jschoubben b704bf5ad8 invoicing: the photos lessons, applied before its window ...

The mongo credential authenticates against its own database and the
database is the granted one (mesh_novox_invoice), not the contributed
name the provisioner ignores. Same for the store: the key is sealed to
the derived bucket (mesh-novox-invoice) — the data mirrors in during the
window, the ncloud/photos pattern. And the api gets the route
contribution it always needed: invoicing-api.novox.be is today a traefik
container label, invisible to every file survey, and it must be a grant
before the edge can ever flip.

2026-09-26 03:15:26 +02:00

..

amqp-email-forwarder

Six modules take their secrets from files; the rest say precisely why not

2026-09-21 12:29:25 +02:00

amqp-ping

Six modules take their secrets from files; the rest say precisely why not

2026-09-21 12:29:25 +02:00

anthropic-consumer

The rest of the catalogue becomes mesh-buildable (issue 060, batch 2)

2026-09-18 02:14:09 +02:00

anthropic-manager

Defer model-usage and anthropic-manager from the buildable set (issue 060)

2026-09-18 02:48:09 +02:00

audit-logger

Review: four manifests said something stale or nothing at all

2026-09-15 22:03:33 +02:00

baserow

baserow: its data directory is 0755, as the image ships it — the cache it runs for itself does so as another user, who must reach its own directory beneath (issue 081)

2026-09-22 13:46:01 +02:00

bazarr

The rest of the catalogue becomes mesh-buildable (issue 060, batch 2)

2026-09-18 02:14:09 +02:00

bookshelf

The rest of the catalogue becomes mesh-buildable (issue 060, batch 2)

2026-09-18 02:14:09 +02:00

builder

builder is a real built module now, not handed over

2026-09-25 17:54:46 +02:00

cloudflare-dns

The rest of the catalogue becomes mesh-buildable (issue 060, batch 2)

2026-09-18 02:14:09 +02:00

confluence

The rest of the catalogue becomes mesh-buildable (issue 060, batch 2)

2026-09-18 02:14:09 +02:00

de-spiegel

11 modules: a container's ports say the software's port, not the machine's

2026-09-24 15:45:58 +02:00

distribution

4 modules: persistent data is a directory bind, never a named volume

2026-09-24 16:12:03 +02:00

dnsmasq

Convert the resolver from the module it replaces: forward, answer at 127.0.0.1, point the runtime at it

2026-09-24 01:09:23 +02:00

fail2ban

fail2ban: require the firewall capability, not the non-existent intrusion-prevention

2026-09-08 18:27:34 +02:00

gitea

Review fixes: holds and create agree, and no password leaves a check

2026-09-26 01:24:32 +02:00

gitlab

The rest of the catalogue becomes mesh-buildable (issue 060, batch 2)

2026-09-18 02:14:09 +02:00

grafana

grafana stays a declared exception until a bed exercises its admin password

2026-09-21 12:31:59 +02:00

hello-web

11 modules: a container's ports say the software's port, not the machine's

2026-09-24 15:45:58 +02:00

home-assistant

The rest of the catalogue becomes mesh-buildable (issue 060, batch 2)

2026-09-18 02:14:09 +02:00

icecast

Five modules keep their own secrets from the vault, under local names; route-proxy declares its bases

2026-09-21 22:16:10 +02:00

influxdb

Five modules keep their own secrets from the vault, under local names; route-proxy declares its bases

2026-09-21 22:16:10 +02:00

invoicing

invoicing: the photos lessons, applied before its window

2026-09-26 03:15:26 +02:00

jackett

The rest of the catalogue becomes mesh-buildable (issue 060, batch 2)

2026-09-18 02:14:09 +02:00

jira

The rest of the catalogue becomes mesh-buildable (issue 060, batch 2)

2026-09-18 02:14:09 +02:00

keycloak

Six modules take their secrets from files; the rest say precisely why not

2026-09-21 12:29:25 +02:00

lavinmq

Every credential provider says whether it still holds a consumer

2026-09-26 01:09:52 +02:00

letta

Six modules take their secrets from files; the rest say precisely why not

2026-09-21 12:29:25 +02:00

lidarr

The rest of the catalogue becomes mesh-buildable (issue 060, batch 2)

2026-09-18 02:14:09 +02:00

local-model-consumer

local model: an ollama provider + a local-model consumer (ADR 0055)

2026-09-07 05:25:21 +02:00

mailu

mssql remaps a user only when orphaned; mailu's operator tool no longer re-enables

