jschoubben
9176aea6c4
Merge pull request 'The packages port given at genesis is a node setting, not manifest text (hq issue 085)' ( #21 ) from feat/packages-port into main
2026-09-22 21:59:46 +02:00
jschoubben
744beb6c51
A re-run does not replace the registered forge with whatever checkout it was given
...
Registering a module is an overwrite. Recording the forge's port ran `module add`
every time, so a genesis re-run pointed at an older catalogue would replace the
manifest of a forge that is built and assigned — with a push a few lines later.
Registering is only here so a settings row has a module row to hang on, and that
row is already there on a mesh that knows the forge. So: ask first, and skip.
Two comments narrowed to what is true. What follows the node's setting is what
the mesh derives from a module's ports — its container mapping, its filter rule,
its opening and what it serves. The forge's own address in its runtime's
environment (hq 088) and its route contribution's port do not, and are already
wrong for any port the mesh assigned. And a settings layer is the module's, not
one resource's: a second mergeable file on the builder would be given `serves`
too.
novox/hq 04-ISSUES/085
2026-09-22 21:56:42 +02:00
jschoubben
c4ce57997e
The packages port given at genesis is a module's setting, like every other
...
Every foundation port given at genesis became a per-node setting of the module
that binds it, except the package registry's: that one was fixed by rewriting
the builder's manifest when the installer registered it. Registering the builder
again from the catalogue undid it, and the forge's own module, when it took the
bootstrap forge over, came up on the catalogue's port — which on a machine where
a predecessor holds 3000 points the builder at the predecessor's forge.
So the rewrite is gone, and the port is recorded twice as a setting, both from
the one input:
- the forge's module is registered at genesis — not assigned, nothing of it runs
— so the controller has something to hold `{"ports": {"3000": <given>}}`
against. Assigning the forge later raises it on the port this machine was
given, and its container, its filter rule, its opening, what it serves and
what consumers are told all read it from there.
- the builder is given `{"serves": {"port": <given>}}`, which merges into the
binding it carries in place of one nothing can resolve yet.
A genesis on the catalogue's port records nothing and registers nothing, so it
does exactly what it did before.
novox/hq 04-ISSUES/085, ADR 0100
2026-09-22 21:40:02 +02:00
jschoubben
0db1fbdb3b
Merge pull request 'Adoption mode: a node in use is adopted before it is converged (hq ADR 0100–0103)' ( #20 ) from feat/adoption-mode into main
2026-09-22 21:01:46 +02:00
jschoubben
6dce63b534
Say plainly where the raised package registry runs, and why an action outside a container still runs
2026-09-22 20:01:26 +02:00
jschoubben
c03a31cec5
Count only a record of making something at a path as the mesh's, not an access record (hq ADR 0103)
2026-09-22 20:01:14 +02:00
jschoubben
01e8affa89
Count an unasked report as said only once the broker has taken it (hq ADR 0100)
2026-09-22 20:00:59 +02:00
jschoubben
b4c21b4f67
Read a machine's iptables rules when it has no nft, instead of calling it unfiltered (hq ADR 0100)
2026-09-22 19:59:22 +02:00
jschoubben
c7ff0b9026
Refuse an endpoint whose port is not the one the private network's hub binds (hq ADR 0100)
2026-09-22 19:58:37 +02:00
jschoubben
04665d36c8
Exempt only the daemons a fresh machine was measured to run from counting as in use (hq ADR 0101)
2026-09-22 19:57:52 +02:00
jschoubben
7beb752be0
Take a key or list member the host may have written itself as the mesh's, so undeclaring gives the file back (hq ADR 0102)
2026-09-22 19:57:15 +02:00
jschoubben
0bd22e50f2
Apply one declaration at a time, so the link and the reconcile do not lose each other's record
2026-09-22 19:56:05 +02:00
jschoubben
9839006d48
Retire the found firewall only once the mesh's own filter is loaded on the machine (hq ADR 0100)
2026-09-22 19:54:43 +02:00
jschoubben
5f126021b7
Keep the originals the carried bundle writes over beside the node's state (hq ADR 0100)
2026-09-22 19:53:50 +02:00
jschoubben
eb2f4fcf53
Keep an original by its path and its content, so a second original at one path is not discarded (hq ADR 0100)
2026-09-22 19:53:15 +02:00
jschoubben
232ed74940
gofmt the ufw rule's direction field
2026-09-22 19:52:40 +02:00
jschoubben
40e8ea9fda
Hold a unit an administrator installed whatever its state, and a packaged unit only when the machine uses it (hq ADR 0103)
2026-09-22 19:52:37 +02:00
jschoubben
d3f2595968
Read a ufw rule's direction: an outgoing rule answers no opening, and incoming is the default ufw merges on (hq ADR 0103)
2026-09-22 19:51:35 +02:00
jschoubben
dc861fb4a8
Do not arm a scheduled step of a module held as found on an adopted node (hq ADR 0103)
2026-09-22 19:48:05 +02:00
jschoubben
da008460ac
Fail a resource when the container runtime cannot answer, instead of reading silence as nothing there (hq ADR 0100)
