jschoubben 721149eda1 nats declares the certificate directory it mounts ...

The mesh's broker certificate is the operator's, kept outside any module and
mounted read-only by whatever serves the bus; the controller declares that
access and now so does nats, the same way. A mount nothing declares is refused
at registration (ADR 0030), which is how this was found.

2026-09-28 00:15:59 +02:00

..

anthropic-consumer

Event names are local now, in the manifests and in the code

2026-09-27 14:42:28 +02:00

anthropic-manager

Event names are local now, in the manifests and in the code

2026-09-27 14:42:28 +02:00

audit-logger

Event names are local now, in the manifests and in the code

2026-09-27 14:42:28 +02:00

baserow

baserow: its data directory is 0755, as the image ships it — the cache it runs for itself does so as another user, who must reach its own directory beneath (issue 081)

2026-09-22 13:46:01 +02:00

bazarr

Event names are local now, in the manifests and in the code

2026-09-27 14:42:28 +02:00

bookshelf

Event names are local now, in the manifests and in the code

2026-09-27 14:42:28 +02:00

builder

The Go base has to be 1.26 for what compiles the controller's code

2026-09-27 20:58:09 +02:00

cloudflare-dns

Event names are local now, in the manifests and in the code

2026-09-27 14:42:28 +02:00

confluence

The rest of the catalogue becomes mesh-buildable (issue 060, batch 2)

2026-09-18 02:14:09 +02:00

de-spiegel

11 modules: a container's ports say the software's port, not the machine's

2026-09-24 15:45:58 +02:00

dhcpcd

Rename seat claims to the mesh-*/node-* convention; retire verdaccio (ADR 0121)

2026-09-27 14:30:56 +02:00

distribution

Merge main: the trunk's seat names, this branch's event names

2026-09-27 18:25:57 +02:00

dnsmasq

Merge main: the trunk's seat names, this branch's event names

2026-09-27 18:25:57 +02:00

fail2ban

fail2ban never bans a tunnel peer: ignoreip names the mesh range

2026-09-27 16:55:34 +02:00

gitea

Merge main: the trunk's seat names, this branch's event names

2026-09-27 18:25:57 +02:00

gitlab

The rest of the catalogue becomes mesh-buildable (issue 060, batch 2)

2026-09-18 02:14:09 +02:00

grafana

Event names are local now, in the manifests and in the code

2026-09-27 14:42:28 +02:00

hello-web

11 modules: a container's ports say the software's port, not the machine's

2026-09-24 15:45:58 +02:00

home-assistant

Event names are local now, in the manifests and in the code

2026-09-27 14:42:28 +02:00

icecast

Event names are local now, in the manifests and in the code

2026-09-27 14:42:28 +02:00

influxdb

Five modules keep their own secrets from the vault, under local names; route-proxy declares its bases

2026-09-21 22:16:10 +02:00

invoicing

A bucket is the one the mesh derives, and the photos module named another

2026-09-26 16:46:10 +02:00

jackett

The rest of the catalogue becomes mesh-buildable (issue 060, batch 2)

2026-09-18 02:14:09 +02:00

jira

The rest of the catalogue becomes mesh-buildable (issue 060, batch 2)

2026-09-18 02:14:09 +02:00

keycloak

Event names are local now, in the manifests and in the code

2026-09-27 14:42:28 +02:00

letta

Six modules take their secrets from files; the rest say precisely why not

2026-09-21 12:29:25 +02:00

lidarr

Event names are local now, in the manifests and in the code

2026-09-27 14:42:28 +02:00

local-model-consumer

local model: an ollama provider + a local-model consumer (ADR 0055)

2026-09-07 05:25:21 +02:00

mailu

Merge main: the trunk's seat names, this branch's event names

2026-09-27 18:25:57 +02:00

marrytts

Convert four more hal modules: bookshelf, unifi, fail2ban, marrytts

2026-09-05 12:04:14 +02:00

mesh-catalog

A build's outcome belongs to the role, not to the module holding it

2026-09-27 15:37:21 +02:00

mesh-vault

Event names are local now, in the manifests and in the code

2026-09-27 14:42:28 +02:00

minio

Event names are local now, in the manifests and in the code

2026-09-27 14:42:28 +02:00

model-usage

Event names are local now, in the manifests and in the code

2026-09-27 14:42:28 +02:00

mongodb

Event names are local now, in the manifests and in the code

2026-09-27 14:42:28 +02:00

mosquitto

Event names are local now, in the manifests and in the code

2026-09-27 14:42:28 +02:00

mssql

Merge main: the trunk's seat names, this branch's event names

2026-09-27 18:25:57 +02:00

n8n

11 modules: a container's ports say the software's port, not the machine's

2026-09-24 15:45:58 +02:00

nats

nats declares the certificate directory it mounts

2026-09-28 00:15:59 +02:00

networkmanager

Rename seat claims to the mesh-*/node-* convention; retire verdaccio (ADR 0121)

