Commit Graph

Select branches

Hide Pull Requests

feat/1126-seed-4

feat/47-G-join11

feat/774-vault-mints

feat/bus-websocket-listener

feat/judge-once-pkgs

feat/l5-l7

feat/l5-l7-a3

feat/mail-list

feat/modules-name-no-node

feat/r4c5-checker

feat/r4d-automx-go

feat/r4d-n8n

feat/r4e-buildmods

feat/r4e-gate

feat/r4e-leaf

feat/r4g-finish-1935

feat/r4g-finish-composer

feat/try-speed

fix/1106-sdk-member-merges

fix/1129-no-drift-pass

fix/1165-fill-retry

fix/1275-group-merges-whole-or-not

fix/1748-retake-and-resolver

fix/1901

fix/1901-node-test-cause

fix/1921-every-failure

fix/1945-adopt-hashes

fix/1945-vault-hashing

fix/1966-gate-record-catalog

fix/270-nats-emits-bus-faults

fix/340-tool-servers-only-from-the-terminal

fix/47-G-start-2

fix/613-home-network-shares

fix/628-modules-declare-every-package-they-need

fix/check-every-failure

fix/check-names-every-conflict

fix/check-speed

fix/checker-full-failure

fix/claude-code-tips-preference

fix/forge-requires-no-status

fix/r4e-k1

fix/r4e-k2

fix/r4e-r2

fix/turn-handed-on-approve

fix/xterm-config-defaults

main

pin/sdk1

pre/registry-milestone

probe/1126-seed-10

probe/1126-seed-5

probe/1126-seed-6

probe/1126-seed-7

probe/1126-seed-8

probe/1126-seed-9

revert/1126-seed-2

revert/774-l3

#1

#10

#100

#101

#102

#103

#104

#105

#106

#107

#108

#109

#11

#110

#111

#112

#113

#114

#115

#116

#117

#118

#119

#12

#120

#121

#122

#123

#124

#125

#126

#127

#128

#129

#13

#130

#131

#132

#133

#134

#135

#136

#137

#138

#139

#14

#140

#141

#142

#143

#144

#145

#146

#147

#148

#149

#15

#150

#151

#152

#153

#154

#155

#156

#157

#158

#159

#16

#160

#161

#162

#163

#164

#165

#166

#167

#168

#169

#17

#170

#171

#172

#173

#174

#175

#176

#177

#178

#179

#18

#180

#181

#182

#183

#184

#185

#186

#187

#188

#189

#19

#190

#191

#192

#193

#194

#195

#196

#197

#198

#199

#2

#20

#200

#201

#202

#203

#204

#205

#206

#207

#208

#209

#21

#210

#211

#212

#213

#214

#215

#216

#217

#218

#219

#22

#220

#221

#222

#223

#224

#225

#226

#227

#228

#229

#23

#230

#231

#232

#233

#234

#235

#236

#237

#238

#239

#24

#240

#241

#242

#243

#244

#245

#246

#247

#248

#249

#25

#250

#251

#252

#253

#254

#255

#256

#257

#258

#259

#26

#260

#261

#262

#263

#264

#265

#266

#267

#268

#269

#27

#270

#271

#272

#273

#274

#275

#276

#277

#278

#279

#28

#280

#281

#282

#283

#284

#285

#286

#287

#288

#289

#29

#290

#291

#292

#293

#294

#295

#296

#297

#298

#299

#3

#30

#300

#301

#302

#303

#304

#305

#306

#307

#308

#309

#31

#310

#311

#312

#313

#314

#315

#316

#317

#318

#319

#32

#320

#321

#322

#323

#324

#325

#326

#327

#328

#329

#33

#330

#331

#332

#333

#334

#335

#336

#337

#338

#339

#34

#340

#341

#342

#343

#344

#345

#346

#347

#348

#349

#35

#350

#351

#352

#353

#354

#355

#356

#357

#358

#359

#36

#360

#361

#362

#363

#364

#365

#366

#367

#368

#369

#37

#370

#371

#372

#373

#374

#375

#376

#377

#378

#379

#38

#380

#381

#382

#383

#384

#385

#386

#387

#388

#389

#39

#390

#391

#392

#393

#394

#395

#396

#397

#398

#399

#4

#40

#400

#401

#402

#403

#404

#405

#406

#407

#408

#409

#41

#410

#411

#412

#413

#414

#415

#416

#417

#418

#419

#42

#420

#421

#422

#423

#424

#425

#426

#427

#428

#429

