Six modules take their secrets from files; the rest say precisely why not (issue 041) #32

2026-09-21T11:48:32Z

jschoubben commented

2026-09-21 11:48:32 +00:00

Part of the migration-blockers feature (novox/hq ADR 0086 follow-through, issue 041).

Converted to file-delivered secrets and proven in a bed: amqp-ping, minio, mongodb, mesh-catalog, model-usage.
mongodb names its secrets' owner (999:999): the image drops to its own user before it reads the password file.
grafana stays a declared exception until a bed exercises its admin password.
Two dead deliveries removed (amqp-email-forwarder's broker password; mailu's secret env detached from containers that never read it), and every remaining env-file reference names a file that is still declared.
The 25 remaining exceptions carry the surveyed reason on the container.

Merge order: mesh-controller → this → mesh-host → mesh-lab → hq.

Part of the migration-blockers feature (novox/hq ADR 0086 follow-through, issue 041). - Converted to file-delivered secrets and proven in a bed: amqp-ping, minio, mongodb, mesh-catalog, model-usage. - mongodb names its secrets' owner (`999:999`): the image drops to its own user before it reads the password file. - grafana stays a declared exception until a bed exercises its admin password. - Two dead deliveries removed (amqp-email-forwarder's broker password; mailu's secret env detached from containers that never read it), and every remaining env-file reference names a file that is still declared. - The 25 remaining exceptions carry the surveyed reason on the container. Merge order: mesh-controller → this → mesh-host → mesh-lab → hq.

jschoubben added 4 commits 2026-09-21 11:48:33 +00:00

Six modules take their secrets from files; the rest say precisely why not 1a28e5aec6

From the survey of every env-file secret (ADR 0086, issue 041): amqp-ping,
minio, mongodb and grafana use the _FILE twin their software honours;
mesh-catalog and model-usage read DATABASE_URL_FILE (a file the mesh
templates, mounted where only the runtime reads it); grafana's secret files
belong to its own account. Two dead deliveries removed: a line nothing read
in amqp-email-forwarder, and mailu's secret.env on four containers that
never read it. The 25 exceptions that remain carry the surveyed reason —
convertible and awaiting a bed, convertible through a generated config file,
the application's own code, or not convertible.

grafana stays a declared exception until a bed exercises its admin password 0b2f3bfbd3

The env-file references to files the conversion removed go with them 50b639ff52

mongodb names its secrets' owner: the image drops to its own user before it reads the password file 1289510538

The official entrypoint re-executes itself as mongodb (uid 999) and only then reads
MONGO_INITDB_ROOT_PASSWORD_FILE, so a root-owned 0600 file is 'Permission denied' at line 83 and
the server never starts. secrets-owner is the mechanism ADR 0086 gives for exactly this.

jschoubben merged commit e0d34723f7 into main

2026-09-21 11:48:47 +00:00

jschoubben deleted branch feat/migration-blockers

2026-09-21 11:48:47 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: novox/mesh-catalog#32