59c42b2086
lab: its tools run in the node's runtime (hq ADR 0198)
jochen2026-10-04 00:36:17 +02:00
3b8164f1c0
mailu: its handlers, tools and provisioner run in the node's runtime (hq ADR 0198)
jochen2026-10-04 00:35:30 +02:00
8877f893e5
records: its consumer and tools run in the node's runtime (hq ADR 0198)
jochen2026-10-04 00:34:57 +02:00
043ae17fbf
mesh-vault: its handlers, tools and provisioner run in the node's runtime (hq ADR 0198)
jochen2026-10-04 00:34:25 +02:00
944f086ec7
gitea: its watcher, tools and provisioner run in the node's runtime (hq ADR 0198)
jochen2026-10-04 00:34:00 +02:00
dd93cfd613
audit-logger: its handler runs in the node's runtime (hq ADR 0198)
jochen2026-10-04 00:32:59 +02:00
64cc292d7e
Merge pull request 'Wave 1: thirteen modules' code moves into bundles the node's runtime serves (hq ADR 0198, to-be 38 WP4c)' (#245) from feat/0198-wave-1-module-code-moves into main
mesh-admin2026-10-03 22:52:08 +00:00
7e889adf71
Merge pull request 'netcheck: one module, a Go tools bundle and a TypeScript one (hq ADR 0188, 0193)' (#246) from feat/netcheck-a-module-in-two-languages into main
mesh-admin2026-10-03 22:35:32 +00:00
7e9ef899c1
netcheck: one module, a Go tools bundle and a TypeScript one (hq ADR 0188, 0193)
jochen2026-10-04 00:34:31 +02:00
03e729d103
claude-code owns /etc/claude-code and ~/.claude as declared directories
jochen2026-10-03 23:49:16 +02:00
eab335b755
claude-code: launched over stdio (ADR 0193), the console's five tools in its instructions (ADR 0195)
jochen2026-10-03 23:41:01 +02:00
f42b58f789
claude-code: the manifest, the managed directory and the tools (hq design 36, to-be 40 WP2)
jochen2026-10-03 16:13:01 +02:00
5737752744
claude-code: the sealed hand-over, the credentials write with the lineage rule, the identity read (hq to-be 40 WP2, in progress)
jochen2026-10-03 16:05:58 +02:00
f79199777d
minio: its tools and provisioner run in the node's runtime (hq ADR 0198)
jochen2026-10-03 23:33:51 +02:00
b9d0884335
nextcloud: its handlers and tools run in the node's runtime (hq ADR 0198)
jochen2026-10-03 23:33:51 +02:00
6a6d5747a3
nodered: the runtime serves its tools, and its mqtt step is a run-once process (hq ADR 0198)
jochen2026-10-03 23:33:51 +02:00
b19c4a2593
home-assistant: the runtime serves its code, and its provisions step is a run-once process (hq ADR 0198)
jochen2026-10-03 23:33:51 +02:00
a934e2a69f
icecast: its handlers and tools run in the node's runtime (hq ADR 0198)
jochen2026-10-03 23:33:51 +02:00
af346f6066
grafana: its handlers and tools run in the node's runtime (hq ADR 0198)
jochen2026-10-03 23:33:51 +02:00
7b0cfceb68
cloudflare-dns: its tools and provisioner run in the node's runtime (hq ADR 0198)
jochen2026-10-03 23:33:51 +02:00
26021865c1
umami: its tools and provisioner run in the node's runtime (hq ADR 0198)
jochen2026-10-03 23:33:51 +02:00
7440b8d009
keycloak: its handlers, tools and provisioner run in the node's runtime (hq ADR 0198)
jochen2026-10-03 23:33:51 +02:00
0cb67e856f
influxdb: its tools and provisioner run in the node's runtime (hq ADR 0198)
jochen2026-10-03 23:33:51 +02:00
038a0a25ce
mosquitto: the runtime serves its code, and its bootstrap is a run-once process (hq ADR 0198)
jochen2026-10-03 23:33:50 +02:00
1b27ce319a
redis: its handlers, tools and provisioner run in the node's runtime (hq ADR 0198)
jochen2026-10-03 23:33:50 +02:00
7563569c8a
postgres: its handlers, tools and provisioner run in the node's runtime (hq ADR 0198)
jochen2026-10-03 23:33:50 +02:00
efff54157b
Merge pull request 'The seven say what the runtime loads from their tools bundle (hq ADR 0192)' (#243) from fix/0192-the-seven-say-what-the-runtime-loads into main
mesh-admin2026-10-03 13:58:27 +00:00
2000ec3f48
The seven say what the runtime loads from their tools bundle (hq ADR 0192)
jochen2026-10-03 15:58:19 +02:00
7c800705bf
