Commit Graph

  • 59c42b2086 lab: its tools run in the node's runtime (hq ADR 0198) jochen 2026-10-04 00:36:17 +02:00
  • 3b8164f1c0 mailu: its handlers, tools and provisioner run in the node's runtime (hq ADR 0198) jochen 2026-10-04 00:35:30 +02:00
  • 8877f893e5 records: its consumer and tools run in the node's runtime (hq ADR 0198) jochen 2026-10-04 00:34:57 +02:00
  • 043ae17fbf mesh-vault: its handlers, tools and provisioner run in the node's runtime (hq ADR 0198) jochen 2026-10-04 00:34:25 +02:00
  • 944f086ec7 gitea: its watcher, tools and provisioner run in the node's runtime (hq ADR 0198) jochen 2026-10-04 00:34:00 +02:00
  • dd93cfd613 audit-logger: its handler runs in the node's runtime (hq ADR 0198) jochen 2026-10-04 00:32:59 +02:00
  • 64cc292d7e Merge pull request 'Wave 1: thirteen modules' code moves into bundles the node's runtime serves (hq ADR 0198, to-be 38 WP4c)' (#245) from feat/0198-wave-1-module-code-moves into main mesh-admin 2026-10-03 22:52:08 +00:00
  • 7e889adf71 Merge pull request 'netcheck: one module, a Go tools bundle and a TypeScript one (hq ADR 0188, 0193)' (#246) from feat/netcheck-a-module-in-two-languages into main mesh-admin 2026-10-03 22:35:32 +00:00
  • 7e9ef899c1 netcheck: one module, a Go tools bundle and a TypeScript one (hq ADR 0188, 0193) jochen 2026-10-04 00:34:31 +02:00
  • 03e729d103 claude-code owns /etc/claude-code and ~/.claude as declared directories jochen 2026-10-03 23:49:16 +02:00
  • eab335b755 claude-code: launched over stdio (ADR 0193), the console's five tools in its instructions (ADR 0195) jochen 2026-10-03 23:41:01 +02:00
  • f42b58f789 claude-code: the manifest, the managed directory and the tools (hq design 36, to-be 40 WP2) jochen 2026-10-03 16:13:01 +02:00
  • 5737752744 claude-code: the sealed hand-over, the credentials write with the lineage rule, the identity read (hq to-be 40 WP2, in progress) jochen 2026-10-03 16:05:58 +02:00
  • f79199777d minio: its tools and provisioner run in the node's runtime (hq ADR 0198) jochen 2026-10-03 23:33:51 +02:00
  • b9d0884335 nextcloud: its handlers and tools run in the node's runtime (hq ADR 0198) jochen 2026-10-03 23:33:51 +02:00
  • 6a6d5747a3 nodered: the runtime serves its tools, and its mqtt step is a run-once process (hq ADR 0198) jochen 2026-10-03 23:33:51 +02:00
  • b19c4a2593 home-assistant: the runtime serves its code, and its provisions step is a run-once process (hq ADR 0198) jochen 2026-10-03 23:33:51 +02:00
  • a934e2a69f icecast: its handlers and tools run in the node's runtime (hq ADR 0198) jochen 2026-10-03 23:33:51 +02:00
  • af346f6066 grafana: its handlers and tools run in the node's runtime (hq ADR 0198) jochen 2026-10-03 23:33:51 +02:00
  • 7b0cfceb68 cloudflare-dns: its tools and provisioner run in the node's runtime (hq ADR 0198) jochen 2026-10-03 23:33:51 +02:00
  • 26021865c1 umami: its tools and provisioner run in the node's runtime (hq ADR 0198) jochen 2026-10-03 23:33:51 +02:00
  • 7440b8d009 keycloak: its handlers, tools and provisioner run in the node's runtime (hq ADR 0198) jochen 2026-10-03 23:33:51 +02:00
  • 0cb67e856f influxdb: its tools and provisioner run in the node's runtime (hq ADR 0198) jochen 2026-10-03 23:33:51 +02:00
