = PW, values: Record<string, unknown> = { access: "read" }) {
  return { as: "mesh_ace_grafana", password, consumer: "ace", values };
 }
 /** Node-RED on ace: writes one bucket. */
 function nodered(password = PW, values: Record<string, unknown> = { access: "write", buckets: ["zurag"] }) {
  return { as: "mesh_ace_nodered", password, consumer: "ace", values };
 }
 function only(token: string): Rec {
  const found = auths.filter((a) => a.token === token);
  assert.equal(found.length, 1, `exactly one authorization ${token}, found ${found.length}`);
  return found[0];
 }
 function perms(a: Rec): string[] {
  return a.permissions.map((p: Rec) => `${p.action}:${p.resource.type}:${p.resource.id ?? "*"}`).sort();
 }
 beforeEach(() => {
  buckets = [{ id: "zb", orgID: "org1", name: "zurag" }];
  auths = [];
  calls = [];
 });
 test("what a contribution may ask for, and what is refused", () => {
  assert.deepEqual(askedFor({}), { access: "read", buckets: [] });
  assert.deepEqual(askedFor({ access: "read-write", buckets: ["b", "a", "a"] }), { access: "read-write", buckets: ["a", "b"] });
  assert.throws(() => askedFor({ access: "admin" }), /access/);
  assert.throws(() => askedFor({ access: "write" }), /names no bucket/);
  assert.throws(() => askedFor({ buckets: "zurag" }), /list of bucket names/);
  assert.throws(() => askedFor({ access: "write", buckets: ["_monitoring"] }), /system bucket/);
 });
 test("a reader is given one authorization, reading every bucket of the org, under the mesh's password", async () => {
  assert.equal(await grants.ensure(grafana()), "created");
  const a = only("mesh_ace_grafana");
  assert.equal(a.orgID, "org1");
  assert.equal(a.status, "active");
  assert.ok(a.description.startsWith(MARK));
  assert.deepEqual(perms(a), ["read:buckets:*"]);
  assert.equal(a.password, PW);
  assert.equal(await grants.holds(grafana()), true);
 });
 test("a writer is allowed its own buckets only, and a missing one is made — never deleted", async () => {
  assert.equal(await grants.ensure(nodered(PW, { access: "write", buckets: ["zurag", "printer"] })), "created");
  const made = buckets.find((b) => b.name === "printer");
  assert.ok(made, "the missing bucket was created");
  assert.deepEqual(made!.retentionRules, [], "kept for ever: retention is the operator's choice");
  assert.deepEqual(perms(only("mesh_ace_nodered")), [`write:buckets:${made!.id}`, "write:buckets:zb"]);
  assert.equal(await grants.remove("mesh_ace_nodered"), "removed");
  assert.equal(buckets.length, 2, "withdrawing the consumer leaves every bucket and its data");
 });
 test("applying the same grant again writes nothing", async () => {
  await grants.ensure(grafana());
  calls = [];
  assert.equal(await grants.ensure(grafana()), "unchanged");
  assert.ok(calls.every((c) => c.startsWith("GET")), `only reads: ${calls.join(", ")}`);
  only("mesh_ace_grafana");
 });
 test("a rotated password is set in place; a changed access remakes only the mesh's own", async () => {
  await grants.ensure(nodered());
  const id = only("mesh_ace_nodered").id;
  assert.equal(await grants.holds(nodered("rotated-password-0123456789")), false);
  assert.equal(await grants.ensure(nodered("rotated-password-0123456789")), "updated");
  assert.equal(only("mesh_ace_nodered").id, id, "updated, not replaced");
  assert.equal(await grants.holds(nodered("rotated-password-0123456789")), true);
  await grants.ensure(nodered(PW, { access: "read-write", buckets: ["zurag"] }));
  assert.deepEqual(perms(only("mesh_ace_nodered")), ["read:buckets:zb", "write:buckets:zb"]);
  assert.equal(await grants.holds(nodered(PW, { access: "read-write", buckets: ["zurag"] })), true);
 });
 test("an authorization disabled, re-passworded or deleted behind the mesh's back is not held, and is made whole", async () => {
  await grants.ensure(grafana());
  only("mesh_ace_grafana").status = "inactive";
  assert.equal(await grants.holds(grafana()), false);
  assert.equal(await grants.ensure(grafana()), "updated");
  assert.equal(await grants.holds(grafana()), true);
  only("mesh_ace_grafana").password = "somebody-else-set-this";
  assert.equal(await grants.holds(grafana()), false);
  await grants.ensure(grafana());
  assert.equal(await grants.holds(grafana()), true);
  auths = [];
  assert.equal(await grants.holds(grafana()), false);
  assert.equal(await grants.ensure(grafana()), "created");
 });
 test("holds only reads, and a bucket gone missing is not held rather than made", async () => {
  await grants.ensure(nodered());
  buckets = [];
  calls = [];
  assert.equal(await grants.holds(nodered()), false);
  assert.ok(calls.every((c) => c.startsWith("GET")), `only reads: ${calls.join(", ")}`);
  assert.equal(buckets.length, 0);
 });
 test("an authorization of the same name the mesh did not make is refused, and left exactly as it was", async () => {
  auths = [{ id: "theirs", token: "mesh_ace_grafana", orgID: "org1", status: "active", description: "hand-made",
    permissions: [{ action: "write", resource: { type: "buckets", orgID: "org1" } }], password: "their-password" }];
  const before = JSON.stringify(auths);
  await assert.rejects(grants.ensure(grafana()), /did not make/);
  assert.equal(JSON.stringify(auths), before);
  assert.ok(calls.every((c) => c.startsWith("GET")), `only reads: ${calls.join(", ")}`);
  assert.equal(await grants.holds(grafana()), false);
  assert.equal(await grants.remove("mesh_ace_grafana"), "not ours");
  assert.equal(auths.length, 1, "never deleted");
 });
 test("the predecessor's own v1 users and tokens are never touched", async () => {
  auths = [{ id: "hal", token: "grafana", orgID: "org1", status: "active", description: "",
    permissions: [{ action: "read", resource: { type: "buckets", orgID: "org1" } }], password: "old-password" }];
  await grants.ensure(grafana());
  assert.equal(auths.find((a) => a.id === "hal")!.password, "old-password");
  assert.equal(await grants.remove("grafana"), "not ours");
  assert.equal(marked({ token: "grafana", description: `${MARK} x` }), false, "the mark needs the mesh's name too");
 });
 test("an org the instance does not have, or a non-mesh name, makes nothing", async () => {
  const elsewhere = new ApiGrants(new InfluxDBClient(`http://127.0.0.1:${port}`, ADMIN, "nope"), "nope");
  await assert.rejects(elsewhere.ensure(grafana()), /no org "nope"/);
  await assert.rejects(grants.ensure({ ...grafana(), as: "grafana" }), /not a mesh identity/);
  assert.equal(auths.length, 0);
 });
 test("a withdrawn consumer's authorization is removed, and an absent one is not an error", async () => {
  await grants.ensure(grafana());
  assert.equal(await grants.remove("mesh_ace_grafana"), "removed");
  assert.equal(auths.length, 0);
  assert.equal(await grants.remove("mesh_ace_grafana"), "absent");
 });
@@ -8,5 +8,10 @@
    "skipLibCheck": true,
    "noEmit": true
  },
-  "include": ["client.ts", "tools/index.ts"]
+  "include": [
    "client.ts",
    "grants.ts",
    "provisioner/index.ts",
    "tools/index.ts"
  ]
 }
@@ -17,11 +17,11 @@
    "route": {
      "site": {
        "label": "invoicing",
-        "port": 80
+        "endpoint": "web"
      },
      "api": {
        "label": "invoicing-api",
-        "port": 9000
+        "endpoint": "api"
      }
    }
  },
@@ -36,12 +36,14 @@
  },
  "listens": [
    {
      "name": "web",
      "port": 80,
      "protocol": "tcp",
      "from": "mesh",
      "why": "the invoicing web frontend; a public name is a route grant later"
    },
    {
      "name": "api",
      "port": 9000,
      "protocol": "tcp",
      "from": "mesh",
@@ -6,6 +6,7 @@
  ],
  "listens": [
    {
      "name": "web",
      "port": 9117,
      "protocol": "tcp",
      "from": "mesh",
@@ -82,7 +83,7 @@
  "contributes": {
    "route": {
      "label": "indexers",
-      "port": 9117
+      "endpoint": "web"
    }
  },
  "binds": {
@@ -17,7 +17,7 @@ FROM ${BUILD_BASE} AS build
 # resolved away.
 WORKDIR /app/modules/keycloak
 COPY . .
-RUN node /app/node_modules/typescript/bin/tsc client.ts index.ts tools/index.ts \
+RUN node /app/node_modules/typescript/bin/tsc client.ts oidc.ts index.ts provisioner/index.ts tools/index.ts \
      --module NodeNext --moduleResolution NodeNext --target ES2022 --outDir dist
 FROM ${RUNTIME_BASE}
@@ -27,4 +27,4 @@ COPY --from=build /app/modules/keycloak/dist /app/modules/keycloak/dist
 # the convention novox/hq issues 060/061 settled. A container that instead ran only its
 # provisioner (`run`) served no tools and emitted no events; a container that named no command
 # ran no provisioner at all.
-ENV MESH_TOOL_MODULES=/app/modules/keycloak/dist/index.js,/app/modules/keycloak/dist/tools/index.js
+ENV MESH_TOOL_MODULES=/app/modules/keycloak/dist/index.js,/app/modules/keycloak/dist/tools/index.js,/app/modules/keycloak/dist/provisioner/index.js
@@ -12,6 +12,45 @@ function meshConfig(file?: string): Record<string, string> {
  catch { return {}; }
 }
 /** A secret file's value, trailing newline trimmed; undefined when unset or unreadable. */
 function secretFile(file?: string): string | undefined {
  if (!file) return undefined;
  try { return readFileSync(file, "utf8").replace(/\n$/, "") || undefined; }
  catch { return undefined; }
 }
 /** A client as the admin API represents it — only the fields this module reads or writes are typed;
 *  the rest travel through untouched, so an update never drops what somebody else set. */
 export interface ClientRepresentation {
  id?: string;
  clientId: string;
  name?: string;
  enabled?: boolean;
  protocol?: string;
  publicClient?: boolean;
  clientAuthenticatorType?: string;
  secret?: string;
  rootUrl?: string;
  baseUrl?: string;
  redirectUris?: string[];
  webOrigins?: string[];
  standardFlowEnabled?: boolean;
  implicitFlowEnabled?: boolean;
  directAccessGrantsEnabled?: boolean;
  serviceAccountsEnabled?: boolean;
  attributes?: Record<string, string>;
  protocolMappers?: ProtocolMapperRepresentation[];
  [other: string]: unknown;
 }
 export interface ProtocolMapperRepresentation {
  id?: string;
  name: string;
  protocol: string;
  protocolMapper: string;
  config: Record<string, string>;
 }
 export class KeycloakClient {
  readonly baseUrl: string;
  readonly defaultRealm: string;
@@ -40,8 +79,13 @@ export class KeycloakClient {
    const cfg = meshConfig(env.MESH_KEYCLOAK_CONFIG_FILE);
    const url = cfg.url ?? env.MESH_KEYCLOAK_URL ?? `http://127.0.0.1:${env.KEYCLOAK_PORT ?? "8080"}`;
    const adminUser = cfg.user ?? env.MESH_KEYCLOAK_ADMIN ?? env.KEYCLOAK_ADMIN ?? "admin";
-    const adminPass = cfg.password ?? env.MESH_KEYCLOAK_PASSWORD ?? env.KEYCLOAK_ADMIN_PASSWORD;
+    // The admin password reaches the runtime as a file (novox/hq ADR 0086): the module's own `admin`
-    if (!adminPass) throw new Error("no Keycloak admin password — set MESH_KEYCLOAK_PASSWORD");
+    // secret, mounted read-only. The environment forms stay for a co-located server that has them.