#43

#430

#431

#432

#433

#434

#435

#436

#437

#438

#439

#44

#440

#441

#442

#443

#444

#445

#446

#447

#448

#449

#45

#450

#451

#452

#453

#454

#455

#456

#457

#458

#459

#46

#460

#461

#462

#463

#464

#465

#466

#467

#468

#469

#47

#470

#471

#472

#473

#474

#475

#476

#477

#478

#479

#48

#480

#481

#482

#483

#484

#485

#486

#487

#488

#489

#49

#490

#491

#492

#493

#494

#495

#496

#497

#498

#499

#5

#50

#500

#501

#502

#503

#504

#505

#506

#507

#508

#509

#51

#510

#511

#512

#513

#514

#515

#516

#517

#518

#519

#52

#520

#521

#522

#523

#524

#525

#526

#527

#528

#529

#53

#530

#531

#532

#533

#534

#535

#536

#537

#538

#539

#54

#540

#541

#542

#543

#544

#545

#546

#547

#548

#549

#55

#550

#551

#552

#553

#554

#555

#556

#557

#558

#559

#56

#560

#561

#562

#563

#564

#565

#566

#567

#568

#569

#57

#570

#571

#572

#573

#574

#575

#576

#577

#578

#579

#58

#580

#581

#582

#583

#584

#585

#586

#587

#588

#589

#59

#590

#591

#592

#593

#594

#595

#596

#597

#598

#599

#6

#60

#600

#601

#602

#603

#604

#605

#606

#607

#608

#609

#61

#610

#611

#612

#613

#614

#615

#616

#617

#618

#619

#62

#620

#621

#622

#623

#624

#625

#626

#627

#628

#629

#63

#630

#631

#632

#633

#634

#635

#636

#637

#638

#639

#64

#640

#641

#642

#643

#644

#645

#646

#647

#648

#649

#65

#650

#651

#652

#653

#654

#655

#656

#657

#658

#659

#66

#660

#661

#662

#663

#664

#665

#666

#667

#668

#669

#67

#670

#671

#672

#673

#674

#675

#676

#677

#678

#679

#68

#69

#7

#70

#71

#72

#73

#74

#75

#76

#77

#78

#79

#8

#80

#81

#82

#83

#84

#85

#86

#87

#88

#89

#9

#90

#91

#92

#93

#94

#95

#96

#97

#98

#99

Mono Color

• df0e9017e0 nextcloud: set OBJECTSTORE_S3_REGION to match minio's actual region jschoubben 2026-09-25 14:12:05 +02:00
• b60dd5e3e3 nextcloud: use a module-owned mesh-admin account instead of 'admin' jschoubben 2026-09-25 13:51:40 +02:00
• b865978e19 nextcloud: use a named build stage for docker:cli, not ARG-in-COPY-from jschoubben 2026-09-25 13:49:02 +02:00
• cdbc850c52 nextcloud: declare docker:cli as a pinned build.on base jschoubben 2026-09-25 13:48:00 +02:00
• e2b3723dd9 nextcloud: fix hardcoded sidecar port and missing docker CLI in runtime image jschoubben 2026-09-25 13:47:03 +02:00
• 5f74c41a3e nextcloud: give the admin password a real _FILE variant, not an env-file jschoubben 2026-09-25 13:42:21 +02:00
• 4329ca9392 nextcloud: deliver the admin password to the sidecar too jschoubben 2026-09-25 13:41:17 +02:00
• 066254e5c4 nextcloud: pin an image whose PHP matches this Nextcloud version jschoubben 2026-09-25 13:39:16 +02:00
• 440e3e446e minio: set the region to eu-west, matching where this mesh actually runs jschoubben 2026-09-25 10:45:01 +02:00
• 20df40c949 minio: revert to single-node after measuring the real cost of sharding jschoubben 2026-09-24 23:07:02 +02:00
• 6a6dd4a7dc minio: name the network minio-net, not minio jschoubben 2026-09-24 20:31:20 +02:00
• 973d80aaa2 minio: publish both public routes now that a module can answer route twice jschoubben 2026-09-24 18:45:52 +02:00
• 945390e59a minio: run the real 4-node/8-drive erasure-coded cluster, not a single container jschoubben 2026-09-24 18:31:38 +02:00
