jschoubben d63f006cb8 The builder's package binding takes its port from the node, not from the manifest ...

The forge is raised by hand at genesis, before any module provides
`package-registry`, so the builder carries a binding instead of resolving one —
and the port in it was rewritten, as text, by the installer. A later
registration of this manifest from the catalogue put 3000 back, silently, and
pointed the builder and its registry credential at whatever holds that port.

Made settable instead: the port is a per-node setting the controller holds, and
the catalogue's number is only its default. `provision`, `from` and `as` are
protected — a setting here is about where the forge answers, never about who the
binding is with.

novox/hq 04-ISSUES/085, ADR 0100

2026-09-22 21:39:54 +02:00

..

amqp-email-forwarder

Six modules take their secrets from files; the rest say precisely why not

2026-09-21 12:29:25 +02:00

amqp-ping

Six modules take their secrets from files; the rest say precisely why not

2026-09-21 12:29:25 +02:00

anthropic-consumer

The rest of the catalogue becomes mesh-buildable (issue 060, batch 2)

2026-09-18 02:14:09 +02:00

anthropic-manager

Defer model-usage and anthropic-manager from the buildable set (issue 060)

2026-09-18 02:48:09 +02:00

audit-logger

Review: four manifests said something stale or nothing at all

2026-09-15 22:03:33 +02:00

baserow

baserow: its data directory is 0755, as the image ships it — the cache it runs for itself does so as another user, who must reach its own directory beneath (issue 081)

2026-09-22 13:46:01 +02:00

bazarr

The rest of the catalogue becomes mesh-buildable (issue 060, batch 2)

2026-09-18 02:14:09 +02:00

bookshelf

The rest of the catalogue becomes mesh-buildable (issue 060, batch 2)

2026-09-18 02:14:09 +02:00

builder

The builder's package binding takes its port from the node, not from the manifest

2026-09-22 21:39:54 +02:00

cloudflare-dns

The rest of the catalogue becomes mesh-buildable (issue 060, batch 2)

2026-09-18 02:14:09 +02:00

confluence

The rest of the catalogue becomes mesh-buildable (issue 060, batch 2)

2026-09-18 02:14:09 +02:00

de-spiegel

Six modules take their secrets from files; the rest say precisely why not

2026-09-21 12:29:25 +02:00

distribution

Name the two modules after their software: nftables and distribution

2026-09-15 20:51:00 +02:00

dnsmasq

Review: four manifests said something stale or nothing at all

2026-09-15 22:03:33 +02:00

fail2ban

fail2ban: require the firewall capability, not the non-existent intrusion-prevention

2026-09-08 18:27:34 +02:00

gitea

Five modules keep their own secrets from the vault, under local names; route-proxy declares its bases

2026-09-21 22:16:10 +02:00

gitlab

The rest of the catalogue becomes mesh-buildable (issue 060, batch 2)

2026-09-18 02:14:09 +02:00

grafana

grafana stays a declared exception until a bed exercises its admin password

2026-09-21 12:31:59 +02:00

hello-web

Declare what hello-web is made of, to prove a build from a path

2026-09-12 16:57:18 +02:00

home-assistant

The rest of the catalogue becomes mesh-buildable (issue 060, batch 2)

2026-09-18 02:14:09 +02:00

icecast

Five modules keep their own secrets from the vault, under local names; route-proxy declares its bases

2026-09-21 22:16:10 +02:00

influxdb

Five modules keep their own secrets from the vault, under local names; route-proxy declares its bases

2026-09-21 22:16:10 +02:00

invoicing

Six modules take their secrets from files; the rest say precisely why not

2026-09-21 12:29:25 +02:00

jackett

The rest of the catalogue becomes mesh-buildable (issue 060, batch 2)

2026-09-18 02:14:09 +02:00

jira

The rest of the catalogue becomes mesh-buildable (issue 060, batch 2)

2026-09-18 02:14:09 +02:00

keycloak

Six modules take their secrets from files; the rest say precisely why not

2026-09-21 12:29:25 +02:00

lavinmq

Guard the store and management ports on adopted nodes, and load the filter through a unit that never flushes the ruleset (hq ADR 0100)

2026-09-22 17:32:32 +02:00

letta

Six modules take their secrets from files; the rest say precisely why not

2026-09-21 12:29:25 +02:00

lidarr

The rest of the catalogue becomes mesh-buildable (issue 060, batch 2)

2026-09-18 02:14:09 +02:00

local-model-consumer

local model: an ollama provider + a local-model consumer (ADR 0055)

2026-09-07 05:25:21 +02:00

mailu

Five modules keep their own secrets from the vault, under local names; route-proxy declares its bases