    const adminPass = cfg.password ?? secretFile(env.MESH_KEYCLOAK_PASSWORD_FILE)
      ?? env.MESH_KEYCLOAK_PASSWORD ?? env.KEYCLOAK_ADMIN_PASSWORD;
    if (!adminPass) {
      throw new Error("no Keycloak admin password — set MESH_KEYCLOAK_PASSWORD_FILE (or MESH_KEYCLOAK_PASSWORD)");
    }
    const realm = cfg.realm ?? env.MESH_KEYCLOAK_REALM ?? "master";
    return new KeycloakClient(url, adminUser, adminPass, realm);
  }
@@ -159,6 +203,50 @@ export class KeycloakClient {
    return client.id as string;
  }
  /** The one client with exactly this clientId, or undefined. The admin API's `clientId` filter is an
   *  exact match unless `search=true` is asked for. */
  async findClient(realm: string, clientId: string): Promise<ClientRepresentation | undefined> {
    const found = await this.request<ClientRepresentation[]>(
      `/${realm}/clients?clientId=${encodeURIComponent(clientId)}`);
    return found.find((c) => c.clientId === clientId);
  }
  async createClientFrom(realm: string, rep: ClientRepresentation): Promise<void> {
    await this.request(`/${realm}/clients`, { method: "POST", body: JSON.stringify(rep) });
  }
  /** Replace a client's representation, addressed by its internal id. */
  async updateClient(realm: string, id: string, rep: ClientRepresentation): Promise<void> {
    await this.request(`/${realm}/clients/${id}`, { method: "PUT", body: JSON.stringify(rep) });
  }
  async deleteClientById(realm: string, id: string): Promise<void> {
    await this.request(`/${realm}/clients/${id}`, { method: "DELETE" });
  }
  async clientSecretById(realm: string, id: string): Promise<string | undefined> {
    const result = await this.request<{ value?: string }>(`/${realm}/clients/${id}/client-secret`);
    return result.value;
  }
  async listClientMappers(realm: string, id: string): Promise<ProtocolMapperRepresentation[]> {
    return this.request(`/${realm}/clients/${id}/protocol-mappers/models`);
  }
  async addClientMapper(realm: string, id: string, mapper: ProtocolMapperRepresentation): Promise<void> {
    await this.request(`/${realm}/clients/${id}/protocol-mappers/models`, {
      method: "POST",
      body: JSON.stringify(mapper),
    });
  }
  async updateClientMapper(realm: string, id: string, mapper: ProtocolMapperRepresentation): Promise<void> {
    await this.request(`/${realm}/clients/${id}/protocol-mappers/models/${mapper.id}`, {
      method: "PUT",
      body: JSON.stringify(mapper),
    });
  }
  async deleteClient(realm: string, clientId: string): Promise<void> {
    await this.request(`/${realm}/clients/${await this.resolveClientId(realm, clientId)}`, { method: "DELETE" });
  }
@@ -1,6 +1,12 @@
 {
  "module": "keycloak",
  "version": "1",
  "provides": [
    {
      "name": "oidc-client",
      "scope": "mesh"
    }
  ],
  "requires": [
    "postgres-database",
    "route"
@@ -11,7 +17,7 @@
    },
    "route": {
      "label": "keycloak",
-      "port": 8080
+      "endpoint": "web"
    }
  },
  "binds": {
@@ -34,12 +40,26 @@
  ],
  "listens": [
    {
      "name": "web",
      "port": 8080,
      "protocol": "tcp",
      "from": "mesh",
      "why": "anything the mesh runs that authenticates a person"
    }
  ],
  "serves": {
    "oidc-client": {
      "authorization-path": "/protocol/openid-connect/auth",
      "token-path": "/protocol/openid-connect/token",
      "userinfo-path": "/protocol/openid-connect/userinfo"
    }
  },
  "receives": {
    "oidc-client": "/var/lib/keycloak/grants/mesh.json"
  },
  "grants": {
    "oidc-client": "/var/lib/keycloak/grants"
  },
  "own-secrets": {
    "admin": "/var/lib/keycloak/admin.secret",
    "broker": "/var/lib/mesh/keycloak/broker"
@@ -57,6 +77,12 @@
      "path": "/var/lib/keycloak",
      "mode": "0700"
    },
    {
      "id": "grants",
      "type": "directory",
      "path": "/var/lib/keycloak/grants",
      "mode": "0700"
    },
    {
      "id": "admin-env",
      "type": "file",
@@ -76,6 +102,13 @@
      "type": "network",
      "name": "keycloak"
    },
    {
      "id": "hostname",
      "type": "file",
      "path": "/var/lib/keycloak/hostname.env",
      "mode": "0644",
      "content": "KC_HOSTNAME=https://${bound:route:name}\n"
    },
    {
      "id": "server",
      "type": "container",
@@ -89,17 +122,20 @@
        "KC_DB": "postgres",
        "KC_HTTP_ENABLED": "true",
        "KC_HEALTH_ENABLED": "true",
        "KC_HOSTNAME": "https://keycloak.novox.be",
        "KC_PROXY_HEADERS": "xforwarded"
      },
      "env-file": [
        "/var/lib/keycloak/admin.env",
-        "/var/lib/keycloak/database.env"
+        "/var/lib/keycloak/database.env",
        "/var/lib/keycloak/hostname.env"
      ],
      "ports": [
        "8080"
      ],
-      "secrets-in-environment": "KC_DB_PASSWORD is convertible through a generated keycloak.conf (db-password=); KEYCLOAK_ADMIN_PASSWORD is env-only before Keycloak 26; not yet converted"
+      "secrets-in-environment": "KC_DB_PASSWORD is convertible through a generated keycloak.conf (db-password=); KEYCLOAK_ADMIN_PASSWORD is env-only before Keycloak 26; not yet converted",
      "restart-on": [
        "hostname"
      ]
    },
    {
      "id": "runtime-config",
@@ -116,12 +152,16 @@
      "network": "host",
      "volumes": [
        "/var/lib/mesh/keycloak/broker:/run/secrets/broker:ro",
-        "/var/lib/mesh/keycloak/config.json:/run/config/config.json:ro"
+        "/var/lib/mesh/keycloak/config.json:/run/config/config.json:ro",
        "/var/lib/keycloak/admin.secret:/run/secrets/admin:ro",
        "/var/lib/keycloak/grants:/var/lib/keycloak/grants:ro"
      ],
      "env": {
        "MESH_BROKER_FILE": "/run/secrets/broker",
        "MESH_KEYCLOAK_URL": "http://127.0.0.1:${port:8080}",
-        "MESH_KEYCLOAK_CONFIG_FILE": "/run/config/config.json"
+        "MESH_KEYCLOAK_CONFIG_FILE": "/run/config/config.json",
        "MESH_KEYCLOAK_PASSWORD_FILE": "/run/secrets/admin",
        "MESH_RECEIVES": "/var/lib/keycloak/grants/mesh.json"
      },
      "restart-on": [
        "runtime-config"
@@ -0,0 +1,185 @@
 // What the `oidc-client` provision means in Keycloak: one confidential OpenID Connect client per
 // consumer, in the realm this module serves, under the name and secret the mesh gave both ends.
 // The provisioner (provisioner/index.ts) is the sdk harness calling these; they are here, apart from
 // it, so they can be exercised against a fake admin API without a broker or a contributions file.
 //
 // **The client id and the secret are the mesh's, not Keycloak's (novox/hq ADR 0048).** The mesh
 // derives the consumer's identity (`as`, e.g. `mesh_ace_grafana`) and hands it to both ends — the
 // consumer names it as its client id through `${bound:oidc-client:as}` — and mints the secret, which
 // this sets as the client's secret. Keycloak generates neither.
 //
 // **Where the consumer's browser comes back to is the consumer's to say.** Its contribution carries
 // `callback` (a path, e.g. `/login/generic_oauth`) and the `label`/`endpoint` of the endpoint it is
 // reached on; the mesh composes that endpoint's names into `name` (public) and `internal-name`
 // (private network) exactly as it does for a route (novox/hq ADR 0056, 0138), so the redirect URI
 // registered here is built from the same names the proxy serves the consumer under.
 //
 // **Only what the mesh made is touched.** A client this module creates carries the attribute
 // `mesh.provisioned=true`, and its id starts with the mesh's own prefix. A client with the same id
 // that lacks the mark is somebody else's: it is refused, never adopted, never updated, never deleted.
 import type { ClientRepresentation, KeycloakClient, ProtocolMapperRepresentation } from "./client.js";
 /** The attribute marking a client as the mesh's own work. */
 export const MARK = "mesh.provisioned";
 /** The mapper every mesh client carries: realm roles as a flat `roles` claim in the id token, the
 *  access token and userinfo — what a consumer maps its own roles from (grafana's role path reads
 *  `roles[*]`), and what the predecessor added to its hand-made clients by hand. */
 export const ROLES_MAPPER: ProtocolMapperRepresentation = {
  name: "realm roles",
  protocol: "openid-connect",
  protocolMapper: "oidc-usermodel-realm-role-mapper",
  config: {
    "claim.name": "roles",
    "jsonType.label": "String",
    multivalued: "true",
    "id.token.claim": "true",
    "access.token.claim": "true",
    "userinfo.token.claim": "true",
  },
 };
 /** One consumer, as the harness hands it over. */
 export interface OidcGrant {
  readonly as: string;
  readonly password: string;
  readonly values: Readonly<Record<string, unknown>>;
  readonly consumer?: string;
 }
 /** The realm named by an issuer URL — `https://id.example/realms/Novox` is realm `Novox`. The issuer is
 *  the one value an assignment sets (it is also what consumers are served), so the realm is read
 *  out of it rather than set a second time where the two could disagree. */
 export function realmOf(issuer: string): string {
  let path: string;
  try {
    path = new URL(issuer).pathname;
  } catch {
    throw new Error(`the issuer ${JSON.stringify(issuer)} is not a URL`);
  }
  const m = /\/realms\/([^/]+)\/?$/.exec(path);
  if (!m) throw new Error(`the issuer ${JSON.stringify(issuer)} does not end in /realms/<realm>`);
  return decodeURIComponent(m[1]);
 }
 /** The redirect URIs a consumer's contribution asks for: its callback under each name the mesh
 *  composed for its endpoint. Refused when there is nothing to register — a client that accepts no
 *  redirect is a client nobody can log in through, and one that accepts any is worse. */
 export function redirectsOf(values: Readonly<Record<string, unknown>>): { root: string; redirects: string[] } {
  const callback = values.callback;
  if (typeof callback !== "string" || !callback.startsWith("/")) {
    throw new Error(`contributes no callback path (\`callback\`, starting with "/"): ${JSON.stringify(callback)}`);
  }
  const names: string[] = [];
  for (const key of ["name", "internal-name"]) {
    const n = values[key];
    if (typeof n === "string" && n.trim() !== "" && !names.includes(n.trim())) names.push(n.trim());
  }
  if (names.length === 0) {
    throw new Error("has no name the mesh composed (`name` / `internal-name`) — contribute a `label` and the `endpoint` it is reached on");
  }
  return { root: `https://${names[0]}`, redirects: names.map((n) => `https://${n}${callback}`) };
 }
 /** The fields the mesh owns on a client it made. Everything else on the client is left as found. */
 function wanted(g: OidcGrant): ClientRepresentation {
  const { root, redirects } = redirectsOf(g.values);
  return {
    clientId: g.as,
    name: g.as,
    description: `made by the mesh for ${g.consumer ? `a module on ${g.consumer}` : "a consumer"} — do not edit; it is reset`,
    enabled: true,
    protocol: "openid-connect",
    publicClient: false,
    clientAuthenticatorType: "client-secret",
    secret: g.password,
    rootUrl: root,
    baseUrl: root,
    redirectUris: redirects,
    standardFlowEnabled: true,
    implicitFlowEnabled: false,
    directAccessGrantsEnabled: false,
    serviceAccountsEnabled: false,
  };
 }
 function sameSet(a: readonly string[] | undefined, b: readonly string[]): boolean {
  const x = [...(a ?? [])].sort();
  const y = [...b].sort();
  return x.length === y.length && x.every((v, i) => v === y[i]);
 }
 function marked(c: ClientRepresentation): boolean {
  return c.attributes?.[MARK] === "true";
 }
 export class OidcClients {
  constructor(private readonly kc: KeycloakClient, readonly realm: string) {}
  /** Create the consumer's client, or bring the mesh's existing one back to what the grant says.