2026-09-26 01:30:15 +02:00

marrytts

Convert four more hal modules: bookshelf, unifi, fail2ban, marrytts

2026-09-05 12:04:14 +02:00

mesh-catalog

The env-file references to files the conversion removed go with them

2026-09-21 12:43:41 +02:00

mesh-vault

Add the mesh-vault module; redis takes its password from it

2026-09-21 00:48:13 +02:00

minio

Every credential provider says whether it still holds a consumer

2026-09-26 01:09:52 +02:00

model-usage

The env-file references to files the conversion removed go with them

2026-09-21 12:43:41 +02:00

mongodb

mongodb: the server container is mongodb-server, not the predecessor's name

2026-09-26 01:37:41 +02:00

mosquitto

Review fixes: holds and create agree, and no password leaves a check

2026-09-26 01:24:32 +02:00

mssql

mssql remaps a user only when orphaned; mailu's operator tool no longer re-enables

2026-09-26 01:30:15 +02:00

n8n

11 modules: a container's ports say the software's port, not the machine's

2026-09-24 15:45:58 +02:00

nextcloud

nextcloud: pull the S3 region from the binding, not a hardcoded literal

2026-09-25 14:15:40 +02:00

nftables

Reload the filter on a rule change rather than restart it, so the node is never unfiltered in between (hq ADR 0102)

2026-09-22 19:47:43 +02:00

nodered

The rest of the catalogue becomes mesh-buildable (issue 060, batch 2)

2026-09-18 02:14:09 +02:00

novox.be

11 modules: a container's ports say the software's port, not the machine's

2026-09-24 15:45:58 +02:00

nzbget

The rest of the catalogue becomes mesh-buildable (issue 060, batch 2)

2026-09-18 02:14:09 +02:00

ollama

local model: an ollama provider + a local-model consumer (ADR 0055)

2026-09-07 05:25:21 +02:00

ombi

The rest of the catalogue becomes mesh-buildable (issue 060, batch 2)

2026-09-18 02:14:09 +02:00

only-office

11 modules: a container's ports say the software's port, not the machine's

2026-09-24 15:45:58 +02:00

openai-consumer

The rest of the catalogue becomes mesh-buildable (issue 060, batch 2)

2026-09-18 02:14:09 +02:00

photos

11 modules: a container's ports say the software's port, not the machine's

2026-09-24 15:45:58 +02:00

photos-eef

11 modules: a container's ports say the software's port, not the machine's

2026-09-24 15:45:58 +02:00

photos-filip

11 modules: a container's ports say the software's port, not the machine's

2026-09-24 15:45:58 +02:00

plex

The rest of the catalogue becomes mesh-buildable (issue 060, batch 2)

2026-09-18 02:14:09 +02:00

portainer

Ten migration-critical modules become mesh-buildable (issue 060)

2026-09-18 02:02:21 +02:00

postgres

Review fixes: holds and create agree, and no password leaves a check

2026-09-26 01:24:32 +02:00

public-acme

public-acme: the roots field is named roots, not root

2026-09-25 18:08:28 +02:00

qbittorrent

The rest of the catalogue becomes mesh-buildable (issue 060, batch 2)

2026-09-18 02:14:09 +02:00

radarr

The rest of the catalogue becomes mesh-buildable (issue 060, batch 2)

2026-09-18 02:14:09 +02:00

redis

redis: say whether it still holds a consumer's ACL user

2026-09-26 00:53:13 +02:00

resolv-conf

Convert the resolver from the module it replaces: forward, answer at 127.0.0.1, point the runtime at it

2026-09-24 01:09:23 +02:00

resolved-split-dns

Convert the resolver from the module it replaces: forward, answer at 127.0.0.1, point the runtime at it

2026-09-24 01:09:23 +02:00

route-adapter

mailu: the manifest matches the machine, provides smtp, and carries automx

2026-09-25 22:39:29 +02:00

route-proxy

route-proxy: internal names are certified by the mesh's own authority

2026-09-25 20:36:41 +02:00

searxng

4 modules: persistent data is a directory bind, never a named volume

2026-09-24 16:12:03 +02:00

showcase

Name the two modules after their software: nftables and distribution

2026-09-15 20:51:00 +02:00

sonarr

The rest of the catalogue becomes mesh-buildable (issue 060, batch 2)

2026-09-18 02:14:09 +02:00

step-ca

route-proxy: internal names are certified by the mesh's own authority

2026-09-25 20:36:41 +02:00

tautulli

The rest of the catalogue becomes mesh-buildable (issue 060, batch 2)

2026-09-18 02:14:09 +02:00

umami

Pin the analytics module to the version the machine it replaces is running

2026-09-23 02:47:23 +02:00

unifi

The rest of the catalogue becomes mesh-buildable (issue 060, batch 2)

2026-09-18 02:14:09 +02:00

verdaccio

Pin the package registry to the version the machine it replaces is running: 6.10.3, not 6.10.1

2026-09-23 02:24:07 +02:00