Merge pull request 'Seven tool containers move to bundles the node's runtime serves, given their words (hq ADR 0192)' (#242) from feat/0192-seven-tool-containers-move into main
mesh-admin2026-10-03 13:45:46 +00:00
19511012f8
Seven tool containers move to bundles the node's runtime serves, given their words (hq ADR 0192)
jochen2026-10-03 15:35:00 +02:00
0e8ad3a8e1
Merge pull request 'dnsmasq: restart on the mesh hosts region, which it reads only at start' (#241) from fix/dnsmasq-rereads-the-names-region into main
jschoubben2026-10-03 13:29:29 +00:00
b43e405947
dnsmasq: restart on the mesh's hosts region, which it reads only at start
jschoubben2026-10-03 15:29:28 +02:00
d5269c8662
Merge pull request 'fail2ban's tools are a bundle the node's runtime serves; its container goes (hq to-be 38 WP4)' (#240) from feat/fail2ban-tools-as-a-bundle into main
mesh-admin2026-10-03 13:07:35 +00:00
aa5bf7d5ef
fail2ban's tools are a bundle the node's runtime serves; its container goes (hq to-be 38 WP4)
jochen2026-10-03 15:07:21 +02:00
510de183b1
Merge pull request 'The packet filter's tools are a bundle the node's runtime serves; its container goes (hq to-be 38 WP4)' (#239) from feat/wp4-the-packet-filter-moves into main
mesh-admin2026-10-03 11:14:33 +00:00
db5e7c80cf
The packet filter's tools are a bundle the node's runtime serves; its container goes (hq to-be 38 WP4)
jochen2026-10-03 12:46:35 +02:00
38be3ba7f0
Merge pull request 'ssh-client: own ~/.ssh, not the openssh package' (#238) from fix/ssh-client-owns-no-package into main
jschoubben2026-10-03 10:43:46 +00:00
a19638d112
ssh-client: own ~/.ssh, not the openssh package
jschoubben2026-10-03 12:43:35 +02:00
1cbddeb104
Merge pull request 'ssh-client module: the mesh owns ~/.ssh, config from the hub (to-be 29)' (#237) from feat/ssh-client-module into main
jschoubben2026-10-03 10:40:13 +00:00
301aeda5f3
ssh-client module: the mesh owns ~/.ssh, config from the hub (to-be 29)
jschoubben2026-09-27 17:50:57 +02:00
853ace3828
Merge pull request 'Retire builder: the build machine is the build-agent on every machine (hq ADR 0190)' (#236) from feat/retire-builder into main
mesh-admin2026-10-03 09:44:09 +00:00
8ccc6762d4
Retire builder: the build machine is the build-agent on every machine (hq ADR 0190)
jochen2026-10-03 11:43:01 +02:00
6d01007ea6
Merge pull request 'build-agent: a short slug, so its identifier on a machine fits a backend's 20-character key' (#235) from fix/build-agent-slug into main
mesh-admin2026-10-03 09:13:57 +00:00
02463ba55d
build-agent: a short slug, so its identifier on a machine fits a backend's 20-character key
jochen2026-10-03 11:09:24 +02:00
85af10ebad
Merge pull request 'step-ca: stop offering acme-ca, so public names are certified by public-acme' (#234) from fix/step-ca-is-not-the-public-acme-ca into main
jschoubben2026-10-03 08:57:25 +00:00
0778f8f0ae
step-ca: stop offering acme-ca, so public names are certified by public-acme
jschoubben2026-10-03 10:54:43 +02:00
6afc1160b6
Merge pull request 'build-agent: the build machine as a node role every machine can hold (hq ADR 0190)' (#231) from feat/build-agent into main
mesh-admin2026-10-03 01:52:04 +00:00
c32edcfc6f
Merge pull request 'Retire mesh-console: the console is the node-tools runtime's serving mode (hq ADR 0175 §6, to-be 38 WP3)' (#230) from feat/retire-mesh-console into main
mesh-admin2026-10-03 00:40:37 +00:00
740359ffd9
Merge pull request 'Remove portainer: deprecated, and unassigned everywhere' (#233) from jschoubben/remove-portainer into main
mesh-admin2026-10-02 21:26:03 +00:00
a309deb479
Remove portainer: deprecated, and unassigned everywhere
jschoubben2026-10-02 23:25:45 +02:00
0fd722e829
Merge pull request 'gitea: the jail also bans what gitea's sshd refuses' (#232) from jschoubben/gitea-ssh-jail into main
mesh-admin2026-10-02 21:23:44 +00:00
2e6cc71f7a
gitea: the jail also bans what gitea's sshd refuses
jschoubben2026-10-02 23:23:35 +02:00
84403aec0c