• 49c5903861 Merge pull request 'minio: repin to pgsty's fork, build the runtime sidecar, move data off HAL's live drive' (#57) from fix/minio-repin-and-move-off-hal-data into main jschoubben 2026-09-24 16:15:09 +00:00
• 35e8a3fe19 minio: repin to pgsty's fork, build the runtime sidecar, move data off HAL's live drive jschoubben 2026-09-24 17:55:49 +02:00
• ed0f4602a6 keycloak: use Hostname v2's actual config shape, not v1's deprecated flags jschoubben 2026-09-24 17:27:04 +02:00
• 13d0361640 keycloak: carry over HAL's hostname/proxy settings, dropped during conversion jschoubben 2026-09-24 17:25:16 +02:00
• 61eb201f8a postgres: declare the data directory's real owner; keycloak: use the port template jschoubben 2026-09-24 16:39:11 +02:00
• 5c3781d8c2 Merge pull request '4 modules: persistent data is a directory bind, never a named volume' (#54) from fix/persistent-data-is-a-directory-bind-not-a-volume into main jschoubben 2026-09-24 14:24:15 +00:00
• 6a3e0ab9d3 4 modules: persistent data is a directory bind, never a named volume jschoubben 2026-09-24 16:12:03 +02:00
• 3e8ecfa4eb Merge pull request '11 modules: a container's ports say the software's port, not the machine's' (#53) from fix/091-ports-machine-side-is-the-mesh-to-assign into main jschoubben 2026-09-24 13:53:34 +00:00
• 12f885ffc5 11 modules: a container's ports say the software's port, not the machine's jschoubben 2026-09-24 15:45:58 +02:00
• 7551a65579 Merge pull request 'postgres: the provisioner connects to mesh-store's actual port, not a hardcoded 5432' (#52) from fix/postgres-provisioner-connects-to-the-actual-store-port into main jschoubben 2026-09-24 13:38:45 +00:00
• 135101ce6e postgres: fix the port override properly — a twin variable, not a raw substitution jschoubben 2026-09-24 15:27:16 +02:00
• 088022d63b postgres: the provisioner connects to mesh-store's actual port, not a hardcoded 5432 jschoubben 2026-09-24 15:24:07 +02:00
• 415ad7a168 Merge pull request 'gitea: the token needs read:user, not just write:repository and write:issue' (#51) from fix/gitea-user-repos-scope into main jschoubben 2026-09-24 09:49:36 +00:00
• aaf341a2d8 gitea: the token needs read:user, not just write:repository and write:issue jschoubben 2026-09-24 11:43:46 +02:00
• 8a458aa5c4 Merge pull request 'The forge mints its own API token with the admin account the vault delivers' (#49) from fix/gitea-mints-its-token into main jschoubben 2026-09-24 08:41:13 +00:00
• d036b43bfc Merge main into fix/gitea-mints-its-token to pick up the resolver conversion and artifact-store seat fix jschoubben 2026-09-24 10:40:57 +02:00
• 5a94b78891 Merge pull request 'Convert the resolver from the module it replaces: forward, answer at 127.0.0.1, point the runtime at it' (#50) from convert/dnsmasq-from-hal into main jschoubben 2026-09-23 23:13:08 +00:00
• 3d81bf41c6 Convert the resolver from the module it replaces: forward, answer at 127.0.0.1, point the runtime at it jschoubben 2026-09-23 23:53:51 +02:00
• ed094031fd The forge mints its own API token with the admin account the vault delivers jschoubben 2026-09-23 23:48:36 +02:00
• 4d8be01c5f Merge pull request 'The artifact store's seat is one per mesh' (#48) from fix/the-artifact-store-is-one-per-mesh into main jschoubben 2026-09-23 21:42:25 +00:00
• 833d8ec3ec The artifact store's seat is one per mesh jschoubben 2026-09-23 23:40:54 +02:00
• 9f2c678355 Merge pull request 'Convert mssql from the module it replaces, not from a blank page' (#46) from convert/mssql-from-hal into main jschoubben 2026-09-23 18:22:51 +00:00
