jschoubben 290be37a93 step-ca: mount the directory, not each secret file ...

A file bind mount tracks the inode. The host writes atomically — new file, rename
over — so the container keeps reading the file that was there when it started,
and a rotated or newly-delivered secret never reaches it. Mounting the parent
directory resolves the path on each open instead.

This is a known shape (hal KB troubleshooting/docker-bind-mounts), and it cost an
hour here before it was looked up: the CA crash-looped on a root key it had
already been given, because the container still held the inode from before the
key arrived.

Claude-Session: https://claude.ai/code/session_01LrgweAeERJYBg88c5cKDzF

2026-09-11 08:49:55 +02:00

..

amqp-email-forwarder

Pin the operator's own images by digest, as every other image already is

2026-09-11 01:06:14 +02:00

amqp-ping

Add lavinmq amqp provider and amqp-ping consumer

2026-09-06 15:50:19 +02:00

anthropic-consumer

Give every module that would overflow its login a short slug

2026-09-10 20:57:45 +02:00

anthropic-manager

Give every module that would overflow its login a short slug

2026-09-10 20:57:45 +02:00

audit-logger

Give every module that would overflow its login a short slug

2026-09-10 20:57:45 +02:00

baserow

ADR 0056: selectable ACME issuer, step-ca init from operator root, route labels

2026-09-10 00:21:42 +02:00

bazarr

ADR 0056: selectable ACME issuer, step-ca init from operator root, route labels

2026-09-10 00:21:42 +02:00

bookshelf

Give every module that would overflow its login a short slug

2026-09-10 20:57:45 +02:00

cloudflare-dns

Give every module that would overflow its login a short slug

2026-09-10 20:57:45 +02:00

confluence

Give every module that would overflow its login a short slug

2026-09-10 20:57:45 +02:00

de-spiegel

Pin the operator's own images by digest, as every other image already is

2026-09-11 01:06:14 +02:00

dnsmasq

Resync hq ADR references 0044-0054 -> 0039-0049 after the hq record reconciliation

2026-09-05 12:49:16 +02:00

fail2ban

fail2ban: require the firewall capability, not the non-existent intrusion-prevention

2026-09-08 18:27:34 +02:00

firewall

Resync hq ADR references 0044-0054 -> 0039-0049 after the hq record reconciliation

2026-09-05 12:49:16 +02:00

gitea

ADR 0056: selectable ACME issuer, step-ca init from operator root, route labels

2026-09-10 00:21:42 +02:00

gitlab

Convert gitlab into a tools-only mesh catalog module

2026-09-06 01:33:43 +02:00

grafana

ADR 0056: selectable ACME issuer, step-ca init from operator root, route labels

2026-09-10 00:21:42 +02:00

hello-web

ADR 0056: selectable ACME issuer, step-ca init from operator root, route labels

2026-09-10 00:21:42 +02:00

home-assistant

Give every module that would overflow its login a short slug

2026-09-10 20:57:45 +02:00

icecast

Resync hq ADR references 0044-0054 -> 0039-0049 after the hq record reconciliation

2026-09-05 12:49:16 +02:00

influxdb

Resync hq ADR references 0044-0054 -> 0039-0049 after the hq record reconciliation

2026-09-05 12:49:16 +02:00

invoicing

Pin the operator's own images by digest, as every other image already is

2026-09-11 01:06:14 +02:00

jackett

ADR 0056: selectable ACME issuer, step-ca init from operator root, route labels

2026-09-10 00:21:42 +02:00

jira

Convert confluence and jira into nox catalog modules

2026-09-06 01:49:22 +02:00

keycloak

ADR 0056: selectable ACME issuer, step-ca init from operator root, route labels

2026-09-10 00:21:42 +02:00

lavinmq

Add lavinmq amqp provider and amqp-ping consumer

2026-09-06 15:50:19 +02:00

letta

fix: postgres consumers connect to the db the mesh named (the login), not a hardcoded app name

2026-09-06 13:47:16 +02:00

lidarr

ADR 0056: selectable ACME issuer, step-ca init from operator root, route labels

2026-09-10 00:21:42 +02:00

local-model-consumer

local model: an ollama provider + a local-model consumer (ADR 0055)