   *  Returns whether it was newly created. Idempotent: applying the same grant twice changes nothing
   *  the second time beyond re-asserting it. */
  async ensure(g: OidcGrant): Promise<"created" | "updated"> {
    const want = wanted(g);
    const found = await this.kc.findClient(this.realm, g.as);
    if (found && !marked(found)) {
      throw new Error(
        `realm ${this.realm} already has a client ${g.as} the mesh did not make — left alone; ` +
          `delete or rename it if the mesh should own that id`);
    }
    if (!found) {
      await this.kc.createClientFrom(this.realm, {
        ...want,
        attributes: { [MARK]: "true" },
        protocolMappers: [ROLES_MAPPER],
      });
      return "created";
    }
    // Overlay what the mesh owns on what is there, so a field Keycloak added or an operator set on a
    // field the mesh does not own survives the update.
    await this.kc.updateClient(this.realm, found.id!, {
      ...found,
      ...want,
      attributes: { ...(found.attributes ?? {}), [MARK]: "true" },
    });
    await this.ensureMapper(found.id!);
    return "updated";
  }
  private async ensureMapper(id: string): Promise<void> {
    const mappers = await this.kc.listClientMappers(this.realm, id);
    const have = mappers.find((m) => m.name === ROLES_MAPPER.name);
    if (!have) {
      await this.kc.addClientMapper(this.realm, id, ROLES_MAPPER);
      return;
    }
    const drifted =
      have.protocolMapper !== ROLES_MAPPER.protocolMapper ||
      Object.entries(ROLES_MAPPER.config).some(([k, v]) => have.config?.[k] !== v);
    if (drifted) {
      await this.kc.updateClientMapper(this.realm, id, { ...ROLES_MAPPER, id: have.id });
    }
  }
  /** Whether Keycloak still holds this consumer's client exactly as the grant says: present, the
   *  mesh's, enabled, confidential, with the mesh's secret and the redirects asked for. Reads only. */
  async holds(g: OidcGrant): Promise<boolean> {
    const want = wanted(g);
    const found = await this.kc.findClient(this.realm, g.as);
    if (!found || !marked(found) || found.enabled === false || found.publicClient) return false;
    if (!sameSet(found.redirectUris, want.redirectUris!)) return false;
    const mappers = await this.kc.listClientMappers(this.realm, found.id!);
    if (!mappers.some((m) => m.name === ROLES_MAPPER.name)) return false;
    return (await this.kc.clientSecretById(this.realm, found.id!)) === g.password;
  }
  /** Withdraw a consumer's client — only one the mesh made. Returns what happened, for the log. */
  async remove(as: string): Promise<"removed" | "absent" | "not ours"> {
    const found = await this.kc.findClient(this.realm, as);
    if (!found) return "absent";
    if (!marked(found)) return "not ours";
    await this.kc.deleteClientById(this.realm, found.id!);
    return "removed";
  }
 }
@@ -1,11 +1,15 @@
 {
  "name": "@novox/module-keycloak",
  "version": "0.1.0",
-  "description": "keycloak — identity and access. Its admin API client, tools and events live here (novox/hq ADR 0039).",
+  "description": "keycloak — identity and access; provides the mesh oidc-client interface. Its admin API client, provisioner, tools and events live here (novox/hq ADR 0039).",
  "type": "module",
  "private": true,
  "scripts": {
    "build": "tsc client.ts oidc.ts index.ts provisioner/index.ts tools/index.ts --module NodeNext --moduleResolution NodeNext --target ES2022 --outDir dist",
    "test": "npm run build && node --test --experimental-strip-types 'test/*.test.ts'"
  },
  "dependencies": {
-    "@novox/mesh-sdk": "^0.1.0"
+    "@novox/mesh-sdk": "^0.1.1"
  },
  "devDependencies": {
    "@types/node": "^22.0.0",
@@ -0,0 +1,73 @@
 // keycloak's provisioner — the adapter that makes keycloak a provider of the mesh `oidc-client`
 // interface. The reconcile loop, the contributions file and reading the mesh's minted secret are the
 // sdk harness's; this writes only the per-service half: how Keycloak creates, checks and removes a
 // consumer's client (novox/hq ADR 0039/0040/0048). What a client is, and which ones are the mesh's,
 // is in ../oidc.ts.
 //
 // The `oidc-client` interface: a consumer logs people in through the realm this module serves, as
 // the confidential client `as` with the secret the mesh minted, and is redirected back to the
 // callback it contributed under the names the mesh composed for its endpoint. What it is served —
 // the issuer and the endpoint paths under it — is in the manifest's `serves`, settled with the
 // assignment's settings.
 //
 // **The realm is read out of the issuer**, the one value an assignment sets (settings reach both the
 // served facts and this module's config.json): a realm set in one place and an issuer in another
 // would let the consumer be told one realm while its client is made in another.
 import { runProvisioner, type Provision } from "@novox/mesh-sdk/provisioner";
 import { emit } from "@novox/mesh-sdk/events";
 import { readFileSync } from "node:fs";
 import { KeycloakClient } from "../client.js";
 import { OidcClients, realmOf } from "../oidc.js";
 /** The issuer this assignment serves, from the settings-merged config the mesh delivers. */
 function issuer(): string {
  const file = process.env.MESH_KEYCLOAK_CONFIG_FILE;
  let cfg: Record<string, unknown> = {};
  if (file) {
    try {
      cfg = JSON.parse(readFileSync(file, "utf8")) as Record<string, unknown>;
    } catch {
      // Absent or unreadable: fall through to the environment, and refuse below if that is empty too.
    }
  }
  const said = typeof cfg.issuer === "string" ? cfg.issuer : process.env.MESH_KEYCLOAK_ISSUER;
  if (!said) throw new Error("no issuer — the module's config.json carries none and MESH_KEYCLOAK_ISSUER is unset");
  return said;
 }
 const clients = new OidcClients(KeycloakClient.fromEnv(), realmOf(issuer()));
 /** Emit a lifecycle event without letting a broker hiccup fail the provisioning itself. */
 async function announce(type: string, body: Record<string, string>): Promise<void> {
  try {
    await emit(type, body);
  } catch (err) {
    console.error(`[provisioner:oidc-client] emit ${type} failed: ${err}`);
  }
 }
 runProvisioner("oidc-client", {
  async create(p: Provision): Promise<void> {
    const done = await clients.ensure(p);
    if (done === "created") {
      console.log(`[provisioner:oidc-client] created client ${p.as} in realm ${clients.realm}`);
      await announce("client.created", { realm: clients.realm, clientId: p.as, consumer: p.consumer ?? "" });
    }
  },
  async remove(p: { as: string }): Promise<void> {
    const done = await clients.remove(p.as);
    if (done === "not ours") {
      console.error(`[provisioner:oidc-client] ${p.as}: a client of that id exists that the mesh did not make — left alone`);
    } else if (done === "removed") {
      console.log(`[provisioner:oidc-client] removed client ${p.as} from realm ${clients.realm}`);
    }
  },
  // Asked every minute by the harness: whether Keycloak still holds this consumer's client exactly as
  // the mesh gave it, so a client deleted or edited behind the mesh's back is made again (hq issue 120).
  async holds(p: Provision): Promise<boolean> {
    return clients.holds(p);
  },
 });
@@ -0,0 +1,239 @@
 // What holds keycloak to the `oidc-client` provision (oidc.ts): one confidential client per consumer,
 // under the id and secret the mesh gave, redirecting only to the consumer's own callback under the
 // names the mesh composed; made once and brought back on every apply; and a client the mesh did not
 // make — same id or not — never adopted, changed or deleted.
 //
 // Keycloak is a fake: the admin routes the module touches, answering with the status codes and the
 // shapes Keycloak gives. Run against the compiled module (npm test builds first), the way the runtime
 // loads it.
 import { test, after } from "node:test";
 import assert from "node:assert/strict";
 import { createServer, type IncomingMessage, type ServerResponse } from "node:http";
 import { randomUUID } from "node:crypto";
 import { KeycloakClient } from "../dist/client.js";
 import { MARK, OidcClients, ROLES_MAPPER, realmOf, redirectsOf } from "../dist/oidc.js";
 type Client = Record<string, any>;
 /** The realm's clients, by internal id, and what the fake was asked. */
 const realm = "Novox";
 const clients = new Map<string, Client>();
 const calls: string[] = [];
 function body(req: IncomingMessage): Promise<any> {
  return new Promise((resolve) => {
    let raw = "";
    req.on("data", (c) => (raw += c));
    req.on("end", () => resolve(raw ? JSON.parse(raw) : undefined));
  });
 }
 function send(res: ServerResponse, status: number, value?: unknown): void {
  res.writeHead(status, { "Content-Type": "application/json" });
  res.end(value === undefined ? "" : JSON.stringify(value));
 }
 const server = createServer(async (req, res) => {
  const url = new URL(req.url!, "http://fake");
  calls.push(`${req.method} ${url.pathname}`);
  if (url.pathname === "/realms/master/protocol/openid-connect/token") {
    return send(res, 200, { access_token: "t", expires_in: 300 });
  }
  const base = `/admin/realms/${realm}/clients`;
  if (!url.pathname.startsWith(base)) return send(res, 404, { error: "Realm not found." });
  const rest = url.pathname.slice(base.length).split("/").filter(Boolean);
  if (rest.length === 0 && req.method === "GET") {
    const want = url.searchParams.get("clientId");
    return send(res, 200, [...clients.values()].filter((c) => !want || c.clientId === want));
  }
  if (rest.length === 0 && req.method === "POST") {
    const rep = await body(req);
    if ([...clients.values()].some((c) => c.clientId === rep.clientId)) {
      return send(res, 409, { errorMessage: `Client ${rep.clientId} already exists` });
    }
    const id = randomUUID();
    const mappers = (rep.protocolMappers ?? []).map((m: Client) => ({ ...m, id: randomUUID() }));
    clients.set(id, { ...rep, id, protocolMappers: mappers });
    return send(res, 201);
  }
  const c = clients.get(rest[0]);
  if (!c) return send(res, 404, { error: "Could not find client" });
  if (rest.length === 1 && req.method === "PUT") {
    // Keycloak ignores protocolMappers on a client update: they have their own endpoints.
    const rep = await body(req);
    clients.set(c.id, { ...rep, id: c.id, protocolMappers: c.protocolMappers });
    return send(res, 204);
  }
  if (rest.length === 1 && req.method === "DELETE") {
    clients.delete(c.id);
    return send(res, 204);
  }
  if (rest[1] === "client-secret" && req.method === "GET") {
    return send(res, 200, { type: "secret", value: c.secret });
  }
  if (rest[1] === "protocol-mappers") {
    if (req.method === "GET") return send(res, 200, c.protocolMappers ?? []);
    if (req.method === "POST") {
      c.protocolMappers = [...(c.protocolMappers ?? []), { ...(await body(req)), id: randomUUID() }];
      return send(res, 201);
    }
    if (req.method === "PUT") {
      const m = await body(req);
      c.protocolMappers = c.protocolMappers.map((x: Client) => (x.id === rest[4] ? m : x));
      return send(res, 204);
    }
  }
  send(res, 405);
 });
 await new Promise<void>((r) => server.listen(0, "127.0.0.1", r));
 after(() => server.close());
 const port = (server.address() as { port: number }).port;
 const oidc = new OidcClients(new KeycloakClient(`http://127.0.0.1:${port}`, "admin", "pw"), realm);
 /** Grafana on ace, as the mesh hands it to the provisioner. */
 function grafana(secret = "s3cret", values: Record<string, unknown> = {}) {
  return {
    as: "mesh_ace_grafana",
    password: secret,
    consumer: "ace",
    values: {
      label: "grafana", endpoint: "web", port: 20010, callback: "/login/generic_oauth",
      name: "grafana.zurag.be", "internal-name": "grafana.ace.internal", ...values,
    },
  };
 }
 function only(clientId: string): Client {
  const found = [...clients.values()].filter((c) => c.clientId === clientId);
  assert.equal(found.length, 1, `exactly one client ${clientId}, found ${found.length}`);
  return found[0];
 }
 test("the realm is read out of the issuer, and an issuer that names none is refused", () => {
  assert.equal(realmOf("https://keycloak.novox.be/realms/Novox"), "Novox");
  assert.equal(realmOf("https://keycloak.novox.be/realms/Novox/"), "Novox");
  assert.equal(realmOf("http://127.0.0.1:18500/realms/master"), "master");
  assert.throws(() => realmOf("https://keycloak.novox.be"), /realms/);
  assert.throws(() => realmOf("keycloak"), /not a URL/);
 });
 test("the redirect is the consumer's callback under every name the mesh composed for it", () => {
  assert.deepEqual(redirectsOf(grafana().values), {
    root: "https://grafana.zurag.be",
    redirects: ["https://grafana.zurag.be/login/generic_oauth", "https://grafana.ace.internal/login/generic_oauth"],
  });
  // A route reaching only the private network has only the internal name, and that is enough.
