jochen b19c4a2593 home-assistant: the runtime serves its code, and its provisions step is a run-once process (hq ADR 0198) ...

The mesh-home-assistant container goes with its Dockerfile, build bases and bus credential. The provisions step runs node on the bundle and reads the binding files where the mesh writes them, from an env-file the mesh fills because a process's env is not given ${port:…}. It still runs again when a binding it reads changes.

2026-10-03 23:33:51 +02:00

..

anthropic-consumer

The mesh's own files for a module are placed by the mesh, not the definition (issue 174)

2026-09-30 22:29:28 +02:00

anthropic-manager

The mesh's own files for a module are placed by the mesh, not the definition (issue 174)

2026-09-30 22:29:28 +02:00

audit-logger

A definition names no host path for its own data

2026-09-30 21:10:18 +02:00

baserow

The seven say what the runtime loads from their tools bundle (hq ADR 0192)

2026-10-03 15:58:19 +02:00

build-agent

build-agent: a short slug, so its identifier on a machine fits a backend's 20-character key

2026-10-03 11:09:24 +02:00

ca-trust

ca-trust: a machine trusts the mesh's authority because a module put its root there

2026-09-29 15:07:40 +02:00

cloudflare-dns

cloudflare-dns: its tools and provisioner run in the node's runtime (hq ADR 0198)

2026-10-03 23:33:51 +02:00

confluence

The seven say what the runtime loads from their tools bundle (hq ADR 0192)

2026-10-03 15:58:19 +02:00

de-spiegel

A definition names no host path for its own data

2026-09-30 21:10:18 +02:00

dhcpcd

And the uplink holders' capabilities return

2026-10-01 17:19:41 +02:00

distribution

distribution claims mesh-artifact-store, the seat's name for its scope (novox/hq ADR 0156)

2026-09-30 21:14:40 +02:00

dnsmasq

dnsmasq: restart on the mesh's hosts region, which it reads only at start

2026-10-03 15:29:28 +02:00

fail2ban

fail2ban's tools are a bundle the node's runtime serves; its container goes (hq to-be 38 WP4)

2026-10-03 15:07:21 +02:00

gitea

gitea: the jail also bans what gitea's sshd refuses

2026-10-02 23:23:35 +02:00

gitlab

The seven say what the runtime loads from their tools bundle (hq ADR 0192)

2026-10-03 15:58:19 +02:00

grafana

grafana: its handlers and tools run in the node's runtime (hq ADR 0198)

2026-10-03 23:33:51 +02:00

hello-web

A definition names no host path for its own data

2026-09-30 21:10:18 +02:00

home-assistant

home-assistant: the runtime serves its code, and its provisions step is a run-once process (hq ADR 0198)

2026-10-03 23:33:51 +02:00

icecast

icecast: its handlers and tools run in the node's runtime (hq ADR 0198)

2026-10-03 23:33:51 +02:00

influxdb

influxdb: its tools and provisioner run in the node's runtime (hq ADR 0198)

2026-10-03 23:33:51 +02:00

invoicing

The mesh's own files for a module are placed by the mesh, not the definition (issue 174)

2026-09-30 22:29:28 +02:00

jira

The seven say what the runtime loads from their tools bundle (hq ADR 0192)

2026-10-03 15:58:19 +02:00

keycloak

keycloak: its handlers, tools and provisioner run in the node's runtime (hq ADR 0198)

2026-10-03 23:33:51 +02:00

lab

lab: the image carries what the builds and the lab call: python3, file, iproute2, sudo

2026-10-02 15:23:52 +02:00

letta

The seven say what the runtime loads from their tools bundle (hq ADR 0192)

2026-10-03 15:58:19 +02:00

local-model-consumer

A definition names no host path for its own data

2026-09-30 21:10:18 +02:00

mailu

fail2ban holds the intrusion seat's verbs and composes the jails; mail, forge and proxy declare theirs (hq ADR 0179, to-be 31)

2026-10-02 17:02:49 +02:00

marrytts

The mesh's own files for a module are placed by the mesh, not the definition (issue 174)

2026-09-30 22:29:28 +02:00

matrix

No definition names this installation

2026-09-30 20:49:21 +02:00

mesh-catalog

The mesh's own files for a module are placed by the mesh, not the definition (issue 174)