• cae0d00a7d Convert mssql from the module it replaces, not from a blank page jschoubben 2026-09-23 20:22:34 +02:00
• c001e054fd Merge pull request 'Pin the analytics module to the version the machine it replaces is running' (#45) from fix/umami-matches-production into main jschoubben 2026-09-23 00:48:13 +00:00
• b69edbb16f Pin the analytics module to the version the machine it replaces is running jschoubben 2026-09-23 02:47:23 +02:00
• b0d48d5c54 Merge pull request 'Pin the package registry to the version the machine it replaces is running' (#44) from fix/verdaccio-matches-production into main jschoubben 2026-09-23 00:37:31 +00:00
• a3eca8f4e6 Pin the package registry to the version the machine it replaces is running: 6.10.3, not 6.10.1 jschoubben 2026-09-23 02:24:07 +02:00
• f11534102d Merge pull request 'Pin the forge to the version the machine it replaces is running' (#43) from fix/gitea-matches-production into main jschoubben 2026-09-23 00:28:26 +02:00
• a29475617a Pin the forge to the version the machine it replaces is running: 1.27.3, not 1.22.6 jschoubben 2026-09-23 00:28:11 +02:00
• 176bbd6085 Merge pull request 'route-adapter: provide route by writing into the predecessor's proxy (hq ADR 0104)' (#42) from feat/route-adapter into main jschoubben 2026-09-23 00:12:48 +02:00
• bd5b349a0d route-adapter: provide route by writing into the predecessor's proxy (hq ADR 0104) jschoubben 2026-09-23 00:11:21 +02:00
• 4f4a0750de Merge pull request 'The store keeps the vector extension the predecessor's database had' (#41) from fix/store-keeps-pgvector into main jschoubben 2026-09-22 23:30:34 +02:00
• 5eb1baf5fe Keep the vector extension the predecessor's database had: the store runs the pgvector build of the same major jschoubben 2026-09-22 23:30:21 +02:00
• d0fed5b982 Merge pull request 'The forge's own address follows the port the node gave it (hq issue 088)' (#40) from feat/forge-address into main jschoubben 2026-09-22 23:29:47 +02:00
• cf30d4b3d0 The forge's sidecar dials the port the machine put the forge on (hq issue 088) jschoubben 2026-09-22 22:36:34 +02:00
• 5706c00566 Merge pull request 'The builder's package binding is settable per node (hq issue 085)' (#39) from feat/packages-port into main jschoubben 2026-09-22 21:59:57 +02:00
• b2e29871fd Protect the address the builder sends its registry password to jschoubben 2026-09-22 21:56:51 +02:00
• d63f006cb8 The builder's package binding takes its port from the node, not from the manifest jschoubben 2026-09-22 21:39:54 +02:00
• 6e88982498 Merge pull request 'Adoption mode: guards, and a filter unit that never flushes the ruleset (hq ADR 0100, 0103)' (#38) from feat/adoption-mode into main jschoubben 2026-09-22 21:01:56 +02:00
• 90104d0818 Reload the filter on a rule change rather than restart it, so the node is never unfiltered in between (hq ADR 0102) jschoubben 2026-09-22 19:47:43 +02:00
• 84012fab2e Make the stock nftables unit's stop delete only the mesh's table on nodes that still have it enabled (hq ADR 0100) jschoubben 2026-09-22 18:06:15 +02:00
• 0c37d7389d Guard the store and management ports on adopted nodes, and load the filter through a unit that never flushes the ruleset (hq ADR 0100) jschoubben 2026-09-22 17:32:26 +02:00
• f4097b3c57 Merge pull request 'n8n and baserow no longer take the shared cache (issue 081)' (#37) from multiple-fixes into main jschoubben 2026-09-22 13:53:14 +02:00