  • 038a0a25ce mosquitto: the runtime serves its code, and its bootstrap is a run-once process (hq ADR 0198) jochen 2026-10-03 23:33:50 +02:00
  • 1b27ce319a redis: its handlers, tools and provisioner run in the node's runtime (hq ADR 0198) jochen 2026-10-03 23:33:50 +02:00
  • 7563569c8a postgres: its handlers, tools and provisioner run in the node's runtime (hq ADR 0198) jochen 2026-10-03 23:33:50 +02:00
  • efff54157b Merge pull request 'The seven say what the runtime loads from their tools bundle (hq ADR 0192)' (#243) from fix/0192-the-seven-say-what-the-runtime-loads into main mesh-admin 2026-10-03 13:58:27 +00:00
  • 2000ec3f48 The seven say what the runtime loads from their tools bundle (hq ADR 0192) jochen 2026-10-03 15:58:19 +02:00
  • 7c800705bf Merge pull request 'Seven tool containers move to bundles the node's runtime serves, given their words (hq ADR 0192)' (#242) from feat/0192-seven-tool-containers-move into main mesh-admin 2026-10-03 13:45:46 +00:00
  • 19511012f8 Seven tool containers move to bundles the node's runtime serves, given their words (hq ADR 0192) jochen 2026-10-03 15:35:00 +02:00
  • 0e8ad3a8e1 Merge pull request 'dnsmasq: restart on the mesh hosts region, which it reads only at start' (#241) from fix/dnsmasq-rereads-the-names-region into main jschoubben 2026-10-03 13:29:29 +00:00
  • b43e405947 dnsmasq: restart on the mesh's hosts region, which it reads only at start jschoubben 2026-10-03 15:29:28 +02:00
  • d5269c8662 Merge pull request 'fail2ban's tools are a bundle the node's runtime serves; its container goes (hq to-be 38 WP4)' (#240) from feat/fail2ban-tools-as-a-bundle into main mesh-admin 2026-10-03 13:07:35 +00:00
  • aa5bf7d5ef fail2ban's tools are a bundle the node's runtime serves; its container goes (hq to-be 38 WP4) jochen 2026-10-03 15:07:21 +02:00
  • 510de183b1 Merge pull request 'The packet filter's tools are a bundle the node's runtime serves; its container goes (hq to-be 38 WP4)' (#239) from feat/wp4-the-packet-filter-moves into main mesh-admin 2026-10-03 11:14:33 +00:00
  • db5e7c80cf The packet filter's tools are a bundle the node's runtime serves; its container goes (hq to-be 38 WP4) jochen 2026-10-03 12:46:35 +02:00
  • 38be3ba7f0 Merge pull request 'ssh-client: own ~/.ssh, not the openssh package' (#238) from fix/ssh-client-owns-no-package into main jschoubben 2026-10-03 10:43:46 +00:00
  • a19638d112 ssh-client: own ~/.ssh, not the openssh package jschoubben 2026-10-03 12:43:35 +02:00
  • 1cbddeb104 Merge pull request 'ssh-client module: the mesh owns ~/.ssh, config from the hub (to-be 29)' (#237) from feat/ssh-client-module into main jschoubben 2026-10-03 10:40:13 +00:00
  • 301aeda5f3 ssh-client module: the mesh owns ~/.ssh, config from the hub (to-be 29) jschoubben 2026-09-27 17:50:57 +02:00
  • 853ace3828 Merge pull request 'Retire builder: the build machine is the build-agent on every machine (hq ADR 0190)' (#236) from feat/retire-builder into main mesh-admin 2026-10-03 09:44:09 +00:00
  • 8ccc6762d4 Retire builder: the build machine is the build-agent on every machine (hq ADR 0190) jochen 2026-10-03 11:43:01 +02:00
