jschoubben 278610c0c3 fail2ban never bans a tunnel peer: ignoreip names the mesh range ...

The jail.local [DEFAULT] gains ignoreip = 127.0.0.1/8 ::1 ${machine:mesh-range}
— localhost plus the mesh's own private range, named through the placeholder
rather than hardcoded (data is the mesh's, ADR 0112). Without it fail2ban could
ban the mesh's own nodes on 10.10.0.0/24; on novox that rule survived only in
memory from a now-deleted HAL file and would be lost on the next restart.

2026-09-27 16:55:34 +02:00

..

amqp-email-forwarder

Six modules take their secrets from files; the rest say precisely why not

2026-09-21 12:29:25 +02:00

amqp-ping

Six modules take their secrets from files; the rest say precisely why not

2026-09-21 12:29:25 +02:00

anthropic-consumer

The rest of the catalogue becomes mesh-buildable (issue 060, batch 2)

2026-09-18 02:14:09 +02:00

anthropic-manager

Defer model-usage and anthropic-manager from the buildable set (issue 060)

2026-09-18 02:48:09 +02:00

audit-logger

Review: four manifests said something stale or nothing at all

2026-09-15 22:03:33 +02:00

baserow

baserow: its data directory is 0755, as the image ships it — the cache it runs for itself does so as another user, who must reach its own directory beneath (issue 081)

2026-09-22 13:46:01 +02:00

bazarr

The rest of the catalogue becomes mesh-buildable (issue 060, batch 2)

2026-09-18 02:14:09 +02:00

bookshelf

The rest of the catalogue becomes mesh-buildable (issue 060, batch 2)

2026-09-18 02:14:09 +02:00

builder

Rename seat claims to the mesh-*/node-* convention; retire verdaccio (ADR 0121)

2026-09-27 14:30:56 +02:00

cloudflare-dns

The rest of the catalogue becomes mesh-buildable (issue 060, batch 2)

2026-09-18 02:14:09 +02:00

confluence

The rest of the catalogue becomes mesh-buildable (issue 060, batch 2)

2026-09-18 02:14:09 +02:00

de-spiegel

11 modules: a container's ports say the software's port, not the machine's

2026-09-24 15:45:58 +02:00

dhcpcd

Rename seat claims to the mesh-*/node-* convention; retire verdaccio (ADR 0121)

2026-09-27 14:30:56 +02:00

distribution

4 modules: persistent data is a directory bind, never a named volume

2026-09-24 16:12:03 +02:00

dnsmasq

Rename seat claims to the mesh-*/node-* convention; retire verdaccio (ADR 0121)

2026-09-27 14:30:56 +02:00

fail2ban

fail2ban never bans a tunnel peer: ignoreip names the mesh range

2026-09-27 16:55:34 +02:00

gitea

Six modules name no /var/lib: the root is a place, the maps reference it

2026-09-26 18:20:47 +02:00

gitlab

The rest of the catalogue becomes mesh-buildable (issue 060, batch 2)

2026-09-18 02:14:09 +02:00

grafana

grafana stays a declared exception until a bed exercises its admin password

2026-09-21 12:31:59 +02:00

hello-web

11 modules: a container's ports say the software's port, not the machine's

2026-09-24 15:45:58 +02:00

home-assistant

The rest of the catalogue becomes mesh-buildable (issue 060, batch 2)

2026-09-18 02:14:09 +02:00

icecast

Five modules keep their own secrets from the vault, under local names; route-proxy declares its bases

2026-09-21 22:16:10 +02:00

influxdb

Five modules keep their own secrets from the vault, under local names; route-proxy declares its bases

2026-09-21 22:16:10 +02:00

invoicing

A bucket is the one the mesh derives, and the photos module named another

2026-09-26 16:46:10 +02:00

jackett

The rest of the catalogue becomes mesh-buildable (issue 060, batch 2)

2026-09-18 02:14:09 +02:00

jira

The rest of the catalogue becomes mesh-buildable (issue 060, batch 2)

2026-09-18 02:14:09 +02:00

keycloak

keycloak: use Hostname v2's actual config shape, not v1's deprecated flags

2026-09-24 17:27:04 +02:00

lavinmq

lavinmq: the broker TLS directory is the operator's, read by whoever needs it

2026-09-26 16:12:29 +02:00

letta

Six modules take their secrets from files; the rest say precisely why not

2026-09-21 12:29:25 +02:00

lidarr

The rest of the catalogue becomes mesh-buildable (issue 060, batch 2)

2026-09-18 02:14:09 +02:00

local-model-consumer

local model: an ollama provider + a local-model consumer (ADR 0055)

2026-09-07 05:25:21 +02:00

mailu

mailu: the smtp provision serves the name its certificate answers to

2026-09-26 19:26:53 +02:00

marrytts

Convert four more hal modules: bookshelf, unifi, fail2ban, marrytts

2026-09-05 12:04:14 +02:00

mesh-catalog

Rename seat claims to the mesh-*/node-* convention; retire verdaccio (ADR 0121)

