jschoubben
d278edabe0
Node-RED and Icecast are the plain shapes — a data directory owned by the number inside, generated passwords in a host-written env file, one declared port each. Portainer mounts the container runtime's socket, which is the mount 04-ISSUES/026 is reopened about: a machine facility, not the module's data, spelled today exactly like a data directory. It is converted as it runs now rather than held hostage to that vocabulary — the same mount the builder already carries — and it will be the second citation when 026 gets its answer. Letta stays unconverted for now: the arrangement being replaced pins a year-old image of a fast-moving project, and converting a pin nobody would keep is not fidelity. It wants a fresh look at what version to run, which is a decision and not a translation. All pinned by real digests, resolved on this workstation today.
examples
Things that run, kept here because a contract is easier to read as working code than as prose.
Nothing here is part of the control plane. The control plane decides and never touches a machine (README); everything in this directory runs on a machine and touches it. These are reference implementations of contracts the control plane defines, and a real one ships with the module that ships the software it configures.
postgres-provisioner |
the last step of a credential: reads what the mesh delivered and makes PostgreSQL accept it |
Running the provisioner
--watch reconciles now and again whenever what the mesh delivered changes. That is what lets it
be a module: an ordinary long-running service the host supervises, rather than something that has
to be invoked after every declaration by a timer or a unit wired to a file.
It polls rather than watching the filesystem, because the host writes atomically — the file is replaced, so a watch on the path stops seeing anything after the first replacement. A watcher that silently stops working is worse than a poll.
Credentials are compared by digest and never by content. This runs for as long as the machine is up, and a secret does not belong in a long-lived variable when a hash answers the same question.