2026-09-07 05:25:21 +02:00

mailu

ADR 0056: selectable ACME issuer, step-ca init from operator root, route labels

2026-09-10 00:21:42 +02:00

marrytts

Convert four more hal modules: bookshelf, unifi, fail2ban, marrytts

2026-09-05 12:04:14 +02:00

mesh-control

The control plane as an ordinary module

2026-09-10 23:43:07 +02:00

minio

minio: pin the manifest these machines can actually run

2026-09-11 02:51:34 +02:00

model-usage

model-usage: the vendor-neutral usage store (ADR 0054)

2026-09-07 04:07:26 +02:00

mongodb

fix: db/cache/store providers must serve their port; drop baserow's empty redis contribution

2026-09-06 02:38:22 +02:00

mosquitto

Give every module that would overflow its login a short slug

2026-09-10 20:57:45 +02:00

mssql

Resync hq ADR references 0044-0054 -> 0039-0049 after the hq record reconciliation

2026-09-05 12:49:16 +02:00

n8n

ADR 0056: selectable ACME issuer, step-ca init from operator root, route labels

2026-09-10 00:21:42 +02:00

nextcloud

Give every module that would overflow its login a short slug

2026-09-10 20:57:45 +02:00

nodered

ADR 0056: selectable ACME issuer, step-ca init from operator root, route labels

2026-09-10 00:21:42 +02:00

novox.be

Pin the operator's own images by digest, as every other image already is

2026-09-11 01:06:14 +02:00

nzbget

modules: wire tool-runtime app credentials as own-secrets

2026-09-08 18:40:23 +02:00

ollama

local model: an ollama provider + a local-model consumer (ADR 0055)

2026-09-07 05:25:21 +02:00

ombi

ADR 0056: selectable ACME issuer, step-ca init from operator root, route labels

2026-09-10 00:21:42 +02:00

only-office

ADR 0056: selectable ACME issuer, step-ca init from operator root, route labels

2026-09-10 00:21:42 +02:00

openai-consumer

Give every module that would overflow its login a short slug

2026-09-10 20:57:45 +02:00

photos

Pin the operator's own images by digest, as every other image already is

2026-09-11 01:06:14 +02:00

photos-eef

Pin the operator's own images by digest, as every other image already is

2026-09-11 01:06:14 +02:00

photos-filip

Pin the operator's own images by digest, as every other image already is

2026-09-11 01:06:14 +02:00

plex

modules: wire tool-runtime app credentials as own-secrets

2026-09-08 18:40:23 +02:00

portainer

Give every module that would overflow its login a short slug

2026-09-10 20:57:45 +02:00

postgres

fix: db/cache/store providers must serve their port; drop baserow's empty redis contribution

2026-09-06 02:38:22 +02:00

public-acme

Give every module that would overflow its login a short slug

2026-09-10 20:57:45 +02:00

qbittorrent

Give every module that would overflow its login a short slug

2026-09-10 20:57:45 +02:00

radarr

ADR 0056: selectable ACME issuer, step-ca init from operator root, route labels

2026-09-10 00:21:42 +02:00

redis

fix: db/cache/store providers must serve their port; drop baserow's empty redis contribution

2026-09-06 02:38:22 +02:00

registry

The artifact store requires nothing, because at genesis there is nothing

2026-09-11 00:06:23 +02:00

resolv-conf

Give every module that would overflow its login a short slug

2026-09-10 20:57:45 +02:00

resolved-split-dns

Give every module that would overflow its login a short slug

2026-09-10 20:57:45 +02:00

route-proxy

Give every module that would overflow its login a short slug

2026-09-10 20:57:45 +02:00

searxng

ADR 0056: selectable ACME issuer, step-ca init from operator root, route labels

2026-09-10 00:21:42 +02:00

sonarr

ADR 0056: selectable ACME issuer, step-ca init from operator root, route labels

2026-09-10 00:21:42 +02:00

step-ca

step-ca: mount the directory, not each secret file

2026-09-11 08:49:55 +02:00

tautulli

ADR 0056: selectable ACME issuer, step-ca init from operator root, route labels

2026-09-10 00:21:42 +02:00

umami

ADR 0056: selectable ACME issuer, step-ca init from operator root, route labels

2026-09-10 00:21:42 +02:00

unifi

Resync hq ADR references 0044-0054 -> 0039-0049 after the hq record reconciliation

2026-09-05 12:49:16 +02:00

verdaccio

Give every module that would overflow its login a short slug

2026-09-10 20:57:45 +02:00