 jschoubben
|
c7ff0b9026
|
Refuse an endpoint whose port is not the one the private network's hub binds (hq ADR 0100)
|
2026-09-22 19:58:37 +02:00 |
|
|
jschoubben
|
04665d36c8
|
Exempt only the daemons a fresh machine was measured to run from counting as in use (hq ADR 0101)
|
2026-09-22 19:57:52 +02:00 |
|
|
jschoubben
|
7beb752be0
|
Take a key or list member the host may have written itself as the mesh's, so undeclaring gives the file back (hq ADR 0102)
|
2026-09-22 19:57:15 +02:00 |
|
|
jschoubben
|
0bd22e50f2
|
Apply one declaration at a time, so the link and the reconcile do not lose each other's record
|
2026-09-22 19:56:05 +02:00 |
|
|
jschoubben
|
9839006d48
|
Retire the found firewall only once the mesh's own filter is loaded on the machine (hq ADR 0100)
|
2026-09-22 19:54:43 +02:00 |
|
|
jschoubben
|
5f126021b7
|
Keep the originals the carried bundle writes over beside the node's state (hq ADR 0100)
|
2026-09-22 19:53:50 +02:00 |
|
|
jschoubben
|
eb2f4fcf53
|
Keep an original by its path and its content, so a second original at one path is not discarded (hq ADR 0100)
|
2026-09-22 19:53:15 +02:00 |
|
|
jschoubben
|
232ed74940
|
gofmt the ufw rule's direction field
|
2026-09-22 19:52:40 +02:00 |
|
|
jschoubben
|
40e8ea9fda
|
Hold a unit an administrator installed whatever its state, and a packaged unit only when the machine uses it (hq ADR 0103)
|
2026-09-22 19:52:37 +02:00 |
|
|
jschoubben
|
d3f2595968
|
Read a ufw rule's direction: an outgoing rule answers no opening, and incoming is the default ufw merges on (hq ADR 0103)
|
2026-09-22 19:51:35 +02:00 |
|
|
jschoubben
|
dc861fb4a8
|
Do not arm a scheduled step of a module held as found on an adopted node (hq ADR 0103)
|
2026-09-22 19:48:05 +02:00 |
|
|
jschoubben
|
da008460ac
|
Fail a resource when the container runtime cannot answer, instead of reading silence as nothing there (hq ADR 0100)
|
2026-09-22 19:46:56 +02:00 |
|
|
jschoubben
|
0ea646b384
|
Keep the derived filter in force when a guard resource failed on the way back to adopted (hq ADR 0103)
|
2026-09-22 19:45:33 +02:00 |
|
|
jschoubben
|
60bb3d895c
|
Count a unit as found only when the machine runs it or starts it at boot, so a packaged unit nothing ran is not held (hq ADR 0103, found by the adoption bed)
|
2026-09-22 18:47:48 +02:00 |
|
|
jschoubben
|
bde5e3461c
|
Keep the original of any file the host writes over without a record of it, on every node, and name where (hq ADR 0100)
|
2026-09-22 18:35:03 +02:00 |
|
|
jschoubben
|
272e1a65ea
|
Reload the guard for a changed table and restart it only for a changed unit, as the controller declares it (hq ADR 0103)
|
2026-09-22 18:33:57 +02:00 |
|
|
jschoubben
|
b4f3eaf11b
|
Release a whole-file hold once the file is declared written into (hq ADR 0102)
|
2026-09-22 18:33:45 +02:00 |
|
|
jschoubben
|
bd3fd17ad8
|
Do not count the machine's own plumbing mounted into a container as found data (hq ADR 0103)
|
2026-09-22 18:33:29 +02:00 |
|
|
jschoubben
|
a4e4632077
|
gofmt the store's firewall record
|
2026-09-22 18:33:13 +02:00 |
|
|
jschoubben
|
444ad8f3cf
|
Record the forward policies before disabling ufw, so a retried retirement restores them (hq ADR 0100)
|
2026-09-22 18:33:09 +02:00 |
|
|
jschoubben
|
aef4993d10
|
Hold an archive, a process's unit and a user found on an adopted node for an untaken module (hq ADR 0103)
|
2026-09-22 18:32:20 +02:00 |
|
|
jschoubben
|
491e04fb8f
|
Load the guard before removing the derived filter when a node returns to adopted, and defer the adoption's orphans only on the flip (hq ADR 0103)
|
2026-09-22 18:30:13 +02:00 |
|
|
jschoubben
|
b531c47486
|
Refuse an opening ufw would merge into a found rule that does other than a plain allow, and read log types in either place (hq ADR 0103)
|
2026-09-22 18:29:06 +02:00 |
|
|
jschoubben
|
facf6af46a
|
Add the mesh's members to a list found in a file written into, and take back only those (hq ADR 0102)
|
2026-09-22 18:27:51 +02:00 |
|
|
jschoubben
|
48a8f4cf9d
|
Point the builder's package binding at the port given with --packages-port (hq ADR 0100)
|
2026-09-22 18:16:00 +02:00 |
|
|
jschoubben
|
4a095df2f9
|
Let go of a hold whose resource is no longer declared, touching nothing on disk (hq ADR 0100)
|
2026-09-22 18:14:37 +02:00 |
|
|
jschoubben
|
824cb60cbb
|
Hold a found directory, a found service's unit, a container that would mount found data, and a step run in a held container on an adopted node (hq ADR 0103)
