jschoubben
ef7750f816
Converted from the arrangement being replaced. The search engine brings its own valkey on its own network — a sidecar is just a second container resource. The time-series database initialises itself from two generated secrets, and its data and config directories are declared with the owner the image runs as. The package registry's configuration is a declared file rather than a merged one, which is the position 16-module-coverage takes on config merging: the module knows its own format because it wrote the rest of the file. Two were read and deliberately not converted, which is worth recording where the next person will look: n8n builds a custom image, so it is a module with a repository rather than a manifest in this catalogue — where a module's own code lives is ADR 0037's question, and pretending otherwise here would prejudge it. mosquitto authenticates from a hashed password file that only mosquitto_passwd can write, and the mesh delivers plaintext sealed files — so an honest conversion needs a small provisioner, the same shape as the cache's. Without one, the manifest would compose a broker nobody can log in to, which is exactly the kind of module that parses, resolves, and stops on the machine. All images pinned by real digests, resolved on this workstation today.
examples
Things that run, kept here because a contract is easier to read as working code than as prose.
Nothing here is part of the control plane. The control plane decides and never touches a machine (README); everything in this directory runs on a machine and touches it. These are reference implementations of contracts the control plane defines, and a real one ships with the module that ships the software it configures.
postgres-provisioner |
the last step of a credential: reads what the mesh delivered and makes PostgreSQL accept it |
Running the provisioner
--watch reconciles now and again whenever what the mesh delivered changes. That is what lets it
be a module: an ordinary long-running service the host supervises, rather than something that has
to be invoked after every declaration by a timer or a unit wired to a file.
It polls rather than watching the filesystem, because the host writes atomically — the file is replaced, so a watch on the path stops seeing anything after the first replacement. A watcher that silently stops working is worse than a poll.
Credentials are compared by digest and never by content. This runs for as long as the machine is up, and a secret does not belong in a long-lived variable when a hash answers the same question.