  • 6d01007ea6 Merge pull request 'build-agent: a short slug, so its identifier on a machine fits a backend's 20-character key' (#235) from fix/build-agent-slug into main mesh-admin 2026-10-03 09:13:57 +00:00
  • 02463ba55d build-agent: a short slug, so its identifier on a machine fits a backend's 20-character key jochen 2026-10-03 11:09:24 +02:00
  • 85af10ebad Merge pull request 'step-ca: stop offering acme-ca, so public names are certified by public-acme' (#234) from fix/step-ca-is-not-the-public-acme-ca into main jschoubben 2026-10-03 08:57:25 +00:00
  • 0778f8f0ae step-ca: stop offering acme-ca, so public names are certified by public-acme jschoubben 2026-10-03 10:54:43 +02:00
  • 6afc1160b6 Merge pull request 'build-agent: the build machine as a node role every machine can hold (hq ADR 0190)' (#231) from feat/build-agent into main mesh-admin 2026-10-03 01:52:04 +00:00
  • c32edcfc6f Merge pull request 'Retire mesh-console: the console is the node-tools runtime's serving mode (hq ADR 0175 §6, to-be 38 WP3)' (#230) from feat/retire-mesh-console into main mesh-admin 2026-10-03 00:40:37 +00:00
  • 740359ffd9 Merge pull request 'Remove portainer: deprecated, and unassigned everywhere' (#233) from jschoubben/remove-portainer into main mesh-admin 2026-10-02 21:26:03 +00:00
  • a309deb479 Remove portainer: deprecated, and unassigned everywhere jschoubben 2026-10-02 23:25:45 +02:00
  • 0fd722e829 Merge pull request 'gitea: the jail also bans what gitea's sshd refuses' (#232) from jschoubben/gitea-ssh-jail into main mesh-admin 2026-10-02 21:23:44 +00:00
  • 2e6cc71f7a gitea: the jail also bans what gitea's sshd refuses jschoubben 2026-10-02 23:23:35 +02:00
  • 84403aec0c build-agent: the build machine as a node role every machine can hold (hq ADR 0190) jochen 2026-10-02 22:28:48 +02:00
  • b28b1b9f24 Retire mesh-console: the console is the node-tools runtime's serving mode (hq ADR 0175 §6, to-be 38 WP3) jochen 2026-10-02 21:58:21 +02:00
  • 810c7fbac3 Merge pull request 'A ban list never holds a neighbour (hq ADR 0186)' (#227) from fix/a-ban-list-never-holds-a-neighbour into main mesh-admin 2026-10-02 16:43:26 +00:00
  • 304044da40 A ban list never holds a neighbour (hq ADR 0186) jschoubben 2026-10-02 18:42:16 +02:00
  • 419d92e810 Merge pull request 'The proxy's jail reads a refused name as well as a refused certificate (hq ADR 0179)' (#226) from fix/the-proxys-jail-reads-both-refusals into main mesh-admin 2026-10-02 15:23:48 +00:00
  • 23112b111c The proxy's jail reads both refusals, each pattern naming the host once jschoubben 2026-10-02 17:23:42 +02:00
  • b547308e05 The proxy's jail reads a refused name as well as a refused certificate jschoubben 2026-10-02 17:20:54 +02:00
  • 3c3c5c6e03 Merge pull request 'fail2ban holds the intrusion seat's verbs and composes the jails; mail, forge and proxy declare theirs (hq ADR 0179, to-be 31)' (#225) from feat/the-intrusion-seat-serves-its-verbs into main mesh-admin 2026-10-02 15:19:20 +00:00
  • 1601d5a335 fail2ban holds the intrusion seat's verbs and composes the jails; mail, forge and proxy declare theirs (hq ADR 0179, to-be 31) jschoubben 2026-10-02 17:02:49 +02:00
  • 96b3d60a4a Merge pull request 'nftables declares the ufw front end absent once its filter is loaded (hq ADR 0175)' (#223) from feat/the-found-front-end-is-uninstalled into main mesh-admin 2026-10-02 14:38:00 +00:00