build-agent: the build machine as a node role every machine can hold (hq ADR 0190)
jochen2026-10-02 22:28:48 +02:00
b28b1b9f24
Retire mesh-console: the console is the node-tools runtime's serving mode (hq ADR 0175 §6, to-be 38 WP3)
jochen2026-10-02 21:58:21 +02:00
810c7fbac3
Merge pull request 'A ban list never holds a neighbour (hq ADR 0186)' (#227) from fix/a-ban-list-never-holds-a-neighbour into main
mesh-admin2026-10-02 16:43:26 +00:00
304044da40
A ban list never holds a neighbour (hq ADR 0186)
jschoubben2026-10-02 18:42:16 +02:00
419d92e810
Merge pull request 'The proxy's jail reads a refused name as well as a refused certificate (hq ADR 0179)' (#226) from fix/the-proxys-jail-reads-both-refusals into main
mesh-admin2026-10-02 15:23:48 +00:00
23112b111c
The proxy's jail reads both refusals, each pattern naming the host once
jschoubben2026-10-02 17:23:42 +02:00
b547308e05
The proxy's jail reads a refused name as well as a refused certificate
jschoubben2026-10-02 17:20:54 +02:00
3c3c5c6e03
Merge pull request 'fail2ban holds the intrusion seat's verbs and composes the jails; mail, forge and proxy declare theirs (hq ADR 0179, to-be 31)' (#225) from feat/the-intrusion-seat-serves-its-verbs into main
mesh-admin2026-10-02 15:19:20 +00:00
1601d5a335
fail2ban holds the intrusion seat's verbs and composes the jails; mail, forge and proxy declare theirs (hq ADR 0179, to-be 31)
jschoubben2026-10-02 17:02:49 +02:00
96b3d60a4a
Merge pull request 'nftables declares the ufw front end absent once its filter is loaded (hq ADR 0175)' (#223) from feat/the-found-front-end-is-uninstalled into main
mesh-admin2026-10-02 14:38:00 +00:00
3dfbad6f03
nftables declares the ufw front end absent once its filter is loaded (hq ADR 0175)
jschoubben2026-10-02 16:27:34 +02:00
d5c5415756
Merge pull request 'lab: the image carries python3, file, iproute2 and sudo' (#222) from jschoubben/lab-image-tools into main
mesh-admin2026-10-02 13:24:00 +00:00
6dfd2401c9
lab: the image carries what the builds and the lab call: python3, file, iproute2, sudo
jschoubben2026-10-02 15:23:52 +02:00
31923f70e7
Merge pull request 'lab: a run resolves the @novox scope from the forge's package registry' (#221) from jschoubben/lab-npm-scope into main
mesh-admin2026-10-02 13:13:29 +00:00
8cd4f199f1
lab: a run resolves the @novox scope from the forge's package registry
jschoubben2026-10-02 15:13:22 +02:00
1b9b298827
Merge pull request 'lab: compile from the module's root, so the runtime finds its tools' (#220) from jschoubben/lab-tools-path into main
mesh-admin2026-10-02 13:08:14 +00:00
bce7b3a551
lab: compile from the module's root, so the runtime finds its tools
jschoubben2026-10-02 15:08:01 +02:00
17d3d3e63a
Merge pull request 'lab: declares the virtualisation capability (hq ADR 0172)' (#218) from jschoubben/the-lab-is-a-module-2 into main
mesh-admin2026-10-02 12:53:43 +00:00
5c961c446f
Merge pull request 'Cite hq ADR 0170, not 0169: the firewall seat's record was renumbered' (#219) from fix/adr-0170-cited into main
mesh-admin2026-10-02 12:53:10 +00:00
b77582f6a6
Cite hq ADR 0170, not 0169: the firewall seat's record was renumbered after a collision on hq main
jschoubben2026-10-02 14:52:26 +02:00
b3865d240f
lab: declares the virtualisation capability, which grants its daemon's socket
jschoubben2026-10-02 14:48:10 +02:00
a81b94d4ab
Merge pull request 'lab: the lab as a module, running beds when the mesh asks (hq ADR 0172)' (#217) from jschoubben/the-lab-is-a-module into main
mesh-admin2026-10-02 12:17:14 +00:00
67d1a400e8
lab: the lab as a module, running beds when the mesh asks
jschoubben2026-10-02 14:15:42 +02:00
1c201d59c9
Merge pull request 'nftables holds the node-packet-filter seat: rules, reload and remove, from a runtime with NET_ADMIN (hq ADR 0169)' (#216) from feat/the-firewall-seat-serves-its-verbs into main
mesh-admin2026-10-02 11:33:47 +00:00
663e8143d4
nftables holds the node-packet-filter seat: rules, reload and remove, from a runtime with NET_ADMIN (hq ADR 0169)