• 431627c510 baserow: its data directory is 0755, as the image ships it — the cache it runs for itself does so as another user, who must reach its own directory beneath (issue 081) jschoubben 2026-09-22 13:46:01 +02:00
• 93634041db baserow: its texts no longer name the shared cache it stopped taking jschoubben 2026-09-22 12:34:58 +02:00
• 24cbac816d n8n and baserow no longer take the shared cache: neither can keep its keys and channels under the login it is granted — baserow runs its own, n8n in its shipped mode needs none (novox/hq issue 081) jschoubben 2026-09-22 12:26:33 +02:00
• b2a48558ea Merge pull request 'redis: a consumer's ACL loses the dangerous category (issue 080)' (#36) from multiple-fixes into main jschoubben 2026-09-22 02:19:14 +02:00
• c71bbd497f redis: INFO is allowed back — client libraries ask it at connect, and it reads nothing a consumer keeps jschoubben 2026-09-22 02:03:23 +02:00
• 421f4d8577 redis: a consumer's ACL loses the dangerous category — a key pattern does not confine FLUSHALL (novox/hq issue 080) jschoubben 2026-09-22 01:39:29 +02:00
• 54af5e8536 Merge pull request 'route-proxy: the trust gate names the binding it reads; the server names the gate (ADR 0099)' (#35) from multiple-fixes into main jschoubben 2026-09-21 23:58:48 +02:00
• 6fb2003b8d route-proxy: the trust gate names the binding it reads and runs again when the authority moved; the server follows it (ADR 0099) jschoubben 2026-09-21 23:25:06 +02:00
• 64d62978f6 Merge pull request 'Multiple fixes: five modules keep their secrets from the vault (ADR 0094), the authority makes its own root (076), the builder on the host network, route-proxy declares its bases' (#34) from multiple-fixes into main jschoubben 2026-09-21 22:58:24 +02:00
• ac651c7ac2 route-proxy: the trust container names its artifact jschoubben 2026-09-21 22:55:35 +02:00
• 1c964cd571 route-proxy: the trust gate retries with a timeout and checks for a certificate; its images are declared artifacts (ADRs 0096, 0097, 0098) jschoubben 2026-09-21 22:53:29 +02:00
• 28b8feebfc The authority makes its own root at first start, and the proxy fetches it through a gate jschoubben 2026-09-21 22:26:28 +02:00
• 82256fcdb0 The builder runs on the machine's network: it copies images into the mesh's registry itself now jschoubben 2026-09-21 22:24:43 +02:00
• facd41806d Five modules keep their own secrets from the vault, under local names; route-proxy declares its bases jschoubben 2026-09-21 22:16:10 +02:00
• 126969a829 Merge pull request 'The controller's manifest lives in the controller's repository, not here (hq issue 072)' (#33) from feat/one-controller-manifest into main jschoubben 2026-09-21 19:23:18 +02:00
• a514d9827c The controller's manifest lives in the controller's repository, not here jschoubben 2026-09-21 15:17:47 +02:00
• e0d34723f7 Merge pull request 'Six modules take their secrets from files; the rest say precisely why not (issue 041)' (#32) from feat/migration-blockers into main jschoubben 2026-09-21 13:48:46 +02:00
• 1289510538 mongodb names its secrets' owner: the image drops to its own user before it reads the password file jschoubben 2026-09-21 13:43:41 +02:00
• 50b639ff52 The env-file references to files the conversion removed go with them jschoubben 2026-09-21 12:43:41 +02:00
• 0b2f3bfbd3 grafana stays a declared exception until a bed exercises its admin password jschoubben 2026-09-21 12:31:59 +02:00
