6 Commits

Include renames

Author	SHA1	Message	Date
jochen	37947ca4ee	Raise genesis on the bus the mesh runs on, from one bundle (hq issue 146, ADR 0331) ... The installer could not raise a first node: the old bundle's control plane had no MESH_BUS_NATS and crash-looped, and the NATS bundle was refused because rootsecrets only knew the previous broker's guest:guest@ template. One bundle now, the NATS one. rootsecrets makes the controller's bus account and puts it in both placeholders (the address and the bcrypt hash in the carried user list), kept with its hash so a re-run writes the same bundle. Preflight refuses a template naming no bus connection it knows, naming the placeholder, instead of waiting out the verify step. The broker step adopts the bus as the nats module and refuses, by name, a catalogue without it or a server that is not the foundation's container.	2026-10-12 22:49:49 +02:00
jschoubben	272e1a65ea	Reload the guard for a changed table and restart it only for a changed unit, as the controller declares it (hq ADR 0103)	2026-09-22 18:33:57 +02:00
jschoubben	c989b57439	Guard the broker's plaintext port too at an adopted genesis: the filter admits it from the private network only (hq ADR 0103)	2026-09-22 18:01:14 +02:00
jschoubben	14b3ffbd40	Guard only packets addressed to this machine, and load the guard before the network and stop it only at shutdown (hq ADR 0103)	2026-09-22 18:00:54 +02:00
jschoubben	6eabed63eb	Reload the service manager's units before restarting a service whose files changed, and start the guard before the network as the controller declares it (hq ADR 0100)	2026-09-22 17:38:17 +02:00
jschoubben	5e3dd3f59c	Raise a machine in use adopted: keep its firewall, load no dropping table, guard the mesh's own ports, and take only the mesh's own modules (hq ADR 0100)	2026-09-22 17:32:44 +02:00