  assert.deepEqual(redirectsOf({ callback: "/cb", "internal-name": "x.ace.internal" }).redirects,
    ["https://x.ace.internal/cb"]);
  assert.throws(() => redirectsOf({ name: "grafana.zurag.be" }), /callback/);
  assert.throws(() => redirectsOf({ name: "grafana.zurag.be", callback: "login" }), /callback/);
  assert.throws(() => redirectsOf({ callback: "/cb" }), /label/);
 });
 test("a consumer is given one confidential client, under its id and the mesh's secret", async () => {
  clients.clear();
  assert.equal(await oidc.ensure(grafana()), "created");
  const c = only("mesh_ace_grafana");
  assert.equal(c.publicClient, false);
  assert.equal(c.clientAuthenticatorType, "client-secret");
  assert.equal(c.secret, "s3cret");
  assert.equal(c.enabled, true);
  assert.equal(c.standardFlowEnabled, true);
  assert.equal(c.directAccessGrantsEnabled, false);
  assert.equal(c.implicitFlowEnabled, false);
  assert.deepEqual(c.redirectUris, [
    "https://grafana.zurag.be/login/generic_oauth", "https://grafana.ace.internal/login/generic_oauth"]);
  assert.equal(c.attributes[MARK], "true");
  assert.deepEqual(c.protocolMappers.map((m: Client) => m.name), [ROLES_MAPPER.name]);
  assert.equal(await oidc.holds(grafana()), true);
 });
 test("applying the same grant again makes no second client", async () => {
  clients.clear();
  await oidc.ensure(grafana());
  assert.equal(await oidc.ensure(grafana()), "updated");
  assert.equal(await oidc.ensure(grafana()), "updated");
  only("mesh_ace_grafana");
  assert.equal(only("mesh_ace_grafana").protocolMappers.length, 1, "the roles mapper is not added twice");
 });
 test("a new secret or a moved name is applied in place, and what the mesh does not own survives", async () => {
  clients.clear();
  await oidc.ensure(grafana());
  const id = only("mesh_ace_grafana").id;
  // Something the mesh does not own, set on the client after it was made.
  clients.get(id)!.consentRequired = true;
  clients.get(id)!.attributes["post.logout.redirect.uris"] = "+";
  assert.equal(await oidc.holds(grafana("rotated")), false, "a rotated secret is not held until applied");
  await oidc.ensure(grafana("rotated", { name: "dash.zurag.be" }));
  const c = only("mesh_ace_grafana");
  assert.equal(c.id, id, "updated, not replaced");
  assert.equal(c.secret, "rotated");
  assert.deepEqual(c.redirectUris, [
    "https://dash.zurag.be/login/generic_oauth", "https://grafana.ace.internal/login/generic_oauth"]);
  assert.equal(c.rootUrl, "https://dash.zurag.be");
  assert.equal(c.consentRequired, true);
  assert.equal(c.attributes["post.logout.redirect.uris"], "+");
  assert.equal(c.attributes[MARK], "true");
  assert.equal(await oidc.holds(grafana("rotated", { name: "dash.zurag.be" })), true);
 });
 test("a client lost or edited behind the mesh's back is not held, and is made whole again", async () => {
  clients.clear();
  await oidc.ensure(grafana());
  const c = only("mesh_ace_grafana");
  c.redirectUris = ["*"];
  assert.equal(await oidc.holds(grafana()), false, "a widened redirect is not what the mesh gave");
  await oidc.ensure(grafana());
  assert.equal(await oidc.holds(grafana()), true);
  only("mesh_ace_grafana").protocolMappers = [];
  assert.equal(await oidc.holds(grafana()), false, "a client without its roles mapper is not held");
  await oidc.ensure(grafana());
  assert.equal(await oidc.holds(grafana()), true);
  clients.clear();
  assert.equal(await oidc.holds(grafana()), false);
 });
 test("a client of the same id the mesh did not make is refused, and left exactly as it was", async () => {
  clients.clear();
  clients.set("theirs", { id: "theirs", clientId: "mesh_ace_grafana", secret: "their-secret", redirectUris: ["*"] });
  const before = JSON.stringify(clients.get("theirs"));
  const writes = calls.length;
  await assert.rejects(oidc.ensure(grafana()), /did not make/);
  assert.equal(JSON.stringify(clients.get("theirs")), before);
  assert.ok(calls.slice(writes).every((c) => c.startsWith("GET") || c.startsWith("POST /realms/master")),
    `only reads were made: ${calls.slice(writes).join(", ")}`);
  assert.equal(await oidc.holds(grafana()), false);
  assert.equal(await oidc.remove("mesh_ace_grafana"), "not ours");
  assert.ok(clients.has("theirs"), "a client the mesh did not make is never deleted");
 });
 test("the predecessor's hand-made client is never touched: the mesh's has its own id", async () => {
  clients.clear();
  clients.set("hal", { id: "hal", clientId: "grafana", secret: "old", redirectUris: ["https://grafana.zurag.be/*"] });
  await oidc.ensure(grafana());
  assert.equal(clients.get("hal")!.secret, "old");
  only("mesh_ace_grafana");
  assert.equal(await oidc.remove("grafana"), "not ours");
  assert.ok(clients.has("hal"));
 });
 test("a withdrawn consumer's client is removed, and an absent one is not an error", async () => {
  clients.clear();
  await oidc.ensure(grafana());
  assert.equal(await oidc.remove("mesh_ace_grafana"), "removed");
  assert.equal([...clients.values()].length, 0);
  assert.equal(await oidc.remove("mesh_ace_grafana"), "absent");
 });
 test("a contribution with no callback makes no client at all", async () => {
  clients.clear();
  await assert.rejects(oidc.ensure({ ...grafana(), values: { name: "grafana.zurag.be" } }), /callback/);
  assert.equal(clients.size, 0);
 });
@@ -8,5 +8,5 @@
    "skipLibCheck": true,
    "noEmit": true
  },
-  "include": ["client.ts", "index.ts", "tools/index.ts"]
+  "include": ["client.ts", "oidc.ts", "index.ts", "provisioner/index.ts", "tools/index.ts"]
 }
@@ -1,42 +0,0 @@
 # lavinmq's runtime: the tool runtime, carrying this module's compiled bootstrap, provisioner,
 # tools and event consumer.
 #
 # **Built from this module's own directory and nothing else.** The sdk is in the base image, so
 # nothing is copied out of a neighbouring checkout — which is what lets the mesh build this from a
 # repository and a path (novox/hq ADR 0069) rather than only on a workstation that happens to have
 # the siblings.
 #
 # Two bases, named rather than pinned: the image this is COMPILED in, and the image it RUNS in.
 # They are different images on purpose — the first carries a compiler and the second must not, or
 # every running container would carry one it never invokes. The mesh answers both with the copies it
 # holds, because a fingerprint written here would name one particular copy and no other mesh has it
 # (novox/hq issue 044). Declared in module.json's `build.on`; deliberately no defaults, so a build
 # nobody told stops here and says which module to build first.
 ARG BUILD_BASE
 ARG RUNTIME_BASE
 FROM ${BUILD_BASE} AS build
 # Compiled under /app/modules so `@novox/mesh-sdk` resolves upward into the base's own
 # node_modules — the module is compiled against exactly the sdk it will run against.
 WORKDIR /app/modules/lavinmq
 COPY . .
 # The compiler is invoked by its real path rather than through node_modules/.bin, whose entries are
 # symlinks to a launcher that requires its library relatively — resolved away when the base image
 # was assembled.
 #
 # Four entrypoints and a client, because this module is four things: a run-once bootstrap that
 # writes the broker's configuration before it first starts, a provisioner that grants consumers
 # their own vhost and user, a set of tools, and an event consumer.
 RUN node /app/node_modules/typescript/bin/tsc \
      client.ts index.ts bootstrap/index.ts provisioner/index.ts tools/index.ts \
      --module NodeNext --moduleResolution NodeNext --target ES2022 --outDir dist
 FROM ${RUNTIME_BASE}
 COPY --from=build /app/modules/lavinmq/dist /app/modules/lavinmq/dist
 # What the runtime loads from this module in serve mode: its event consumer, its tools, and its
 # provisioner — all three in one process, so the provisioner's reconcile loop runs with the broker
 # connected (novox/hq issues 060/061; the provisioner used to be run as a separate container `args`
 # command, which meant it served no tools and, once, ran nowhere at all). The run-once bootstrap is
 # NOT listed here — it is named in its own container's `args`, because it runs to completion before
 # the broker starts rather than serving. One image, because they are one module and share a client.
 ENV MESH_TOOL_MODULES=/app/modules/lavinmq/dist/index.js,/app/modules/lavinmq/dist/tools/index.js,/app/modules/lavinmq/dist/provisioner/index.js
@@ -1,45 +0,0 @@
 // lavinmq's run-once bootstrap — lavinmq's own code (novox/hq ADR 0039), run once before the broker
 // first starts (ADR 0052). lavinmq's default admin is set at first boot from a config file's
 // `default_password_hash`, and that value is a HASH of the mesh-minted admin password, not the
 // password itself — a form the mesh's plain-secret delivery cannot produce and no `${secret:...}`
 // placeholder can compute. So this step computes it: it reads the admin password the mesh minted and
 // the host unsealed, hashes it the way lavinmq expects (see client.rabbitHash), and writes the config
 // file the broker container reads with `--config`. The host runs it to completion and only then
 // starts the broker the manifest places after it — so the broker's first boot finds a config with an
 // admin it can authenticate, and the provisioner (which reaches the management API as that admin)
 // can do its work.
 //
 // It runs in the module's own runtime image, under the module's own account, as `mesh-tools run`
 // imports it — no broker connection, because writing a config file is an offline operation and there
 // is no broker to reach yet.
 //
 // lavinmq consults `default_user`/`default_password_hash` only on a first boot with an empty data
 // dir; a later boot uses the persisted user database and ignores them. So this seeds the admin once,
 // and a rotation of the admin secret does not re-key an already-initialised broker — the same
 // first-boot-only shape the RabbitMQ-compatible default user has always had.
 import { writeFileSync } from "node:fs";
 import { readFileSync } from "node:fs";
 import { rabbitHash } from "../client.js";
 const adminUser = process.env.MESH_PROVISION_ADMIN_USER ?? process.env.MESH_LAVINMQ_ADMIN_USER ?? "mesh-admin";
 const passwordFile = process.env.MESH_PROVISION_PASSWORD_FILE ?? process.env.MESH_LAVINMQ_ADMIN_PASSWORD_FILE ?? "/run/secrets/default";
 const configOut = process.env.MESH_LAVINMQ_CONFIG_OUT ?? "/var/lib/lavinmq-module/lavinmq.ini";
 const dataDir = process.env.MESH_LAVINMQ_DATA_DIR ?? "/var/lib/lavinmq";
 const password = readFileSync(passwordFile, "utf8").replace(/\n$/, "");
 if (!password) {
  throw new Error(`[lavinmq:bootstrap] admin password file ${passwordFile} is empty — cannot seed the admin`);
 }
 // The broker reads only what it needs to authenticate its admin on first boot; bind/ports come from
 // the container's entrypoint (`-b 0.0.0.0`), so this file names the admin and nothing else about the
 // network.
 const ini =
  "[main]\n" +
  `data_dir = ${dataDir}\n` +
  `default_user = ${adminUser}\n` +
  `default_password_hash = ${rabbitHash(password)}\n`;
 writeFileSync(configOut, ini, { mode: 0o600 });
 console.log(`[lavinmq:bootstrap] wrote ${configOut} with admin '${adminUser}' (password hashed for lavinmq)`);
@@ -1,183 +0,0 @@
 // lavinmq's admin client — lavinmq's own code, living in the module (novox/hq ADR 0039). Both this
 // module's tools and its provisioner import it, and nothing outside lavinmq does.
