novox/mesh-host
3
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Compare commits

base: novox/mesh-host:4ef41ad5a048437fe045f8b45d076297b732ae37
Branches Tags
novox/mesh-host:main novox/mesh-host:fix/genesis-lets-the-controller-ask novox/mesh-host:feat/one-bus novox/mesh-host:fix/genesis-follows-the-forge novox/mesh-host:feat/a-host-adopts-a-membership-at-start novox/mesh-host:fix/genesis-accounts-hear-and-have-jetstream novox/mesh-host:fix/a-host-uses-its-own-inbox novox/mesh-host:fix/a-host-logs-in-as-its-node-user novox/mesh-host:feat/a-machine-moves-to-the-bus-it-is-told novox/mesh-host:feat/nats-genesis
...
compare: novox/mesh-host:feat/a-host-adopts-a-membership-at-start
Branches Tags
novox/mesh-host:main novox/mesh-host:fix/genesis-lets-the-controller-ask novox/mesh-host:feat/one-bus novox/mesh-host:fix/genesis-follows-the-forge novox/mesh-host:feat/a-host-adopts-a-membership-at-start novox/mesh-host:fix/genesis-accounts-hear-and-have-jetstream novox/mesh-host:fix/a-host-uses-its-own-inbox novox/mesh-host:fix/a-host-logs-in-as-its-node-user novox/mesh-host:feat/a-machine-moves-to-the-bus-it-is-told novox/mesh-host:feat/nats-genesis
3 Commits
4ef41ad5a0 ... feat/a-host-adopts-a-membership-at-start
Author SHA1 Message Date
jschoubben 68a193d6f0 A host adopts a delivered membership at start, not only after a declaration 
The rescue path: an operator writes the membership file by hand on a machine no
bus can reach — rotated while it still held the old password — and restarts the
host. Same file, same check as the declaration path.
 2026-09-28 02:21:56 +02:00
jschoubben 4fba884d47 Merge pull request 'Genesis: the first user list lets the controller hear its consumers, and the account has JetStream' (#36) from fix/genesis-accounts-hear-and-have-jetstream into main 2026-09-27 23:47:41 +00:00
jschoubben 15f0dabf32 Genesis: the first user list lets the controller hear its consumers, and the account has JetStream 
Two things the controller's own composition now derives and the installer's
carried list did not: the delivery subjects of the controller's consumers, and
JetStream enabled on the account — without which the first bound consumer is
refused. Found live on a mesh moved rather than raised; a fresh genesis would
have met both at first start.
 2026-09-28 01:46:14 +02:00
2 changed files with 8 additions and 3 deletions
Expand all files Collapse all files
cmd/mesh-host/main.go
+7 -2
View File
@@ -962,9 +962,14 @@ func runLink(ctx context.Context, opts options) error {
return nil // asked to stop while waiting return nil // asked to stop while waiting
} }
fmt.Printf("node %s, linking to %s\n", mine.Node, mine.Membership.Broker) // **A membership delivered while this host was not running is adopted before the first dial.**
// The ordinary path is a declaration, read after it applies; the rescue path is an operator
// writing the file by hand on a machine no bus can reach — rotated while it held the old
// password, say — and restarting the host (design 28, task 5.2). Same file, same check.
say := func(line string) { fmt.Println(line) } say := func(line string) { fmt.Println(line) }
adoptDeliveredMembership(identity.Path(opts.state), &mine, say)
fmt.Printf("node %s, linking to %s\n", mine.Node, mine.Membership.Broker)
// One scheduler for the life of the process, re-established from each applied declaration // One scheduler for the life of the process, re-established from each applied declaration
// (novox/hq ADR 0053). It fires scheduled steps on their cadence, surviving across applies and // (novox/hq ADR 0053). It fires scheduled steps on their cadence, surviving across applies and
examples/foundation-first-node-nats.lock
+1 -1
View File
@@ -152,7 +152,7 @@
"type": "file", "type": "file",
"path": "/var/lib/mesh-bus-conf/accounts.conf", "path": "/var/lib/mesh-bus-conf/accounts.conf",
"mode": "0600", "mode": "0600",
"content": "// The first user list, carried by the installer because at genesis there is no mesh to\n// compose one. A bootstrap credential, rotated with the store's and replaced by the\n// controller's own composition from its first start onward.\naccounts {\n MESH {\n users = [\n { user: \"controller\", password: \"$2a$10$AHqJgOifIVbU41KmATiMhuXFs8xa7Wl2HuN4UVBCXdN2jIQzjqApy\", permissions: {\n publish: { allow: [\"$JS.API.>\", \"$JS.ACK.CONTROL.controller.>\", \"$JS.ACK.EVENTS.controller.>\", \"_INBOX.enrol.>\", \"mesh.control.>\", \"mesh.node.>\", \"mesh.seat.mesh-build-machine.accept.>\"] }\n subscribe: { allow: [\"$JS.API.>\", \"_INBOX.controller.>\", \"mesh.control.>\", \"mesh.mod.mesh-catalog.event.catching-up\", \"mesh.mod.mesh-catalog.event.upgraded\", \"mesh.seat.mesh-build-machine.event.built\"] }\n allow_responses: { max: 1, ttl: \"1m\" }\n } }\n ]\n }\n}\n" "content": "// The first user list, carried by the installer because at genesis there is no mesh to\n// compose one. A bootstrap credential, rotated with the store's and replaced by the\n// controller's own composition from its first start onward.\naccounts {\n MESH {\n jetstream: enabled\n users = [\n { user: \"controller\", password: \"$2a$10$AHqJgOifIVbU41KmATiMhuXFs8xa7Wl2HuN4UVBCXdN2jIQzjqApy\", permissions: {\n publish: { allow: [\"$JS.API.>\", \"$JS.ACK.CONTROL.controller.>\", \"$JS.ACK.EVENTS.controller.>\", \"_INBOX.enrol.>\", \"mesh.control.>\", \"mesh.node.>\", \"mesh.seat.mesh-build-machine.accept.>\"] }\n subscribe: { allow: [\"$JS.API.>\", \"_DELIVER.controller\", \"_DELIVER.controller.>\", \"_INBOX.controller.>\", \"mesh.control.>\", \"mesh.mod.mesh-catalog.event.catching-up\", \"mesh.mod.mesh-catalog.event.upgraded\", \"mesh.seat.mesh-build-machine.event.built\"] }\n allow_responses: { max: 1, ttl: \"1m\" }\n } }\n ]\n }\n}\n"
}, },
{ {
"id": "broker", "id": "broker",