  • 3dfbad6f03 nftables declares the ufw front end absent once its filter is loaded (hq ADR 0175) jschoubben 2026-10-02 16:27:34 +02:00
  • d5c5415756 Merge pull request 'lab: the image carries python3, file, iproute2 and sudo' (#222) from jschoubben/lab-image-tools into main mesh-admin 2026-10-02 13:24:00 +00:00
  • 6dfd2401c9 lab: the image carries what the builds and the lab call: python3, file, iproute2, sudo jschoubben 2026-10-02 15:23:52 +02:00
  • 31923f70e7 Merge pull request 'lab: a run resolves the @novox scope from the forge's package registry' (#221) from jschoubben/lab-npm-scope into main mesh-admin 2026-10-02 13:13:29 +00:00
  • 8cd4f199f1 lab: a run resolves the @novox scope from the forge's package registry jschoubben 2026-10-02 15:13:22 +02:00
  • 1b9b298827 Merge pull request 'lab: compile from the module's root, so the runtime finds its tools' (#220) from jschoubben/lab-tools-path into main mesh-admin 2026-10-02 13:08:14 +00:00
  • bce7b3a551 lab: compile from the module's root, so the runtime finds its tools jschoubben 2026-10-02 15:08:01 +02:00
  • 17d3d3e63a Merge pull request 'lab: declares the virtualisation capability (hq ADR 0172)' (#218) from jschoubben/the-lab-is-a-module-2 into main mesh-admin 2026-10-02 12:53:43 +00:00
  • 5c961c446f Merge pull request 'Cite hq ADR 0170, not 0169: the firewall seat's record was renumbered' (#219) from fix/adr-0170-cited into main mesh-admin 2026-10-02 12:53:10 +00:00
  • b77582f6a6 Cite hq ADR 0170, not 0169: the firewall seat's record was renumbered after a collision on hq main jschoubben 2026-10-02 14:52:26 +02:00
  • b3865d240f lab: declares the virtualisation capability, which grants its daemon's socket jschoubben 2026-10-02 14:48:10 +02:00
  • a81b94d4ab Merge pull request 'lab: the lab as a module, running beds when the mesh asks (hq ADR 0172)' (#217) from jschoubben/the-lab-is-a-module into main mesh-admin 2026-10-02 12:17:14 +00:00
  • 67d1a400e8 lab: the lab as a module, running beds when the mesh asks jschoubben 2026-10-02 14:15:42 +02:00
  • 1c201d59c9 Merge pull request 'nftables holds the node-packet-filter seat: rules, reload and remove, from a runtime with NET_ADMIN (hq ADR 0169)' (#216) from feat/the-firewall-seat-serves-its-verbs into main mesh-admin 2026-10-02 11:33:47 +00:00
  • 663e8143d4 nftables holds the node-packet-filter seat: rules, reload and remove, from a runtime with NET_ADMIN (hq ADR 0169) jschoubben 2026-10-02 13:28:33 +02:00
  • 8ce4935132 Merge pull request 'unifi: list networks and set the DNS their DHCP hands out (hq issue 198)' (#215) from jschoubben/unifi-network-dns into main mesh-admin 2026-10-02 09:53:22 +00:00
  • d1f8ab86d1 unifi: list networks and set the DNS their DHCP hands out jschoubben 2026-10-02 11:53:16 +02:00
  • 3020cd2312 Merge pull request 'dnsmasq: listen addresses are a setting, and docker's file takes none (hq issue 198)' (#214) from jschoubben/the-lans-dns-is-the-mesh-2 into main mesh-admin 2026-10-02 09:50:09 +00:00
  • b72213261a dnsmasq: listen addresses are a setting, and docker's file takes none jschoubben 2026-10-02 11:49:57 +02:00
