The network carries the registry trust (ADR 0082, issues 042/048)

Being on the private network is what grants a machine the right to pull from the mesh's artifact store, so the module that puts a machine on the network writes the runtime's trust — a merged /etc/docker/daemon.json naming the store's internal name under insecure-registries, and a docker.service restart when that fact first lands. The registry speaks plain HTTP because every path to it is already inside the overlay's encryption; the provider is found, not configured — whichever module serves artifact-store, on whichever machine holds it — and with no store on the network nothing is written, which is genesis. https://claude.ai/code/session_01D6qtiYU3P9jk3pnAXyAFyx
2026-09-17 23:05:23 +02:00
parent 39dc927a6f
commit 0e9035d479
3 changed files with 133 additions and 1 deletions
@@ -0,0 +1,56 @@
+package overlay
+
+import (
+	"strings"
+	"testing"
+)
+
+func TestTheNetworkCarriesRegistryTrust(t *testing.T) {
+	// novox/hq ADR 0082: being on the network is what grants a machine the right to pull from the
+	// mesh's artifact store in the clear, so the network module writes the runtime's trust — and
+	// writes nothing when the mesh has no store to trust.
+	nodes := []Node{
+		{Name: "anchor", Site: "lab", Hub: true, Endpoint: "192.0.2.10:51820", Key: "k1", Address: "10.42.0.1"},
+		{Name: "node2", Site: "lab", Key: "k2", Address: "10.42.0.2"},
+	}
+	g, err := From(nodes, "10.42.0.0/16", "")
+	if err != nil {
+		t.Fatal(err)
+	}
+	plain, _, err := g.Resources("node2")
+	if err != nil {
+		t.Fatal(err)
+	}
+	for _, r := range plain {
+		if r["id"] == "registry-trust" {
+			t.Fatal("trust was written with no artifact store to trust")
+		}
+	}
+
+	g.TrustRegistry("anchor.internal:5000")
+	trusted, part, err := g.Resources("node2")
+	if err != nil || !part {
+		t.Fatalf("resources: %v part=%v", err, part)
+	}
+	var file, service map[string]any
+	for _, r := range trusted {
+		switch r["id"] {
+		case "registry-trust":
+			file = r
+		case "registry-trust-reload":
+			service = r
+		}
+	}
+	if file == nil || service == nil {
+		t.Fatalf("the trust file or its reload is missing: %v", trusted)
+	}
+	if file["path"] != "/etc/docker/daemon.json" || file["merge"] != "json" {
+		t.Fatalf("the trust is not a merged daemon.json: %v", file)
+	}
+	if content, _ := file["content"].(string); !strings.Contains(content, `"anchor.internal:5000"`) {
+		t.Fatalf("the trust does not name the store: %v", file["content"])
+	}
+	if service["unit"] != "docker.service" {
+		t.Fatalf("the reload does not restart the runtime: %v", service)
+	}
+}