• 1a28e5aec6 Six modules take their secrets from files; the rest say precisely why not jschoubben 2026-09-21 12:29:25 +02:00
• db597bcb71 Merge pull request 'The controller reads its credentials from files; every other env-file secret says why' (#31) from feat/secret-not-in-environment into main jschoubben 2026-09-21 11:59:08 +02:00
• 8647ea6671 The control plane's secret files belong to its own account (secrets-owner) jschoubben 2026-09-21 10:19:00 +02:00
• 32dec5f0c2 The controller reads its credentials from files; every other env-file secret says why jschoubben 2026-09-21 10:10:33 +02:00
• d03520f4ed Merge pull request 'Add mesh-vault; redis, postgres and lavinmq take their passwords from files' (#30) from feat/secrets-vault into main jschoubben 2026-09-21 10:03:12 +02:00
• 82e513a360 Add the mesh-vault module; redis takes its password from it jschoubben 2026-09-20 23:08:28 +02:00
• 8105ab6141 Merge pull request 'minio: pull image from quay.io (docker.io denies anonymous pulls)' (#29) from fix/minio-pull-from-quay into main jschoubben 2026-09-20 22:03:50 +02:00
• 2ef7eb2a27 minio: pull image from quay.io (docker.io denies anonymous pulls) jschoubben 2026-09-20 22:01:20 +02:00
• 4ce9de6f3a Merge pull request 'Correct lavinmq Dockerfile's stale MESH_TOOL_MODULES comment (061 review)' (#28) from fix/lavinmq-dockerfile-comment into main jschoubben 2026-09-20 13:42:03 +02:00
• 17243b72df Correct lavinmq Dockerfile's stale MESH_TOOL_MODULES comment (061 review) jschoubben 2026-09-20 13:32:47 +02:00
• 43c9c973e2 Merge pull request 'The mesh builds its own catalogue (issue 060)' (#27) from feat/the-mesh-builds-its-catalogue into main jschoubben 2026-09-20 12:53:04 +02:00
• 965c58fe44 Defer minio from the buildable set too (issue 060) jschoubben 2026-09-18 02:51:09 +02:00
• b8d390cbae Defer model-usage and anthropic-manager from the buildable set (issue 060) jschoubben 2026-09-18 02:48:09 +02:00
• e362fb951c The rest of the catalogue becomes mesh-buildable (issue 060, batch 2) jschoubben 2026-09-18 02:14:09 +02:00
• 591b26f712 Ten migration-critical modules become mesh-buildable (issue 060) jschoubben 2026-09-18 02:02:21 +02:00
• 83a78b4fb3 Merge pull request 'Refs name the registry; lavinmq's runtime runs its provisioner (042/048/061)' (#26) from feat/refs-name-the-registry into main jschoubben 2026-09-18 01:00:43 +02:00
• 1891b09c65 lavinmq's runtime container runs its provisioner jschoubben 2026-09-17 23:54:56 +02:00
• 2dab3069d2 The builder names the registry by the binding again (ADR 0082) jschoubben 2026-09-17 23:05:25 +02:00
• 728922a016 Merge pull request 'Foundation modules claim a mesh-scoped seat named after their server' (#25) from multi-node/foundation-seats into main jschoubben 2026-09-17 02:15:59 +02:00
• fccc1e6552 The foundation modules claim a mesh-scoped seat named after their server jschoubben 2026-09-17 02:13:26 +02:00
• a24362b74b Merge pull request 'The adopted broker declares its amqps bus port (5671) in listens' (#24) from fix/broker-declares-amqps-port into main jschoubben 2026-09-17 01:44:47 +02:00
• 06fd436eca The adopted broker declares its amqps bus port (5671) in listens jschoubben 2026-09-17 01:01:54 +02:00
• f155493926 Merge pull request 'Foundation modules adopted, and the mesh-controller/foundation rename' (#23) from feat/foundation-and-rename into main jschoubben 2026-09-16 23:22:47 +02:00
• 5e4dc3748e Phase 3.2: the lavinmq module adopts mesh-broker instead of raising its own jschoubben 2026-09-16 21:24:13 +02:00