2026-09-22 19:46:56 +02:00
jschoubben
0ea646b384
Keep the derived filter in force when a guard resource failed on the way back to adopted (hq ADR 0103)
2026-09-22 19:45:33 +02:00
jschoubben
60bb3d895c
Count a unit as found only when the machine runs it or starts it at boot, so a packaged unit nothing ran is not held (hq ADR 0103, found by the adoption bed)
2026-09-22 18:47:48 +02:00
jschoubben
bde5e3461c
Keep the original of any file the host writes over without a record of it, on every node, and name where (hq ADR 0100)
2026-09-22 18:35:03 +02:00
jschoubben
272e1a65ea
Reload the guard for a changed table and restart it only for a changed unit, as the controller declares it (hq ADR 0103)
2026-09-22 18:33:57 +02:00
jschoubben
b4f3eaf11b
Release a whole-file hold once the file is declared written into (hq ADR 0102)
2026-09-22 18:33:45 +02:00
jschoubben
bd3fd17ad8
Do not count the machine's own plumbing mounted into a container as found data (hq ADR 0103)
2026-09-22 18:33:29 +02:00
jschoubben
a4e4632077
gofmt the store's firewall record
2026-09-22 18:33:13 +02:00
jschoubben
444ad8f3cf
Record the forward policies before disabling ufw, so a retried retirement restores them (hq ADR 0100)
2026-09-22 18:33:09 +02:00
jschoubben
aef4993d10
Hold an archive, a process's unit and a user found on an adopted node for an untaken module (hq ADR 0103)
2026-09-22 18:32:20 +02:00
jschoubben
491e04fb8f
Load the guard before removing the derived filter when a node returns to adopted, and defer the adoption's orphans only on the flip (hq ADR 0103)
2026-09-22 18:30:13 +02:00
jschoubben
b531c47486
Refuse an opening ufw would merge into a found rule that does other than a plain allow, and read log types in either place (hq ADR 0103)
2026-09-22 18:29:06 +02:00
jschoubben
facf6af46a
Add the mesh's members to a list found in a file written into, and take back only those (hq ADR 0102)
2026-09-22 18:27:51 +02:00
jschoubben
48a8f4cf9d
Point the builder's package binding at the port given with --packages-port (hq ADR 0100)
2026-09-22 18:16:00 +02:00
jschoubben
4a095df2f9
Let go of a hold whose resource is no longer declared, touching nothing on disk (hq ADR 0100)
2026-09-22 18:14:37 +02:00
jschoubben
824cb60cbb
Hold a found directory, a found service's unit, a container that would mount found data, and a step run in a held container on an adopted node (hq ADR 0103)
2026-09-22 18:14:37 +02:00
jschoubben
35ecf68393
Accept --registry as a host alone again, completing it with the registry's port (hq ADR 0100)
2026-09-22 18:08:50 +02:00
jschoubben
d59d232656
Let a re-run of genesis find the package registry it raised itself under its own name (hq ADR 0100)
2026-09-22 18:08:20 +02:00
jschoubben
078e84c681
Read an adopted or converged node's mode from its state on a re-run of genesis, and refuse a flag that disagrees (hq ADR 0103)
2026-09-22 18:08:02 +02:00
jschoubben
52e139d96f
Add no opening a found ufw rule already answers, since ufw takes rules differing only in comment for one, as captured on a lab machine (hq ADR 0103)
2026-09-22 18:06:47 +02:00
jschoubben
da65f84c45
Read fail2ban's bans as no firewall, and an iptables-nft reject as a refusal, from rulesets captured on a lab machine (hq ADR 0100)
2026-09-22 18:04:48 +02:00
jschoubben
8e2f75454d
Put back the forward policy ufw disable opens when the found firewall is retired, as measured on a lab machine (hq ADR 0100)
2026-09-22 18:03:30 +02:00
jschoubben
588ab71d14
Remove an adopted node's guard and openings last on the flip, and keep them if anything failed (hq ADR 0103)
2026-09-22 18:02:46 +02:00
jschoubben
9033e3da98
Retire the found firewall only on a converged declaration from the mesh, never on a carried apply (hq ADR 0100)
2026-09-22 18:01:49 +02:00
jschoubben
c989b57439
Guard the broker's plaintext port too at an adopted genesis: the filter admits it from the private network only (hq ADR 0103)
2026-09-22 18:01:14 +02:00
jschoubben
14b3ffbd40
Guard only packets addressed to this machine, and load the guard before the network and stop it only at shutdown (hq ADR 0103)
2026-09-22 18:00:54 +02:00
jschoubben
1e0c6a3516
Publish a reconcile report when what is reachable changed, so the controller's converge preview stays fresh (hq ADR 0100)
2026-09-22 18:00:03 +02:00
jschoubben
0f126d137c
Write into a file the machine shares instead of over it, and reload a service that re-reads its configuration instead of restarting it (hq ADR 0102)
2026-09-22 17:48:57 +02:00
jschoubben
6eabed63eb
Reload the service manager's units before restarting a service whose files changed, and start the guard before the network as the controller declares it (hq ADR 0100)
2026-09-22 17:38:17 +02:00
jschoubben
3e0e6e6b7e
Delete a forwarded opening the way ufw accepts it, and read a fresh machine's resolver as not in use — both measured on a lab machine (hq ADR 0100)
2026-09-22 17:37:01 +02:00
jschoubben
5e3dd3f59c
Raise a machine in use adopted: keep its firewall, load no dropping table, guard the mesh's own ports, and take only the mesh's own modules (hq ADR 0100)
2026-09-22 17:32:44 +02:00
jschoubben