4 Commits

Include renames

Author	SHA1	Message	Date
jochen	ef3e5ae9b0	Stamp no commit in this repository's own image recipes either (hq issue 363, review of #292) ... The genesis image copies the whole clone with .git, so its controller carried the commit it was built at, as the bundles did.	2026-10-13 06:47:18 +02:00
jschoubben	1f6793cf0c	The example images build from the Go the manifest pins ... Four example Dockerfiles named golang:1.25 while go.mod requires 1.26; the control plane's image takes GO_BASE from the manifest and these did not, so a build that could not fetch a newer toolchain failed at go mod download (found running the lab through the mesh).	2026-10-02 15:52:25 +02:00
jschoubben	1c4e10e0d8	The cache keeps no ACL file, and the watch keeps the cache ... The lab's diagnostics said it in one line: AUTH called without any password configured for the default user. With an aclfile configured, redis takes the default user from the file and quietly ignores requirepass — so the empty seed this module shipped left the store without any password at all, politely refusing the credential the mesh had sealed for it. And the file could never have worked here anyway: it was host-declared content, which the host reconciles, so every re-apply would have wiped what ACL SAVE wrote — a fight between two reconcilers with the tenants as the ball. So no file. requirepass alone does what it says, and durability moves to the watch, which now checks the store and not only its inputs: a restarted store comes back empty and is re-granted within a tick, because reconciling is against reality, not against a diff of instructions. A run that failed leaves last empty, so the next tick retries instead of believing the inputs were handled.	2026-09-02 01:23:38 +02:00
jschoubben	8c4a478b09	Four more of the catalogue: registry, redis, umami, grafana ... Converted from the arrangement being replaced, in its shapes rather than theirs. The registry is the manifest the lab already proved, promoted: names its image by digest and is never built (04-ISSUES/029), provides the artifact store, claims it once per machine. Redis is the third provision after a database and a bucket, and the first whose tenancy is a pattern in a shared keyspace rather than a namespace something else enforces. Its provisioner mirrors the postgres one's contract line for line — the manifest, the sealed per-consumer files, the mark, the withdrawal of orphans — and speaks RESP directly: five commands are needed, and a client library large enough to hide them would be most of the program's size. A prefix Redis would read as a pattern is refused, because the grant must mean what the manifest said; grants are persisted with ACL SAVE, or said loudly, because a cache that forgets its tenants on restart reports success until then. Umami asks the mesh for its database and a generated app secret, and carries no state of its own — the arrangement being replaced ran a bundled second postgres beside it. Grafana keeps its dashboards in a declared directory with the image's own owner. Both listen on 3000, as does the forge — which is the mesh's port assignment earning its keep. Traefik is deliberately not converted: the mesh's route provider is mesh-route-proxy, which speaks route grants natively, and a traefik that consumed them would be an adapter nobody has written pretending to be a conversion. All images pinned by real digests, resolved on this workstation today.	2026-09-01 22:44:53 +02:00