  • 7e5c98920e Merge pull request 'Revert dnsmasq's listen addresses as a setting (hq issue 198)' (#213) from jschoubben/revert-dnsmasq-listen into main mesh-admin 2026-10-02 09:48:49 +00:00
  • 67f5236b01 Revert dnsmasq's listen addresses as a setting jschoubben 2026-10-02 11:48:37 +02:00
  • e9876858a8 Merge pull request 'dnsmasq: the addresses it listens on beside the machine's are a setting (hq issue 198)' (#212) from jschoubben/the-lans-dns-is-the-mesh into main mesh-admin 2026-10-02 09:46:32 +00:00
  • 56a22847f5 dnsmasq: the addresses it listens on beside the machine's are a setting jschoubben 2026-10-02 11:42:41 +02:00
  • 1271f797e9 Merge pull request 'route-proxy: a bus account, to read its membership (hq ADR 0167, issue 191)' (#211) from jschoubben/an-internal-only-route into main mesh-admin 2026-10-01 23:49:50 +00:00
  • 4f952ce771 route-proxy: a bus account, to read its membership jschoubben 2026-10-02 01:46:18 +02:00
  • fec6d76fb3 Merge pull request 'mssql: the query runs as a read-only login, one line, no variables; sqlcmd is installed (hq #193)' (#210) from fix/193-mssql-reads-as-a-reader into main mesh-admin 2026-10-01 22:30:02 +00:00
  • da7355dce0 Merge pull request 'postgres: the store's query runs as a read-only login, never as the admin (hq #193)' (#209) from fix/193-the-store-reads-as-a-reader into main mesh-admin 2026-10-01 22:29:57 +00:00
  • 400b2f9696 mssql: the query runs as a read-only login, one line, no variables; sqlcmd is installed (hq #193) jschoubben 2026-10-02 00:25:22 +02:00
  • 160b5ad65a postgres: the store's query runs as a read-only login, never as the admin (hq #193) jschoubben 2026-10-02 00:09:09 +02:00
  • ef44c502db Merge pull request 'route-proxy README: the node that runs a proxy carries public-acme (hq #258)' (#208) from docs/route-proxy-carries-public-acme into main mesh-admin 2026-10-01 15:32:05 +00:00
  • 0651b63926 route-proxy README: the node that runs a proxy carries public-acme (hq #258) jschoubben 2026-10-01 17:31:58 +02:00
  • 0c521ffa20 Merge pull request 'The vault's claim, its own event names, and the uplink holders' capabilities return' (#207) from fix/the-vaults-claim-and-events-return into main mesh-admin 2026-10-01 15:19:55 +00:00
  • 01d68bda88 And the uplink holders' capabilities return jschoubben 2026-10-01 17:19:41 +02:00
  • 89e0dde9e0 The vault's claim and its own event names return jschoubben 2026-10-01 17:19:05 +02:00
  • 5ebc89d89d Merge pull request 'Each uplink holder declares the manager it speaks for (hq ADR 0161)' (#206) from feat/each-uplink-holder-declares-the-manager-it-speaks-for into main mesh-admin 2026-10-01 15:11:31 +00:00
  • 32fa76fccb Merge pull request 'The vault claims mesh-vault, and each uplink holder declares the manager it speaks for (hq ADR 0161)' (#205) from feat/the-vault-claims-its-seat-and-the-uplinks-say-their-dialect into main mesh-admin 2026-10-01 14:53:15 +00:00
  • 2e96d2f67d This branch carries the uplink capabilities alone (hq ADR 0161 rule 3); merges once every machine running a holder has reported uplink-<manager> jschoubben 2026-10-01 16:52:47 +02:00
  • 932efb5186 This branch carries the vault's claim alone; the uplink capabilities wait for every machine to report its profile jschoubben 2026-10-01 16:52:46 +02:00