jschoubben2026-10-02 13:28:33 +02:00
8ce4935132
Merge pull request 'unifi: list networks and set the DNS their DHCP hands out (hq issue 198)' (#215) from jschoubben/unifi-network-dns into main
mesh-admin2026-10-02 09:53:22 +00:00
d1f8ab86d1
unifi: list networks and set the DNS their DHCP hands out
jschoubben2026-10-02 11:53:16 +02:00
3020cd2312
Merge pull request 'dnsmasq: listen addresses are a setting, and docker's file takes none (hq issue 198)' (#214) from jschoubben/the-lans-dns-is-the-mesh-2 into main
mesh-admin2026-10-02 09:50:09 +00:00
b72213261a
dnsmasq: listen addresses are a setting, and docker's file takes none
jschoubben2026-10-02 11:49:57 +02:00
7e5c98920e
Merge pull request 'Revert dnsmasq's listen addresses as a setting (hq issue 198)' (#213) from jschoubben/revert-dnsmasq-listen into main
mesh-admin2026-10-02 09:48:49 +00:00
67f5236b01
Revert dnsmasq's listen addresses as a setting
jschoubben2026-10-02 11:48:37 +02:00
e9876858a8
Merge pull request 'dnsmasq: the addresses it listens on beside the machine's are a setting (hq issue 198)' (#212) from jschoubben/the-lans-dns-is-the-mesh into main
mesh-admin2026-10-02 09:46:32 +00:00
56a22847f5
dnsmasq: the addresses it listens on beside the machine's are a setting
jschoubben2026-10-02 11:42:41 +02:00
1271f797e9
Merge pull request 'route-proxy: a bus account, to read its membership (hq ADR 0167, issue 191)' (#211) from jschoubben/an-internal-only-route into main
mesh-admin2026-10-01 23:49:50 +00:00
4f952ce771
route-proxy: a bus account, to read its membership
jschoubben2026-10-02 01:46:18 +02:00
fec6d76fb3
Merge pull request 'mssql: the query runs as a read-only login, one line, no variables; sqlcmd is installed (hq #193)' (#210) from fix/193-mssql-reads-as-a-reader into main
mesh-admin2026-10-01 22:30:02 +00:00
da7355dce0
Merge pull request 'postgres: the store's query runs as a read-only login, never as the admin (hq #193)' (#209) from fix/193-the-store-reads-as-a-reader into main
mesh-admin2026-10-01 22:29:57 +00:00
400b2f9696
mssql: the query runs as a read-only login, one line, no variables; sqlcmd is installed (hq #193)
jschoubben2026-10-02 00:25:22 +02:00
160b5ad65a
postgres: the store's query runs as a read-only login, never as the admin (hq #193)
jschoubben2026-10-02 00:09:09 +02:00
ef44c502db
Merge pull request 'route-proxy README: the node that runs a proxy carries public-acme (hq #258)' (#208) from docs/route-proxy-carries-public-acme into main
mesh-admin2026-10-01 15:32:05 +00:00
0651b63926
route-proxy README: the node that runs a proxy carries public-acme (hq #258)
jschoubben2026-10-01 17:31:58 +02:00
0c521ffa20
Merge pull request 'The vault's claim, its own event names, and the uplink holders' capabilities return' (#207) from fix/the-vaults-claim-and-events-return into main
mesh-admin2026-10-01 15:19:55 +00:00
01d68bda88
And the uplink holders' capabilities return
jschoubben2026-10-01 17:19:41 +02:00
89e0dde9e0
The vault's claim and its own event names return
jschoubben2026-10-01 17:19:05 +02:00
5ebc89d89d
Merge pull request 'Each uplink holder declares the manager it speaks for (hq ADR 0161)' (#206) from feat/each-uplink-holder-declares-the-manager-it-speaks-for into main
mesh-admin2026-10-01 15:11:31 +00:00
32fa76fccb
Merge pull request 'The vault claims mesh-vault, and each uplink holder declares the manager it speaks for (hq ADR 0161)' (#205) from feat/the-vault-claims-its-seat-and-the-uplinks-say-their-dialect into main
mesh-admin2026-10-01 14:53:15 +00:00
2e96d2f67d
This branch carries the uplink capabilities alone (hq ADR 0161 rule 3); merges once every machine running a holder has reported uplink-<manager>
jschoubben2026-10-01 16:52:47 +02:00
932efb5186
This branch carries the vault's claim alone; the uplink capabilities wait for every machine to report its profile
jschoubben2026-10-01 16:52:46 +02:00