From 71c8080359a712c545438c494dc332bf66576bb9 Mon Sep 17 00:00:00 2001
From: jochen <jschoubben@novox.be>
Date: Sat, 26 Sep 2026 14:55:04 +0200
Subject: [PATCH] Declare the broker's TLS directory as an access, not an
 undeclared bind
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The swap from a named volume to the host directory left the mount undeclared, which main's own
manifest check now refuses: a bind the module did not declare is created by the runtime as root, so
the module's owner and mode never reach it and ADR 0030's data rule does not cover it.

The directory is the broker's — lavinmq declares it as its own, mode 0700 — so from here it is an
access, read-only: a pre-existing path this module is granted use of and does not own.
---
 module.json | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/module.json b/module.json
index f46b1d1..1694a31 100644
--- a/module.json
+++ b/module.json
@@ -11,6 +11,12 @@
       "scope": "mesh"
     }
   ],
+  "accesses": [
+    {
+      "path": "/var/lib/mesh-broker-tls",
+      "mode": "read"
+    }
+  ],
   "own-secrets": {
     "inventory": "/var/lib/mesh/mesh-controller/inventory",
     "identity": "/var/lib/mesh/mesh-controller/identity",