2026-09-27 14:30:56 +02:00

mesh-vault

Add the mesh-vault module; redis takes its password from it

2026-09-21 00:48:13 +02:00

minio

Merge main

2026-09-26 15:05:40 +02:00

model-usage

The env-file references to files the conversion removed go with them

2026-09-21 12:43:41 +02:00

mongodb

Six modules name no /var/lib: the root is a place, the maps reference it

2026-09-26 18:20:47 +02:00

mosquitto

Review fixes: holds and create agree, and no password leaves a check

2026-09-26 01:24:32 +02:00

mssql

mssql: its data is placed — the last /services placement retires

2026-09-26 20:36:03 +02:00

n8n

11 modules: a container's ports say the software's port, not the machine's

2026-09-24 15:45:58 +02:00

networkmanager

Rename seat claims to the mesh-*/node-* convention; retire verdaccio (ADR 0121)

2026-09-27 14:30:56 +02:00

nextcloud

Six modules name no /var/lib: the root is a place, the maps reference it

2026-09-26 18:20:47 +02:00

nftables

Rename seat claims to the mesh-*/node-* convention; retire verdaccio (ADR 0121)

2026-09-27 14:30:56 +02:00

nodered

The rest of the catalogue becomes mesh-buildable (issue 060, batch 2)

2026-09-18 02:14:09 +02:00

novox.be

11 modules: a container's ports say the software's port, not the machine's

2026-09-24 15:45:58 +02:00

nzbget

The rest of the catalogue becomes mesh-buildable (issue 060, batch 2)

2026-09-18 02:14:09 +02:00

ollama

local model: an ollama provider + a local-model consumer (ADR 0055)

2026-09-07 05:25:21 +02:00

ombi

The rest of the catalogue becomes mesh-buildable (issue 060, batch 2)

2026-09-18 02:14:09 +02:00

only-office

Six modules name no /var/lib: the root is a place, the maps reference it

2026-09-26 18:20:47 +02:00

openai-consumer

The rest of the catalogue becomes mesh-buildable (issue 060, batch 2)

2026-09-18 02:14:09 +02:00

photos

A bucket is the one the mesh derives, and the photos module named another

2026-09-26 16:46:10 +02:00

photos-eef

11 modules: a container's ports say the software's port, not the machine's

2026-09-24 15:45:58 +02:00

photos-filip

11 modules: a container's ports say the software's port, not the machine's

2026-09-24 15:45:58 +02:00

plex

The rest of the catalogue becomes mesh-buildable (issue 060, batch 2)

2026-09-18 02:14:09 +02:00

portainer

portainer: its data directory is placed, not stated

2026-09-26 18:02:25 +02:00

postgres

Merge main

2026-09-26 15:04:47 +02:00

public-acme

public-acme: the roots field is named roots, not root

2026-09-25 18:08:28 +02:00

qbittorrent

The rest of the catalogue becomes mesh-buildable (issue 060, batch 2)

2026-09-18 02:14:09 +02:00

radarr

The rest of the catalogue becomes mesh-buildable (issue 060, batch 2)

2026-09-18 02:14:09 +02:00

redis

redis: say whether it still holds a consumer's ACL user

2026-09-26 00:53:13 +02:00

resolv-conf

Rename seat claims to the mesh-*/node-* convention; retire verdaccio (ADR 0121)

2026-09-27 14:30:56 +02:00

resolved-split-dns

Rename seat claims to the mesh-*/node-* convention; retire verdaccio (ADR 0121)

2026-09-27 14:30:56 +02:00

route-adapter

route-adapter: write a body limit as the predecessor's buffering middleware

2026-09-26 16:01:23 +02:00

route-proxy

route-proxy: internal names are certified by the mesh's own authority

2026-09-25 20:36:41 +02:00

searxng

4 modules: persistent data is a directory bind, never a named volume

2026-09-24 16:12:03 +02:00

showcase

Rename seat claims to the mesh-*/node-* convention; retire verdaccio (ADR 0121)

2026-09-27 14:30:56 +02:00

sonarr

The rest of the catalogue becomes mesh-buildable (issue 060, batch 2)

2026-09-18 02:14:09 +02:00

sshd

sshd: the operator's door is a module

2026-09-26 20:14:54 +02:00

step-ca

route-proxy: internal names are certified by the mesh's own authority

2026-09-25 20:36:41 +02:00

systemd-networkd

Rename seat claims to the mesh-*/node-* convention; retire verdaccio (ADR 0121)

2026-09-27 14:30:56 +02:00

tautulli

The rest of the catalogue becomes mesh-buildable (issue 060, batch 2)

2026-09-18 02:14:09 +02:00

umami

Pin the analytics module to the version the machine it replaces is running

2026-09-23 02:47:23 +02:00

unifi

The rest of the catalogue becomes mesh-buildable (issue 060, batch 2)

2026-09-18 02:14:09 +02:00