|
2026-09-22 18:14:37 +02:00 |
|
|
jschoubben
|
35ecf68393
|
Accept --registry as a host alone again, completing it with the registry's port (hq ADR 0100)
|
2026-09-22 18:08:50 +02:00 |
|
|
jschoubben
|
d59d232656
|
Let a re-run of genesis find the package registry it raised itself under its own name (hq ADR 0100)
|
2026-09-22 18:08:20 +02:00 |
|
|
jschoubben
|
078e84c681
|
Read an adopted or converged node's mode from its state on a re-run of genesis, and refuse a flag that disagrees (hq ADR 0103)
|
2026-09-22 18:08:02 +02:00 |
|
|
jschoubben
|
52e139d96f
|
Add no opening a found ufw rule already answers, since ufw takes rules differing only in comment for one, as captured on a lab machine (hq ADR 0103)
|
2026-09-22 18:06:47 +02:00 |
|
|
jschoubben
|
da65f84c45
|
Read fail2ban's bans as no firewall, and an iptables-nft reject as a refusal, from rulesets captured on a lab machine (hq ADR 0100)
|
2026-09-22 18:04:48 +02:00 |
|
|
jschoubben
|
8e2f75454d
|
Put back the forward policy ufw disable opens when the found firewall is retired, as measured on a lab machine (hq ADR 0100)
|
2026-09-22 18:03:30 +02:00 |
|
|
jschoubben
|
588ab71d14
|
Remove an adopted node's guard and openings last on the flip, and keep them if anything failed (hq ADR 0103)
|
2026-09-22 18:02:46 +02:00 |
|
|
jschoubben
|
9033e3da98
|
Retire the found firewall only on a converged declaration from the mesh, never on a carried apply (hq ADR 0100)
|
2026-09-22 18:01:49 +02:00 |
|
|
jschoubben
|
c989b57439
|
Guard the broker's plaintext port too at an adopted genesis: the filter admits it from the private network only (hq ADR 0103)
|
2026-09-22 18:01:14 +02:00 |
|
|
jschoubben
|
14b3ffbd40
|
Guard only packets addressed to this machine, and load the guard before the network and stop it only at shutdown (hq ADR 0103)
|
2026-09-22 18:00:54 +02:00 |
|
|
jschoubben
|
1e0c6a3516
|
Publish a reconcile report when what is reachable changed, so the controller's converge preview stays fresh (hq ADR 0100)
|
2026-09-22 18:00:03 +02:00 |
|
|
jschoubben
|
0f126d137c
|
Write into a file the machine shares instead of over it, and reload a service that re-reads its configuration instead of restarting it (hq ADR 0102)
|
2026-09-22 17:48:57 +02:00 |
|
|
jschoubben
|
6eabed63eb
|
Reload the service manager's units before restarting a service whose files changed, and start the guard before the network as the controller declares it (hq ADR 0100)
|
2026-09-22 17:38:17 +02:00 |
|
|
jschoubben
|
3e0e6e6b7e
|
Delete a forwarded opening the way ufw accepts it, and read a fresh machine's resolver as not in use — both measured on a lab machine (hq ADR 0100)
|
2026-09-22 17:37:01 +02:00 |
|
|
jschoubben
|
5e3dd3f59c
|
Raise a machine in use adopted: keep its firewall, load no dropping table, guard the mesh's own ports, and take only the mesh's own modules (hq ADR 0100)
|
2026-09-22 17:32:44 +02:00 |
|
|
jschoubben
|
4811f176fd
|
Refuse a converged genesis on a machine in use, naming every container and listener counted (hq ADR 0100)
|
2026-09-22 17:29:32 +02:00 |
|
|
jschoubben
|
3964d9da0a
|
Take the foundation's ports as genesis inputs, check them free, and hand them to the controller as the node's settings (hq ADR 0100)
|
2026-09-22 17:28:36 +02:00 |
|
|
jschoubben
|
770f589401
|
Report what an adopted node holds, its firewall and what is reachable, and speak unasked when that changes (hq ADR 0100)
|
2026-09-22 17:22:31 +02:00 |
|
|
jschoubben
|
3c90d155b3
|
Converge openings through the firewall an adopted node was found with, and retire it only when the node converges (hq ADR 0100)
|
2026-09-22 17:19:49 +02:00 |
|
|
jschoubben
|
3a613113be
|
Keep what an adopted node was found holding until its module is taken, and report it held (hq ADR 0100)
|
2026-09-22 17:14:04 +02:00 |
|
|
jschoubben
|
fcc447c216
|
Read a node's adoption from every declaration, so the host knows which modules are untaken (hq ADR 0100)
|
2026-09-22 17:11:26 +02:00 |
|
|
jschoubben
|
4fc0330937
|
Merge pull request 'An enrolling node asks again while the mesh cannot answer, and proves it holds its key (issue 083)' (#19) from multiple-fixes into main
|
2026-09-22 14:42:56 +02:00 |
|
|
jschoubben
|
406a5559b0
|
An enrolling node signs its request with the identity it just generated, so the mesh can tell it from anyone who knows its public key (novox/hq issue 083)
|
2026-09-22 14:33:31 +02:00 |
|