2026-09-30 22:29:28 +02:00

mesh-vault

The vault's claim and its own event names return

2026-10-01 17:19:05 +02:00

minio

The mesh's own files for a module are placed by the mesh, not the definition (issue 174)

2026-09-30 22:29:28 +02:00

model-usage

The mesh's own files for a module are placed by the mesh, not the definition (issue 174)

2026-09-30 22:29:28 +02:00

mongodb

The mesh's own files for a module are placed by the mesh, not the definition (issue 174)

2026-09-30 22:29:28 +02:00

mosquitto

mosquitto: the runtime serves its code, and its bootstrap is a run-once process (hq ADR 0198)

2026-10-03 23:33:50 +02:00

mssql

mssql: the query runs as a read-only login, one line, no variables; sqlcmd is installed (hq #193)

2026-10-02 00:25:22 +02:00

n8n

n8n: its media library is an access placed by the assignment

2026-10-01 02:02:30 +02:00

nats

An access has an id, and its mounts name it (issue 153)

2026-10-01 00:01:42 +02:00

networkmanager

And the uplink holders' capabilities return

2026-10-01 17:19:41 +02:00

nextcloud

The mesh's own files for a module are placed by the mesh, not the definition (issue 174)

2026-09-30 22:29:28 +02:00

nftables

The packet filter's tools are a bundle the node's runtime serves; its container goes (hq to-be 38 WP4)

2026-10-03 12:59:07 +02:00

nodered

nodered says it reads its API token and admin password at start, so the mesh may rotate them (hq 180)

2026-10-01 11:44:29 +02:00

ollama

Every module names its endpoints, and every route names the one it serves

2026-09-29 11:51:39 +02:00

only-office

No definition names this installation

2026-09-30 20:49:21 +02:00

openai-consumer

A definition names no host path for its own data

2026-09-30 21:10:18 +02:00

photos

A definition names no host path for its own data

2026-09-30 21:10:18 +02:00

photos-eef

A definition names no host path for its own data

2026-09-30 21:10:18 +02:00

photos-filip

A definition names no host path for its own data

2026-09-30 21:10:18 +02:00

postgres

postgres: its handlers, tools and provisioner run in the node's runtime (hq ADR 0198)

2026-10-03 23:33:50 +02:00

public-acme

public-acme: the roots field is named roots, not root

2026-09-25 18:08:28 +02:00

records

The mesh's own files for a module are placed by the mesh, not the definition (issue 174)

2026-09-30 22:29:28 +02:00

redis

redis: its handlers, tools and provisioner run in the node's runtime (hq ADR 0198)

2026-10-03 23:33:50 +02:00

resolv-conf

Rename seat claims to the mesh-*/node-* convention; retire verdaccio (ADR 0121)

2026-09-27 14:30:56 +02:00

resolved-split-dns

Rename seat claims to the mesh-*/node-* convention; retire verdaccio (ADR 0121)

2026-09-27 14:30:56 +02:00

route-adapter

An access has an id, and its mounts name it (issue 153)

2026-10-01 00:01:42 +02:00

route-proxy

The proxy's jail reads both refusals, each pattern naming the host once

2026-10-02 17:23:42 +02:00

searxng

The seven say what the runtime loads from their tools bundle (hq ADR 0192)

2026-10-03 15:58:19 +02:00

showcase

The mesh's own files for a module are placed by the mesh, not the definition (issue 174)

2026-09-30 22:29:28 +02:00

ssh-client

ssh-client: own ~/.ssh, not the openssh package

2026-10-03 12:43:35 +02:00

sshd

Every module names its endpoints, and every route names the one it serves

2026-09-29 11:51:39 +02:00

step-ca

step-ca: stop offering acme-ca, so public names are certified by public-acme

2026-10-03 10:54:43 +02:00

supabase

supabase: own secrets, and unique ids for its containers

2026-09-30 17:57:57 +02:00

systemd-networkd

And the uplink holders' capabilities return

2026-10-01 17:19:41 +02:00

umami

umami: its tools and provisioner run in the node's runtime (hq ADR 0198)

2026-10-03 23:33:51 +02:00

unifi

The seven say what the runtime loads from their tools bundle (hq ADR 0192)

2026-10-03 15:58:19 +02:00

website

website: it listens on the port its container publishes

2026-09-30 21:01:47 +02:00