 //
 // It drives lavinmq through its HTTP management API (the RabbitMQ-compatible surface lavinmq serves
 // on 15672), not a hand-rolled AMQP admin stack: the module may take NO npm dependency beyond
 // @novox/mesh-sdk, and the management API is exactly the admin surface — create/remove a vhost, a
 // user, and its permissions — reached with `fetch` (global on node 22) and HTTP Basic auth. One
 // boundary, `api()`, and every method is built on it. This is the module's one impure seam, the way
 // postgres's is `psql` and redis's is a RESP socket.
 //
 // **The login and password are the mesh's, not the provisioner's (novox/hq ADR 0048).** The mesh
 // derives the login and hands it to both ends so they agree, and mints the password and delivers a
 // copy to each. lavinmq creates exactly that user with exactly that password on a vhost of the same
 // name — a name or password the provisioner invented is one the consumer could never present.
 import { createHash, randomBytes } from "node:crypto";
 import { readFileSync } from "node:fs";
 export interface LavinmqConn {
  /** Base URL of the management API, e.g. http://lavinmq:15672 (no trailing /api). */
  readonly base: string;
  readonly adminUser: string;
  readonly adminPassword: string;
 }
 export class LavinmqClient {
  constructor(private readonly conn: LavinmqConn) {}
  /**
   * Build from the module's resolved environment. Reads MESH_LAVINMQ_* first (the documented
   * names), falling back to the MESH_PROVISION_* keys the manifest already sets on the provisioner
   * container so the module runs unchanged there. Throws if it cannot find a management endpoint and
   * an admin password — the right failure, because without them nothing it does can work.
   */
  static fromEnv(env: NodeJS.ProcessEnv = process.env): LavinmqClient {
    const base = (env.MESH_LAVINMQ_MANAGEMENT ?? env.MESH_PROVISION_LAVINMQ ?? "").replace(/\/+$/, "");
    const adminUser = env.MESH_LAVINMQ_ADMIN_USER ?? env.MESH_PROVISION_ADMIN_USER ?? "mesh-admin";
    const adminPassword = env.MESH_LAVINMQ_ADMIN_PASSWORD ?? readSecretFile(env.MESH_PROVISION_PASSWORD_FILE);
    if (!base || !adminPassword) {
      throw new Error("lavinmq management endpoint or admin password is not set — lavinmq's own code cannot reach the server");
    }
    return new LavinmqClient({ base, adminUser, adminPassword });
  }
  /** One request against the management API. A non-2xx reply rejects, carrying the body for the log. */
  async api(method: string, path: string, body?: unknown): Promise<unknown> {
    const headers: Record<string, string> = {
      Authorization: "Basic " + Buffer.from(`${this.conn.adminUser}:${this.conn.adminPassword}`).toString("base64"),
    };
    if (body !== undefined) headers["Content-Type"] = "application/json";
    const resp = await fetch(`${this.conn.base}/api${path}`, {
      method,
      headers,
      body: body !== undefined ? JSON.stringify(body) : undefined,
    });
    if (!resp.ok) {
      throw new Error(`lavinmq management API ${method} ${path} -> ${resp.status}: ${await resp.text()}`);
    }
    const text = await resp.text();
    return text ? JSON.parse(text) : null;
  }
  /** True once the management API answers — the server has finished starting. */
  async ready(): Promise<boolean> {
    try {
      await this.api("GET", "/overview");
      return true;
    } catch {
      return false;
    }
  }
  /** Block until the management API answers, or throw once the budget is spent. */
  async waitReady(retries = 30, delayMs = 1000): Promise<void> {
    for (let i = 0; i < retries; i++) {
      if (await this.ready()) return;
      await new Promise((r) => setTimeout(r, delayMs));
    }
    throw new Error("lavinmq management API did not become ready");
  }
  /**
   * Create (or reset to a known state) one consumer's broker: a vhost and a user both named for the
   * consumer's login, with the login owning full permissions on exactly that vhost. Idempotent — a
   * PUT of a vhost or user that exists is a no-op or a password reset, so a reconcile can call it
   * again without harm. The consumer connects as `<login>` to vhost `<login>` and can reach nothing
   * else (novox/hq ADR 0048).
   */
  async createConsumer(login: string, password: string): Promise<void> {
    const v = encodeURIComponent(login);
    const u = encodeURIComponent(login);
    await this.api("PUT", `/vhosts/${v}`);
    await this.api("PUT", `/users/${u}`, { password, tags: "" });
    await this.api("PUT", `/permissions/${v}/${u}`, { configure: ".*", write: ".*", read: ".*" });
  }
  /**
   * Whether a consumer's user exists with exactly this password and full permissions on its own
   * vhost. Read-only: the stored hash is salted SHA-256, the scheme `rabbitHash` writes, so the
   * password is checked by hashing it with the stored salt rather than by logging in. `false` when
   * the user or its permission is gone or the password differs; an unreachable API rejects
   * (novox/hq issue 120).
   */
  async holdsConsumer(login: string, password: string): Promise<boolean> {
    const v = encodeURIComponent(login);
    const u = encodeURIComponent(login);
    const user = await this.getOrNull<{ password_hash?: string; hashing_algorithm?: string }>(`/users/${u}`);
    if (!user?.password_hash) return false;
    if (user.hashing_algorithm && !/sha256/i.test(user.hashing_algorithm)) {
      throw new Error(`lavinmq user ${login} is hashed with ${user.hashing_algorithm}, which this check cannot verify`);
    }
    const stored = Buffer.from(user.password_hash, "base64");
    if (stored.length < 5 || rabbitHash(password, stored.subarray(0, 4)) !== user.password_hash) return false;
    const perm = await this.getOrNull<{ configure?: string; write?: string; read?: string }>(`/permissions/${v}/${u}`);
    return perm?.configure === ".*" && perm?.write === ".*" && perm?.read === ".*";
  }
  /** A GET that answers null for a 404 and rejects on anything else that is not 2xx. */
  private async getOrNull<T>(path: string): Promise<T | null> {
    const resp = await fetch(`${this.conn.base}/api${path}`, {
      headers: {
        Authorization: "Basic " + Buffer.from(`${this.conn.adminUser}:${this.conn.adminPassword}`).toString("base64"),
      },
    });
    if (resp.status === 404) return null;
    if (!resp.ok) throw new Error(`lavinmq management API GET ${path} -> ${resp.status}: ${await resp.text()}`);
    return (await resp.json()) as T;
  }
  /** Remove a consumer's vhost and user, idempotently. A DELETE of what is already gone is tolerated. */
  async removeConsumer(login: string): Promise<void> {
    const v = encodeURIComponent(login);
    const u = encodeURIComponent(login);
    try {
      await this.api("DELETE", `/vhosts/${v}`);
    } catch (err) {
      console.error(`[lavinmq] delete vhost ${login} failed (continuing): ${err}`);
    }
    try {
      await this.api("DELETE", `/users/${u}`);
    } catch (err) {
      console.error(`[lavinmq] delete user ${login} failed (continuing): ${err}`);
    }
  }
  /** The vhosts, for the amqp_list_vhosts tool. */
  async listVhosts(): Promise<{ name: string; messages: number }[]> {
    const vhosts = (await this.api("GET", "/vhosts")) as { name: string; messages?: number }[];
    return vhosts.map((v) => ({ name: v.name, messages: v.messages ?? 0 }));
  }
  /** The queues on one vhost (default the root vhost), for the amqp_list_queues tool. */
  async listQueues(vhost = "/"): Promise<{ name: string; messages: number; consumers: number }[]> {
    const queues = (await this.api("GET", `/queues/${encodeURIComponent(vhost)}`)) as
      { name: string; messages?: number; consumers?: number }[];
    return queues.map((q) => ({ name: q.name, messages: q.messages ?? 0, consumers: q.consumers ?? 0 }));
  }
 }
 /**
 * The RabbitMQ-compatible SHA-256 password hash lavinmq's `default_password_hash` expects:
 * base64( salt[4] || sha256( salt || utf8(password) ) ). The salt is any four bytes — random here,
 * because a fixed salt buys nothing and a fresh one is free. Verified against `lavinmqctl
 * hash_password`: a hash produced here is accepted by the server unchanged.
 */
 export function rabbitHash(password: string, salt: Buffer = randomBytes(4)): string {
  const digest = createHash("sha256").update(Buffer.concat([salt, Buffer.from(password, "utf8")])).digest();
  return Buffer.concat([salt, digest]).toString("base64");
 }
 /** Generate a URL-safe password. */
 export function generatePassword(): string {
  return randomBytes(24).toString("base64url");
 }
 function readSecretFile(path: string | undefined): string | undefined {
  if (!path) return undefined;
  try {
    return readFileSync(path, "utf8").trim();
  } catch {
    return undefined;
  }
 }
@@ -1,25 +0,0 @@
 // lavinmq's events entrypoint, loaded by the per-node tool host (the provisioner container runs
 // ./provisioner separately). The broker lifecycle events are EMITTED from the provisioner, where the
 // lifecycle actually happens (novox/hq ADR 0041/0042):
 //   module.lavinmq.amqp.provisioned    — a consumer's vhost + user was created
 //   module.lavinmq.amqp.deprovisioned  — that vhost + user was removed
 // Here in the tool host we react to them, keeping a lightweight audit trail of who was granted a
 // broker and who lost one — observability the provider itself is best placed to log.