2026-09-27 14:30:56 +02:00

nextcloud

Event names are local now, in the manifests and in the code

2026-09-27 14:42:28 +02:00

nftables

Rename seat claims to the mesh-*/node-* convention; retire verdaccio (ADR 0121)

2026-09-27 14:30:56 +02:00

nodered

Event names are local now, in the manifests and in the code

2026-09-27 14:42:28 +02:00

novox.be

11 modules: a container's ports say the software's port, not the machine's

2026-09-24 15:45:58 +02:00

nzbget

Event names are local now, in the manifests and in the code

2026-09-27 14:42:28 +02:00

ollama

local model: an ollama provider + a local-model consumer (ADR 0055)

2026-09-07 05:25:21 +02:00

ombi

Event names are local now, in the manifests and in the code

2026-09-27 14:42:28 +02:00

only-office

Six modules name no /var/lib: the root is a place, the maps reference it

2026-09-26 18:20:47 +02:00

openai-consumer

The rest of the catalogue becomes mesh-buildable (issue 060, batch 2)

2026-09-18 02:14:09 +02:00

photos

Event names are local now, in the manifests and in the code

2026-09-27 14:42:28 +02:00

photos-eef

11 modules: a container's ports say the software's port, not the machine's

2026-09-24 15:45:58 +02:00

photos-filip

11 modules: a container's ports say the software's port, not the machine's

2026-09-24 15:45:58 +02:00

plex

Event names are local now, in the manifests and in the code

2026-09-27 14:42:28 +02:00

portainer

portainer: its data directory is placed, not stated

2026-09-26 18:02:25 +02:00

postgres

Event names are local now, in the manifests and in the code

2026-09-27 14:42:28 +02:00

public-acme

public-acme: the roots field is named roots, not root

2026-09-25 18:08:28 +02:00

qbittorrent

Event names are local now, in the manifests and in the code

2026-09-27 14:42:28 +02:00

radarr

Event names are local now, in the manifests and in the code

2026-09-27 14:42:28 +02:00

redis

Event names are local now, in the manifests and in the code

2026-09-27 14:42:28 +02:00

resolv-conf

Rename seat claims to the mesh-*/node-* convention; retire verdaccio (ADR 0121)

2026-09-27 14:30:56 +02:00

resolved-split-dns

Rename seat claims to the mesh-*/node-* convention; retire verdaccio (ADR 0121)

2026-09-27 14:30:56 +02:00

route-adapter

route-adapter: write a body limit as the predecessor's buffering middleware

2026-09-26 16:01:23 +02:00

route-proxy

The Go base has to be 1.26 for what compiles the controller's code

2026-09-27 20:58:09 +02:00

searxng

4 modules: persistent data is a directory bind, never a named volume

2026-09-24 16:12:03 +02:00

showcase

Merge main: the trunk's seat names, this branch's event names

2026-09-27 18:25:57 +02:00

sonarr

Event names are local now, in the manifests and in the code

2026-09-27 14:42:28 +02:00

sshd

sshd: the operator's door is a module

2026-09-26 20:14:54 +02:00

step-ca

route-proxy: internal names are certified by the mesh's own authority

2026-09-25 20:36:41 +02:00

systemd-networkd

Rename seat claims to the mesh-*/node-* convention; retire verdaccio (ADR 0121)

2026-09-27 14:30:56 +02:00

tautulli

Event names are local now, in the manifests and in the code

2026-09-27 14:42:28 +02:00

umami

Pin the analytics module to the version the machine it replaces is running

2026-09-23 02:47:23 +02:00

unifi

The rest of the catalogue becomes mesh-buildable (issue 060, batch 2)

2026-09-18 02:14:09 +02:00