4 Commits

Include renames

Author	SHA1	Message	Date
jschoubben	cdbff1777e	Take a directory in the mesh's own tree that the engine's account owns as the mesh's, not as found (issue 1873) ... postgres's data directory moved to /var/lib/mesh/postgres. On ace and novox that directory was there, root:root 0700, before the directory resource was applied, so the engine used it as found (issue 339's rule) and left it to root: the postgres provider, running as the operator's account, cannot reach its own secrets, consumers and grants there. /var/lib/mesh is the engine's tree (root, 0755): only the engine's account makes a directory in it. A directory below it owned by that account is now the mesh's and is given its declared owner and mode. Anywhere else, or owned by another account, issue 339's rule stands.	2026-10-22 22:23:04 +02:00
mesh-tools	60371aadad	Count the home of an account a declaration makes as a home for the directory placement guard, so its own .ssh is placed (issue 1542)	2026-10-20 23:25:37 +00:00
mesh-tools	278a94d59b	Take the node-engine's parser from mesh-sdk: internal/apply imports (issue 1392)	2026-10-20 11:16:26 +00:00
jschoubben	b92fb68116	Judge a node's directories read-only before the walk refuses any (issue 358) ... Once a mesh directory's mode and owner go only through a walk that follows no link another account could make, a directory behind such a link is refused and its module gated: on the control-node that could stop the controller. The operator is to be told which directories that walk would refuse on every node before it lands. So the engine judges the declaration it keeps with the same walk, making and changing nothing: on a signed ask from the controller (mesh.node.<node>.ask.judge-directories, held to the hand-over's checks) and as `nox-mesh-host judge-directories` at the machine.	2026-10-12 13:57:52 +02:00