 import { on } from "@novox/mesh-sdk/events";
 interface AmqpEvent {
  consumer?: string;
  user: string;
  vhost?: string;
 }
 await on<AmqpEvent>("amqp.provisioned", async (e) => {
  console.log(`[lavinmq] broker provisioned for ${e.body.consumer ?? "?"} (user ${e.body.user}, vhost ${e.body.vhost})`);
 });
 await on<AmqpEvent>("amqp.deprovisioned", async (e) => {
  console.log(`[lavinmq] broker deprovisioned (user ${e.body.user})`);
 });
 console.log("[lavinmq] auditing broker lifecycle events");
@@ -1,145 +0,0 @@
 {
  "module": "lavinmq",
  "version": "1",
  "provides": [
    {
      "name": "amqp",
      "scope": "mesh"
    }
  ],
  "capabilities": [
    "container-runtime"
  ],
  "emits": [
    "amqp.provisioned",
    "amqp.deprovisioned"
  ],
  "consumes": [
    "lavinmq.amqp.provisioned",
    "lavinmq.amqp.deprovisioned"
  ],
  "serves": {
    "amqp": {
      "port": 5672
    }
  },
  "receives": {
    "amqp": "/var/lib/lavinmq-module/grants/mesh.json"
  },
  "grants": {
    "amqp": "/var/lib/lavinmq-module/grants"
  },
  "own-secrets": {
    "admin": "/var/lib/lavinmq-module/admin.secret",
    "broker": "/var/lib/mesh/lavinmq/broker"
  },
  "listens": [
    {
      "port": 5671,
      "protocol": "tcp",
      "from": "mesh",
      "why": "the mesh bus \u2014 amqps, every module's events and the control plane, reached over the overlay"
    },
    {
      "port": 5672,
      "protocol": "tcp",
      "from": "mesh",
      "why": "modules on any machine that were granted a queue"
    }
  ],
  "guards": [
    15672
  ],
  "resources": [
    {
      "id": "mesh-state",
      "type": "directory",
      "path": "/var/lib/mesh/lavinmq",
      "mode": "0700"
    },
    {
      "id": "state",
      "type": "directory",
      "path": "/var/lib/lavinmq-module",
      "mode": "0700"
    },
    {
      "id": "grants-dir",
      "type": "directory",
      "path": "/var/lib/lavinmq-module/grants",
      "mode": "0700"
    },
    {
      "id": "broker-data",
      "type": "directory",
      "path": "/var/lib/mesh-broker",
      "mode": "0700"
    },
    {
      "id": "server",
      "type": "container",
      "name": "mesh-broker",
      "image": "cloudamqp/lavinmq@sha256:3eb54c12916d700a978c2ea86e6362cd4974b0e3189508718006d4e6d341246b",
      "ports": [
        "5671:5671",
        "5672:5672",
        "127.0.0.1:15672:15672"
      ],
      "volumes": [
        "/var/lib/mesh-broker:/var/lib/lavinmq",
        "/var/lib/mesh-broker-tls:/tls:ro"
      ],
      "args": [
        "--amqps-port=5671",
        "--cert=/tls/tls.crt",
        "--key=/tls/tls.key"
      ]
    },
    {
      "id": "runtime",
      "type": "container",
      "name": "mesh-lavinmq",
      "artifact": "runtime",
      "network": "host",
      "volumes": [
        "/var/lib/mesh/lavinmq/broker:/run/secrets/broker:ro",
        "/var/lib/lavinmq-module/grants:/var/lib/lavinmq-module/grants:ro",
        "/var/lib/lavinmq-module/admin.secret:/run/secrets/admin:ro"
      ],
      "env": {
        "MESH_BROKER_FILE": "/run/secrets/broker",
        "MESH_RECEIVES": "/var/lib/lavinmq-module/grants/mesh.json",
        "MESH_PROVISION_LAVINMQ": "http://127.0.0.1:15672",
        "MESH_PROVISION_ADMIN_USER": "guest",
        "MESH_PROVISION_PASSWORD_FILE": "/run/secrets/admin"
      }
    }
  ],
  "build": {
    "on": [
      {
        "arg": "BUILD_BASE",
        "module": "mesh-tools",
        "artifact": "build"
      },
      {
        "arg": "RUNTIME_BASE",
        "module": "mesh-tools",
        "artifact": "runtime"
      }
    ],
    "artifacts": [
      {
        "name": "runtime",
        "kind": "image",
        "from": "Dockerfile"
      }
    ]
  },
  "accesses": [
    {
      "path": "/var/lib/mesh-broker-tls",
      "mode": "read"
    }
  ]
 }
@@ -1,14 +0,0 @@
 {
  "name": "@novox/module-lavinmq",
  "version": "0.1.0",
  "description": "lavinmq — provides the mesh amqp interface (a per-consumer AMQP message broker). Its management client, provisioner, run-once bootstrap, tools and events live here (novox/hq ADR 0039).",
  "type": "module",
  "private": true,
  "dependencies": {
    "@novox/mesh-sdk": "^0.1.1"
  },
  "devDependencies": {
    "@types/node": "^22.0.0",
    "typescript": "^5.6.0"
  }
 }
@@ -1,56 +0,0 @@
 // lavinmq's provisioner — the adapter that makes lavinmq a provider of the mesh `amqp` interface.
 // The reconcile loop, the contributions file, and reading the mesh's minted password are the sdk
 // harness's; this writes only the per-service half: how lavinmq creates and removes a consumer's own
 // broker (novox/hq ADR 0039/0040/0048).
 //
 // The `amqp` interface: a consumer connects as `as` with the password the mesh minted, to a vhost
 // named for that same login — its own message broker, isolated from every other consumer's by the
 // vhost boundary. It is a broker of its own, not a shared account on the mesh's control-plane broker.
 //
 // **The login and password are the mesh's, not the provisioner's (novox/hq ADR 0048).** The mesh
 // derives the login and hands it to both ends so they agree, and mints the password and delivers a
 // copy to each. lavinmq creates exactly that user with exactly that password — a name or password the
 // provisioner invented is one the consumer could never present.
 //
 // Vhost-per-login is the isolation model, the exact analog of postgres's database-per-login: the
 // consumer owns one vhost, named for its login, and a user with full rights on that vhost and no
 // rights anywhere else. lavinmq enforces it — a user with no permission on `/` is refused the moment
 // it opens that vhost (`NOT_ALLOWED`), so a login is a broker the consumer alone can reach.
 import { runProvisioner, type Provision } from "@novox/mesh-sdk/provisioner";
 import { emit } from "@novox/mesh-sdk/events";
 import { LavinmqClient } from "../client.js";
 const lavinmq = LavinmqClient.fromEnv();
 /** Emit a lifecycle event without letting a broker hiccup fail the provisioning itself. */
 async function announce(type: string, body: Record<string, string>): Promise<void> {
  try {
    await emit(type, body);
  } catch (err) {
    console.error(`[provisioner:amqp] emit ${type} failed: ${err}`);
  }
 }
 runProvisioner("amqp", {
  async create(p: Provision): Promise<void> {
    // The vhost and the user share the consumer's login, so one cannot reach another's broker.
    await lavinmq.waitReady();
    await lavinmq.createConsumer(p.as, p.password);
    await announce("amqp.provisioned", {
      consumer: p.consumer ?? "",
      user: p.as,
      vhost: p.as,
    });
  },
  async remove(p: { as: string }): Promise<void> {
    await lavinmq.removeConsumer(p.as);
    await announce("amqp.deprovisioned", { user: p.as, vhost: p.as });
  },
  // Asked every minute by the harness: whether the backend still holds this consumer exactly as
  // the mesh gave it, so a login lost behind the provisioner's back is made again (novox/hq issue 120).
  async holds(p: Provision): Promise<boolean> {
    return lavinmq.holdsConsumer(p.as, p.password);
  },
 });
@@ -1,32 +0,0 @@
 // lavinmq's tools — lavinmq's own code (novox/hq ADR 0039), importing lavinmq's own management
 // client. They return structured data; the mesh serves them through the sdk's tool harness.
 import { registerModuleTools, type ToolDefinition } from "@novox/mesh-sdk/tools";
 import { LavinmqClient } from "../client.js";
 export function getLavinmqTools(lavinmq: LavinmqClient): ToolDefinition[] {
  return [
    {
      name: "amqp_list_vhosts",
      description: "List the lavinmq virtual hosts — one per consumer that was granted a broker.",
      input: {},
      run: async () => ({ vhosts: await lavinmq.listVhosts() }),
    },
    {
      name: "amqp_list_queues",
      description: "List the queues on a vhost with message and consumer counts. Omit vhost for the root '/'.",
      input: { vhost: { type: "string", description: "the vhost to list, e.g. a consumer's login; defaults to '/'" } },
      run: async (args) => ({ queues: await lavinmq.listQueues(args.vhost ? String(args.vhost) : undefined) }),
    },
  ];
 }
 // The tools exist only when the server can be reached from the environment; without it, lavinmq
 // contributes none rather than failing the whole tool runtime.
 registerModuleTools("lavinmq", (env) => {
  try {
    return getLavinmqTools(LavinmqClient.fromEnv(env));
  } catch {
    return [];
  }
 });
@@ -1,12 +0,0 @@
 {
  "compilerOptions": {
    "target": "ES2022",
    "module": "NodeNext",
    "moduleResolution": "NodeNext",
    "strict": true,
    "esModuleInterop": true,
    "skipLibCheck": true,
    "noEmit": true
  },
  "include": ["client.ts", "index.ts", "provisioner/index.ts", "tools/index.ts", "bootstrap/index.ts"]
 }
@@ -24,6 +24,7 @@
  },
  "listens": [
    {
      "name": "web",
      "port": 8283,
      "protocol": "tcp",
      "from": "mesh",
@@ -14,6 +14,7 @@
  },
  "listens": [
    {
      "name": "web",
      "port": 8686,
      "protocol": "tcp",
      "from": "mesh",
@@ -86,7 +87,7 @@
  "contributes": {
    "route": {
      "label": "lidarr",
-      "port": 8686
+      "endpoint": "web"
    }
  },
  "binds": {
@@ -16,27 +16,27 @@
    "route": {
      "web": {
        "label": "mail",
-        "port": 7443,
+        "endpoint": "web-tls",
        "scheme": "https",
        "insecure": true
      },
      "acme": {
        "label": "mail",
        "path": "/.well-known/acme-challenge",
-        "port": 7080,
+        "endpoint": "web",
        "priority": 100
      },
      "autoconfig": {
        "label": "autoconfig",
-        "port": 4243
+        "endpoint": "autoconfig"
      },
      "autodiscover": {
        "label": "autodiscover",
-        "port": 4243
+        "endpoint": "autoconfig"
      },
      "automx": {
        "label": "automx",
-        "port": 4243
+        "endpoint": "autoconfig"
      }
    }
  },
@@ -60,6 +60,7 @@
  ],
  "listens": [
    {
      "name": "smtp",
      "port": 25,
      "protocol": "tcp",
      "from": "anywhere",
@@ -67,6 +68,7 @@
      "fixed": true
    },
    {
      "name": "pop3",
      "port": 110,
      "protocol": "tcp",
      "from": "anywhere",
@@ -74,6 +76,7 @@
      "fixed": true
    },
    {
      "name": "imap",
      "port": 143,
      "protocol": "tcp",
      "from": "anywhere",
@@ -81,6 +84,7 @@
      "fixed": true
    },
    {
      "name": "smtps",
      "port": 465,
      "protocol": "tcp",
      "from": "anywhere",
@@ -88,6 +92,7 @@
      "fixed": true
    },
    {
      "name": "submission",
      "port": 587,
      "protocol": "tcp",
      "from": "anywhere",
@@ -95,6 +100,7 @@
      "fixed": true
    },
    {
      "name": "imaps",
      "port": 993,
      "protocol": "tcp",
      "from": "anywhere",
@@ -102,6 +108,7 @@
      "fixed": true
    },
    {
      "name": "pop3s",
      "port": 995,
      "protocol": "tcp",
      "from": "anywhere",
@@ -109,18 +116,21 @@
      "fixed": true
    },
    {
      "name": "web",
      "port": 7080,
      "protocol": "tcp",
      "from": "mesh",
      "why": "the web front over http; only the ACME HTTP-01 passthrough is routed here \u2014 everything else 301s to https and would loop a proxy"
    },
    {
      "name": "web-tls",
      "port": 7443,
      "protocol": "tcp",
      "from": "mesh",
      "why": "the web front over its own TLS (admin, webmail, API); the public name mail.novox.be is a route grant reaching it here"
    },
    {
      "name": "autoconfig",
      "port": 4243,
      "protocol": "tcp",
      "from": "mesh",
@@ -6,6 +6,7 @@
  ],
  "listens": [
    {
      "name": "api",
      "port": 59125,
      "protocol": "tcp",
      "from": "mesh",
@@ -22,7 +22,7 @@ COPY . .
 # The compiler is invoked by its real path rather than through node_modules/.bin, whose entries are
 # symlinks to a launcher that requires its library relatively — resolved away when the base image
 # was assembled.
-RUN node /app/node_modules/typescript/bin/tsc pg.d.ts store.ts index.ts tools/index.ts \
+RUN node /app/node_modules/typescript/bin/tsc pg.d.ts store.ts index.ts tools/index.ts prepare/index.ts \
      --module NodeNext --moduleResolution NodeNext --target ES2022 --outDir dist
 # **A module may need something the base image does not carry.** The base holds what every module
@@ -48,3 +48,8 @@ COPY --from=build /deps/node_modules /app/modules/mesh-catalog/node_modules
 # to listen for what the builder announces. Serve binds the broker first, then imports these, so
 # `on()` has something to subscribe to.
 ENV MESH_TOOL_MODULES=/app/modules/mesh-catalog/dist/index.js,/app/modules/mesh-catalog/dist/tools/index.js
 # And what prepares this module's state, for the runtime's `prepare` mode (novox/hq ADR 0135). Named
 # here, beside the entrypoints above, because the module knows which of its files prepares its state
 # and nothing else could: the mesh asks one word and this says what answers it.
 ENV MESH_PREPARE=/app/modules/mesh-catalog/dist/prepare/index.js
@@ -14,10 +14,12 @@ import { Graph, type Made } from "./store.js";
 const graph = Graph.fromEnv();
-// Before subscribing, and idempotent. The runtime is restarted until its store is reachable, which
+// The schema is not brought up here. The mesh prepares this module's state before it starts this
-// is the same arrangement model-usage uses: a schema step that had to reach the provider over the
+// version, and does not start it if that failed (novox/hq ADR 0135) — see prepare/index.ts. Doing it
-// overlay would block the very apply that brings the overlay up.