2026-09-21 22:16:10 +02:00

marrytts

Convert four more hal modules: bookshelf, unifi, fail2ban, marrytts

2026-09-05 12:04:14 +02:00

mesh-catalog

The env-file references to files the conversion removed go with them

2026-09-21 12:43:41 +02:00

mesh-vault

Add the mesh-vault module; redis takes its password from it

2026-09-21 00:48:13 +02:00

minio

Six modules take their secrets from files; the rest say precisely why not

2026-09-21 12:29:25 +02:00

model-usage

The env-file references to files the conversion removed go with them

2026-09-21 12:43:41 +02:00

mongodb

mongodb names its secrets' owner: the image drops to its own user before it reads the password file

2026-09-21 13:43:41 +02:00

mosquitto

The rest of the catalogue becomes mesh-buildable (issue 060, batch 2)

2026-09-18 02:14:09 +02:00

mssql

Six modules take their secrets from files; the rest say precisely why not

2026-09-21 12:29:25 +02:00

n8n

n8n and baserow no longer take the shared cache: neither can keep its keys and channels under the login it is granted — baserow runs its own, n8n in its shipped mode needs none (novox/hq issue 081)

2026-09-22 12:26:33 +02:00

nextcloud

Six modules take their secrets from files; the rest say precisely why not

2026-09-21 12:29:25 +02:00

nftables

Reload the filter on a rule change rather than restart it, so the node is never unfiltered in between (hq ADR 0102)

2026-09-22 19:47:43 +02:00

nodered

The rest of the catalogue becomes mesh-buildable (issue 060, batch 2)

2026-09-18 02:14:09 +02:00

novox.be

Pin the operator's own images by digest, as every other image already is

2026-09-11 01:06:14 +02:00

nzbget

The rest of the catalogue becomes mesh-buildable (issue 060, batch 2)

2026-09-18 02:14:09 +02:00

ollama

local model: an ollama provider + a local-model consumer (ADR 0055)

2026-09-07 05:25:21 +02:00

ombi

The rest of the catalogue becomes mesh-buildable (issue 060, batch 2)

2026-09-18 02:14:09 +02:00

only-office

Six modules take their secrets from files; the rest say precisely why not

2026-09-21 12:29:25 +02:00

openai-consumer

The rest of the catalogue becomes mesh-buildable (issue 060, batch 2)

2026-09-18 02:14:09 +02:00

photos

Six modules take their secrets from files; the rest say precisely why not

2026-09-21 12:29:25 +02:00

photos-eef

Pin the operator's own images by digest, as every other image already is

2026-09-11 01:06:14 +02:00

photos-filip

Pin the operator's own images by digest, as every other image already is

2026-09-11 01:06:14 +02:00

plex

The rest of the catalogue becomes mesh-buildable (issue 060, batch 2)

2026-09-18 02:14:09 +02:00

portainer

Ten migration-critical modules become mesh-buildable (issue 060)

2026-09-18 02:02:21 +02:00

postgres

Guard the store and management ports on adopted nodes, and load the filter through a unit that never flushes the ruleset (hq ADR 0100)

2026-09-22 17:32:32 +02:00

public-acme

Give every module that would overflow its login a short slug

2026-09-10 20:57:45 +02:00

qbittorrent

The rest of the catalogue becomes mesh-buildable (issue 060, batch 2)

2026-09-18 02:14:09 +02:00

radarr

The rest of the catalogue becomes mesh-buildable (issue 060, batch 2)

2026-09-18 02:14:09 +02:00

redis

redis: INFO is allowed back — client libraries ask it at connect, and it reads nothing a consumer keeps

2026-09-22 02:03:23 +02:00

resolv-conf

Give every module that would overflow its login a short slug

2026-09-10 20:57:45 +02:00

resolved-split-dns

Give every module that would overflow its login a short slug

2026-09-10 20:57:45 +02:00

route-proxy

route-proxy: the trust gate names the binding it reads and runs again when the authority moved; the server follows it (ADR 0099)

2026-09-21 23:25:06 +02:00

searxng

Six modules take their secrets from files; the rest say precisely why not

2026-09-21 12:29:25 +02:00

showcase

Name the two modules after their software: nftables and distribution

2026-09-15 20:51:00 +02:00

sonarr

The rest of the catalogue becomes mesh-buildable (issue 060, batch 2)

2026-09-18 02:14:09 +02:00

step-ca

The authority makes its own root at first start, and the proxy fetches it through a gate

2026-09-21 22:26:28 +02:00

tautulli

The rest of the catalogue becomes mesh-buildable (issue 060, batch 2)

2026-09-18 02:14:09 +02:00

umami

Five modules keep their own secrets from the vault, under local names; route-proxy declares its bases

2026-09-21 22:16:10 +02:00

unifi

The rest of the catalogue becomes mesh-buildable (issue 060, batch 2)

2026-09-18 02:14:09 +02:00

verdaccio

Ten migration-critical modules become mesh-buildable (issue 060)

2026-09-18 02:02:21 +02:00