+// at start made a schema that could not be reached a crash loop instead of a stop, with the graph
-await graph.migrate();
+// keeping a gap and nothing saying so. The reason it used to be here — that a step blocking the apply
 // would block the very apply that brings the overlay up — stopped being true when a step's failure
 // became this module's business and not the machine's (ADR 0136).
 /** What the builder says when it has built something. */
 interface Built {
@@ -47,7 +49,15 @@ interface Built {
  replay?: boolean;
 }
-await on("mesh-build-machine.built", async (event) => {
+/**
 * What a build means for the graph, wherever it came from.
 *
 * Two emitters say the same thing and neither is a mistake: the build machine says it as it happens,
 * and the control plane says what it already held when this module asks what it missed
 * (novox/hq ADR 0134). A replay is marked as one in its body, so nothing acts on a module that moved
 * months ago — see `replay` above.
 */
 const placeTheBuild = async (event: { body: unknown }): Promise<void> => {
  const body = event.body as Built;
  if (!body.module || !body.commit) {
    // Said rather than dropped: a build that announced itself without saying what it built is a
@@ -89,7 +99,11 @@ await on("mesh-build-machine.built", async (event) => {
      because: next.because,
    });
  }
-});
+};
 // As it happens, and what the mesh already held when this module asked what it missed.
 await on("mesh-build-machine.built", placeTheBuild);
 await on("mesh-controller.built-before", placeTheBuild);
 // **And ask for what was built before this catalogue existed** (novox/hq 04-ISSUES/050).
 //
@@ -29,13 +29,16 @@
    "broker": "/var/lib/mesh/mesh-catalog/broker"
  },
  "consumes": [
-    "mesh-build-machine.built"
+    "mesh-build-machine.built",
    "mesh-controller.built-before"
  ],
  "emits": [
    "registered",
    "upgraded",
-    "rebuild-needed"
+    "rebuild-needed",
    "catching-up"
  ],
  "prepares": true,
  "resources": [
    {
      "id": "mesh-state",
@@ -0,0 +1,17 @@
 // The catalogue's state, brought to the shape this version needs (novox/hq ADR 0135).
 //
 // **The mesh runs this before the version that needs it, and does not start that version if it
 // fails** — and the refusal reaches this module and nothing else on the machine
 // (novox/hq ADR 0136). That is the whole difference from where this used to happen: at start, inside
 // the runtime, a schema that could not be brought up was a crash loop, the graph kept a gap, and
 // nothing anywhere said so.
 //
 // Nothing here connects to the broker. Preparation runs before the version that would use it, so
 // there is nothing yet to talk to; the runtime's `prepare` mode imports this and awaits it, and this
 // process exiting non-zero is how the host knows not to start the runtime.
 import { Graph } from "../store.js";
 const graph = Graph.fromEnv();
 await graph.migrate();
 console.log("[mesh-catalog] the module graph's schema is what this version needs");
 await graph.close();
@@ -12,6 +12,7 @@
    "pg.d.ts",
    "store.ts",
    "index.ts",
-    "tools/index.ts"
+    "tools/index.ts",
    "prepare/index.ts"
  ]
 }
@@ -14,11 +14,11 @@
    "route": {
      "api": {
        "label": "files-api",
-        "port": 9000
+        "endpoint": "s3"
      },
      "console": {
        "label": "files",
-        "port": 9001
+        "endpoint": "console"
      }
    }
  },
@@ -31,12 +31,14 @@
  ],
  "listens": [
    {
      "name": "s3",
      "port": 9000,
      "protocol": "tcp",
      "from": "mesh",
      "why": "the S3 endpoint"
    },
    {
      "name": "console",
      "port": 9001,
      "protocol": "tcp",
      "from": "mesh",
@@ -20,6 +20,7 @@
  ],
  "listens": [
    {
      "name": "database",
      "port": 27017,
      "protocol": "tcp",
      "from": "mesh",
@@ -34,12 +34,14 @@
  },
  "listens": [
    {
      "name": "mqtt",
      "port": 1883,
      "protocol": "tcp",
      "from": "mesh",
      "why": "modules on any machine that were granted a topic namespace"
    },
    {
      "name": "mqtt-websockets",
      "port": 8081,
      "protocol": "tcp",
      "from": "mesh",
@@ -20,6 +20,7 @@
  ],
  "listens": [
    {
      "name": "database",
      "port": 4848,
      "protocol": "tcp",
      "from": "mesh",
@@ -14,7 +14,7 @@
    },
    "route": {
      "label": "n8n",
-      "port": 5682
+      "endpoint": "web"
    }
  },
  "binds": {
@@ -29,6 +29,7 @@
  },
  "listens": [
    {
      "name": "web",
      "port": 5682,
      "protocol": "tcp",
      "from": "mesh",
@@ -9,8 +9,11 @@
 #
 # Unlike every other module's Dockerfile, this builds no TypeScript and uses no mesh base image:
 # the module's code is the server, which upstream already built. There is no BUILD_BASE here on
-# purpose — nothing is compiled.
+# purpose — nothing is compiled. The upstream image is declared in the manifest under build.on and
-FROM nats@sha256:b83efabe3e7def1e0a4a31ec6e078999bb17c80363f881df35edc70fcb6bb927
+# arrives as NATS_BASE, like every other base the mesh copies into its own store before a build
 # (novox/hq ADR 0097); the digest above is the index one for the reason given.
 ARG NATS_BASE
 FROM ${NATS_BASE}
 COPY entrypoint.sh /usr/local/bin/mesh-nats-entrypoint
 RUN chmod 0755 /usr/local/bin/mesh-nats-entrypoint
@@ -21,6 +21,7 @@
  "consumes": [],
  "listens": [
    {
      "name": "bus",
      "port": 4222,
      "protocol": "tcp",
      "from": "mesh",
@@ -47,7 +48,7 @@
      "id": "server-conf",
      "type": "file",
      "path": "/var/lib/nats-module/conf/nats.conf",
-      "content": "# The nats module's own server settings. Declared by the module, because a port, a TLS path\n# and a store directory are properties of the container this module raises: they live in its\n# image and its mounts and change when it does.\n#\n# The mesh writes accounts.conf beside this one and nothing else. A controller that wrote the\n# whole file would have to be kept in step with a Dockerfile it never sees.\n\nport: 4222\nhttp: 127.0.0.1:8222\n\ntls {\n  cert_file: \"/tls/tls.crt\"\n  key_file: \"/tls/tls.key\"\n  ca_file: \"/tls/ca.crt\"\n}\n\n# **No `verify`, deliberately, and it was `verify: true` until a probe ran this image.** That\n# setting makes the server demand a *client* certificate, and nothing in the mesh presents one: a\n# host pins this server's exact certificate and authenticates with the password the mesh minted\n# (novox/hq ADR 0004, design 25 \u00a74), and so does a module's runtime. With it on, every connection\n# in the mesh is refused at the TLS handshake, before any password is looked at \u2014 and the error is\n# \"client didn't provide a certificate\", which reads as a client fault.\n#\n# TLS is still required: a tls block is what makes it required, and verify only decides whether\n# client certificates are checked. What is given up is a second factor the mesh has no machinery\n# to issue or rotate \u2014 a certificate per module per node \u2014 and what is kept is stronger than a\n# name check in both directions: an exact pin outward, a per-user password inward.\n\njetstream {\n  store_dir: \"/data\"\n}\n\n# Every user of the mesh, composed by the controller and rewritten whenever a module is\n# assigned, a node enrols or a person's access changes.\n#\n# **Relative, and in this same directory, because it has to be.** An absolute include path is\n# resolved relative to the including file's directory, not from the root: nats-server given\n# `include /etc/nats/accounts.conf` from /etc/nats-server/nats.conf looks for\n# /etc/nats-server/etc/nats/accounts.conf and refuses to start. Verified against the server.\ninclude accounts.conf\n",
+      "content": "# The nats module's own server settings. Declared by the module, because a port, a TLS path\n# and a store directory are properties of the container this module raises: they live in its\n# image and its mounts and change when it does.\n#\n# The mesh writes accounts.conf beside this one and nothing else. A controller that wrote the\n# whole file would have to be kept in step with a Dockerfile it never sees.\n\nport: 4222\nhttp: 127.0.0.1:8222\n\n# The mesh's own broker certificate \u2014 the one every machine already pins by fingerprint and the\n# controller already trusts (MESH_BROKER_CERTIFICATE). Serving the new bus with it means no\n# machine's pin changes when it moves, and no second certificate exists to be wrong about.\ntls {\n  cert_file: \"/tls/tls.crt\"\n  key_file: \"/tls/tls.key\"\n}\n\n# **No `verify`, deliberately, and it was `verify: true` until a probe ran this image.** That\n# setting makes the server demand a *client* certificate, and nothing in the mesh presents one: a\n# host pins this server's exact certificate and authenticates with the password the mesh minted\n# (novox/hq ADR 0004, design 25 \u00a74), and so does a module's runtime. With it on, every connection\n# in the mesh is refused at the TLS handshake, before any password is looked at \u2014 and the error is\n# \"client didn't provide a certificate\", which reads as a client fault.\n#\n# TLS is still required: a tls block is what makes it required, and verify only decides whether\n# client certificates are checked. What is given up is a second factor the mesh has no machinery\n# to issue or rotate \u2014 a certificate per module per node \u2014 and what is kept is stronger than a\n# name check in both directions: an exact pin outward, a per-user password inward.\n\njetstream {\n  store_dir: \"/data\"\n}\n\n# Every user of the mesh, composed by the controller and rewritten whenever a module is\n# assigned, a node enrols or a person's access changes.\n#\n# **Relative, and in this same directory, because it has to be.** An absolute include path is\n# resolved relative to the including file's directory, not from the root: nats-server given\n# `include /etc/nats/accounts.conf` from /etc/nats-server/nats.conf looks for\n# /etc/nats-server/etc/nats/accounts.conf and refuses to start. Verified against the server.\ninclude accounts.conf\n",
      "mode": "0644"
    },
    {
@@ -61,18 +62,24 @@
      "volumes": [
        "/var/lib/mesh-broker-nats:/data",
        "/var/lib/nats-module/conf:/etc/nats:ro",
-        "/var/lib/mesh-broker-nats-tls:/tls:ro"
+        "/var/lib/mesh-broker-tls:/tls:ro"
      ],
      "artifact": "server"
    }
  ],
  "accesses": [
    {
-      "path": "/var/lib/mesh-broker-nats-tls",
+      "path": "/var/lib/mesh-broker-tls",
      "mode": "read"
    }
  ],
  "build": {
    "on": [
      {
        "arg": "NATS_BASE",
        "image": "nats@sha256:b83efabe3e7def1e0a4a31ec6e078999bb17c80363f881df35edc70fcb6bb927"
      }
    ],
    "artifacts": [
      {
        "name": "server",
@@ -13,7 +13,7 @@
    },
    "route": {
      "label": "drive",
-      "port": 80
+      "endpoint": "web"
    }
  },
  "binds": {
@@ -38,6 +38,7 @@
  ],
  "listens": [
    {
      "name": "web",
      "port": 80,
      "protocol": "tcp",
      "from": "mesh",
@@ -12,6 +12,7 @@
  ],
  "listens": [
    {
      "name": "web",
      "port": 1880,
      "protocol": "tcp",
      "from": "mesh",
@@ -81,7 +82,7 @@
  "contributes": {
    "route": {
      "label": "nodered",
-      "port": 1880
+      "endpoint": "web"
    }
  },
  "binds": {
@@ -10,7 +10,7 @@
  "contributes": {
    "route": {
      "label": "@",
-      "port": 4000
+      "endpoint": "web"
    }
  },
  "binds": {
@@ -18,6 +18,7 @@
  },
  "listens": [
    {
      "name": "web",
      "port": 4000,
      "protocol": "tcp",
      "from": "mesh",
@@ -15,6 +15,7 @@
  },
  "listens": [
    {
      "name": "web",
      "port": 6789,
      "protocol": "tcp",
      "from": "mesh",
@@ -12,6 +12,7 @@
  ],
  "listens": [
    {
      "name": "api",
      "port": 11434,
      "protocol": "tcp",
      "from": "machine",
@@ -14,6 +14,7 @@
  },
  "listens": [
    {
      "name": "web",
      "port": 3579,
      "protocol": "tcp",
      "from": "mesh",
@@ -89,7 +90,7 @@
  "contributes": {
    "route": {
      "label": "ombi",
-      "port": 3579
+      "endpoint": "web"
    }
  },
  "binds": {
@@ -11,7 +11,7 @@
  "contributes": {
    "route": {
      "label": "office",
-      "port": 9070
+      "endpoint": "web"
    }
  },
  "binds": {
@@ -22,6 +22,7 @@
  },
  "listens": [
    {
      "name": "web",
      "port": 9070,
      "protocol": "tcp",
      "from": "mesh",
@@ -11,7 +11,7 @@
  "contributes": {
    "route": {
      "label": "eef",
-      "port": 4012
+      "endpoint": "web"
    }
  },
  "binds": {
@@ -19,6 +19,7 @@
  },
  "listens": [
    {
      "name": "web",
      "port": 4012,
      "protocol": "tcp",
      "from": "mesh",
@@ -11,7 +11,7 @@
  "contributes": {
    "route": {
      "label": "filip",
-      "port": 4013
+      "endpoint": "web"
    }
  },
  "binds": {
@@ -19,6 +19,7 @@
  },
  "listens": [
    {
      "name": "web",
      "port": 4013,
      "protocol": "tcp",
      "from": "mesh",
@@ -18,7 +18,7 @@
    },
    "route": {
      "label": "photos",
-      "port": 4001
+      "endpoint": "web"
    }
  },
  "binds": {
@@ -32,12 +32,14 @@
  },
  "listens": [
    {
      "name": "api",
      "port": 9000,
      "protocol": "tcp",
      "from": "mesh",
      "why": "the photos backend API; the client sites on the module network call it"
    },
    {
      "name": "web",
      "port": 4001,
      "protocol": "tcp",
      "from": "mesh",
@@ -18,6 +18,7 @@
  },
  "listens": [
    {
      "name": "stream",
      "port": 32400,
      "protocol": "tcp",
      "from": "mesh",
@@ -7,12 +7,14 @@
  ],
  "listens": [
    {
      "name": "web",
      "port": 9090,
      "protocol": "tcp",
      "from": "mesh",
      "why": "the dashboard over http; portainer.novox.be is a route grant and the proxy reaches it here \u2014 the machine side of 9090:9000, the predecessor's number"
    },
    {
      "name": "web-tls",
      "port": 9443,
      "protocol": "tcp",
      "from": "mesh",
@@ -103,7 +105,7 @@
  "contributes": {
    "route": {
      "label": "portainer",
-      "port": 9090
+      "endpoint": "web"
    }
  },
  "binds": {
@@ -26,6 +26,7 @@
  ],
  "listens": [
    {
      "name": "database",
      "port": 5432,
      "protocol": "tcp",
      "from": "mesh",
@@ -16,6 +16,7 @@
  },
  "listens": [
    {
      "name": "web",
      "port": 8080,
      "protocol": "tcp",
      "from": "mesh",
@@ -14,6 +14,7 @@
  },
  "listens": [
    {
      "name": "web",
      "port": 7878,
      "protocol": "tcp",
      "from": "mesh",
@@ -86,7 +87,7 @@
  "contributes": {
    "route": {
      "label": "movies",
-      "port": 7878
+      "endpoint": "web"
    }
  },
  "binds": {
@@ -40,6 +40,7 @@
  },
  "listens": [
    {
      "name": "cache",
      "port": 6379,
      "protocol": "tcp",
      "from": "mesh",
@@ -27,12 +27,14 @@
  },
  "listens": [
    {
      "name": "http",
      "port": 80,
      "protocol": "tcp",
      "from": "anywhere",
      "why": "public HTTP, and the ACME HTTP-01 challenge answered at the name being certified"
    },
    {
      "name": "https",
      "port": 443,
      "protocol": "tcp",
      "from": "anywhere",
@@ -5,11 +5,12 @@
    "container-runtime"
  ],
  "own-secrets": {
-    "secret": "/var/lib/searxng-module/secret.secret",
+    "secret": "/var/lib/mesh/searxng/secret",
    "broker": "/var/lib/mesh/searxng/broker"
  },
  "listens": [
    {
      "name": "web",
      "port": 8080,
      "protocol": "tcp",
      "from": "mesh",
@@ -26,22 +27,14 @@
    {
      "id": "state",
      "type": "directory",
-      "path": "/var/lib/searxng-module",
+      "mode": "0700",
-      "mode": "0700"
+      "place": "."
    },
    {
      "id": "valkey-data",
      "type": "directory",
      "path": "/var/lib/searxng-module/valkey-data",
      "mode": "0700"
    },
    {
      "id": "server-env",
      "type": "file",
      "path": "/var/lib/searxng-module/server.env",
      "mode": "0600",
      "content": "SEARXNG_SECRET=${secret:secret}\nSEARXNG_VALKEY_URL=valkey://valkey:6379/0\n"
    },
    {
      "id": "net",
      "type": "network",
@@ -62,30 +55,39 @@
        "warning"
      ],
      "volumes": [
-        "/var/lib/searxng-module/valkey-data:/data"
+        "${dir:valkey-data}:/data"
      ]
    },
    {
      "id": "settings",
      "type": "file",
      "path": "${dir:state}/settings.yml",
      "mode": "0600",
      "merge": "json",
      "content": "{\n  \"use_default_settings\": true,\n  \"server\": {\n    \"secret_key\": \"${secret:secret}\",\n    \"base_url\": false,\n    \"limiter\": false,\n    \"image_proxy\": false,\n    \"public_instance\": false\n  },\n  \"search\": {\n    \"formats\": [\"html\", \"json\"]\n  },\n  \"valkey\": {\n    \"url\": \"valkey://valkey:6379/0\"\n  }\n}\n"
    },
    {
      "id": "server",
      "type": "container",
      "name": "searxng",
-      "image": "searxng/searxng@sha256:c7cc75852051bf6254afda6ed1b920dd1677d8efe4ab141bf558f02e582f4371",
+      "image": "searxng/searxng@sha256:cd8812607ab73730a0b1a0dc4990223fe1b9e383f6f35947114d0bef7f8bb441",
      "network": "searxng",
      "env-file": [
        "/var/lib/searxng-module/server.env"
      ],
      "ports": [
        "8080"
      ],
-      "secrets-in-environment": "SEARXNG_SECRET is env-only, but settings.yml carries server.secret_key; convertible by mounting a generated settings.yml, not yet done"
+      "volumes": [
        "${dir:state}/settings.yml:/etc/searxng/settings.yml:ro"
      ],
      "restart-on": [
        "settings"
      ]
    },
    {
      "id": "runtime-config",
      "type": "file",
      "path": "/var/lib/mesh/searxng/config.json",
      "mode": "0600",
-      "content": "{}\n",
+      "content": "{}\n"
      "merge": "json"
    },
    {
      "id": "runtime",
@@ -113,11 +115,11 @@
  "contributes": {
    "route": {
      "label": "searxng",
-      "port": 8080
+      "endpoint": "web"
    }
  },
  "binds": {
-    "route": "/var/lib/searxng-module/route.json"
+    "route": "${dir:state}/route.json"
  },
  "build": {
    "on": [
@@ -43,6 +43,7 @@
  ],
  "listens": [
    {
      "name": "web",
      "port": 8080,
      "protocol": "tcp",
      "from": "mesh",
@@ -14,6 +14,7 @@
  },
  "listens": [
    {
      "name": "web",
      "port": 8989,
      "protocol": "tcp",
      "from": "mesh",
@@ -91,7 +92,7 @@
  "contributes": {
    "route": {
      "label": "series",
-      "port": 8989
+      "endpoint": "web"
    }
  },
  "binds": {
@@ -7,6 +7,7 @@
  ],
  "listens": [
    {
      "name": "ssh",
      "port": 22,
      "protocol": "tcp",
      "from": "anywhere",
@@ -31,6 +32,7 @@
      "type": "service",
      "unit": "sshd.service",
      "state": "running",
      "boot": "enabled",
      "restart-on": [
        "config"
      ]
@@ -26,6 +26,7 @@
  },
  "listens": [
    {
      "name": "acme",
      "port": 9000,
      "protocol": "tcp",
      "from": "mesh",
@@ -12,6 +12,7 @@
  ],
  "listens": [
    {
      "name": "web",
      "port": 8181,
      "protocol": "tcp",
      "from": "mesh",
@@ -85,7 +86,7 @@
  "contributes": {
    "route": {
      "label": "tautulli",
-      "port": 8181
+      "endpoint": "web"
    }
  },
  "binds": {
@@ -15,7 +15,7 @@
    },
    "route": {
      "label": "umami",
-      "port": 3000
+      "endpoint": "web"
    }
  },
  "binds": {
@@ -49,10 +49,11 @@
  },
  "listens": [
    {
      "name": "web",
      "port": 3000,
      "protocol": "tcp",
-      "from": "anywhere",
+      "from": "mesh",
-      "why": "one port serves two surfaces: the dashboard (the proxy gates it to the mesh) and the public collection endpoint that the browsers of every tracked site POST to \u2014 so the port itself must be reachable from anywhere"
+      "why": "one port serves two surfaces \u2014 the dashboard and the collection endpoint that the browsers of every tracked site POST to. Both are reached through the proxy, by name, so the port is how the proxy reaches this module and nothing else (novox/hq ADR 0045). It said \"anywhere\" and gave the reason that the collection endpoint must be public, which is true of the name and not of the port: opened, the machine-side port served the dashboard over plain HTTP to the internet, bypassing every rule the proxy applies by path"
    }
  ],
  "resources": [
@@ -6,54 +6,63 @@
  ],
  "listens": [
    {
      "name": "web",
      "port": 8443,
      "protocol": "tcp",
      "from": "mesh",
      "why": "the controller web UI, over its own self-signed tls; reaching it from outside is a route grant later"
    },
    {
      "name": "inform",
      "port": 8080,
      "protocol": "tcp",
      "from": "mesh",
      "why": "device inform \u2014 how APs and switches check in and are adopted"
    },
    {
      "name": "stun",
      "port": 3478,
      "protocol": "udp",
      "from": "mesh",
      "why": "STUN, so managed devices can find the controller through NAT"
    },
    {
      "name": "discovery",
      "port": 10001,
      "protocol": "udp",
      "from": "mesh",
      "why": "device discovery \u2014 the controller finds unadopted devices on the network"
    },
    {
      "name": "discovery-l2",
      "port": 1902,
      "protocol": "udp",
      "from": "mesh",
      "why": "layer-2 (UBNT) discovery broadcasts; published on 1902, the container listens on 1900"
    },
    {
      "name": "portal-tls",
      "port": 8843,
      "protocol": "tcp",
      "from": "mesh",
      "why": "the guest captive portal over https"
    },
    {
      "name": "portal",
      "port": 8880,
      "protocol": "tcp",
      "from": "mesh",
      "why": "the guest captive portal over http"
    },
    {
      "name": "speedtest",
      "port": 6789,
      "protocol": "tcp",
      "from": "mesh",
      "why": "mobile-app speed-test throughput measurement"
    },
    {
      "name": "syslog",
      "port": 5514,
      "protocol": "udp",
      "from": "mesh",