Genesis lets the control plane state its own facts

A mesh raised from nothing must be able to say what it applied and what a machine refused (novox/hq ADR 0134), and the first user list is what permits it. Kept in step with the controller's own composition by the test that reads this file.
Merge pull request 'A resource's owner is read to the last dot, because a module's name may contain one' (#42 ) from fix/a-resources-owner-is-read-to-the-last-dot into main
2026-09-28 16:07:20 +02:00 · 2026-09-28 13:45:01 +00:00
1 changed files with 1 additions and 1 deletions
@@ -152,7 +152,7 @@
      "type": "file",
      "path": "/var/lib/mesh-bus-conf/accounts.conf",
      "mode": "0600",
-      "content": "// The first user list, carried by the installer because at genesis there is no mesh to\n// compose one. A bootstrap credential, rotated with the store's and replaced by the\n// controller's own composition from its first start onward.\naccounts {\n  MESH {\n    jetstream: enabled\n    users = [\n      { user: \"controller\", password: \"$2a$10$AHqJgOifIVbU41KmATiMhuXFs8xa7Wl2HuN4UVBCXdN2jIQzjqApy\", permissions: {\n        publish: { allow: [\"$JS.API.>\", \"$JS.ACK.CONTROL.controller.>\", \"$JS.ACK.EVENTS.controller.>\", \"_INBOX.enrol.>\", \"mesh.control.>\", \"mesh.mod.*.tool.>\", \"mesh.node.>\", \"mesh.seat.mesh-build-machine.accept.>\"] }\n        subscribe: { allow: [\"$JS.API.>\", \"_DELIVER.controller\", \"_DELIVER.controller.>\", \"_INBOX.controller.>\", \"mesh.control.>\", \"mesh.mod.mesh-catalog.event.catching-up\", \"mesh.mod.mesh-catalog.event.upgraded\", \"mesh.mod.gitea.event.pull.merged\", \"mesh.seat.mesh-build-machine.event.built\"] }\n        allow_responses: { max: 1, ttl: \"1m\" }\n      } }\n    ]\n  }\n}\n"
+      "content": "// The first user list, carried by the installer because at genesis there is no mesh to\n// compose one. A bootstrap credential, rotated with the store's and replaced by the\n// controller's own composition from its first start onward.\naccounts {\n  MESH {\n    jetstream: enabled\n    users = [\n      { user: \"controller\", password: \"$2a$10$AHqJgOifIVbU41KmATiMhuXFs8xa7Wl2HuN4UVBCXdN2jIQzjqApy\", permissions: {\n        publish: { allow: [\"$JS.API.>\", \"$JS.ACK.CONTROL.controller.>\", \"$JS.ACK.EVENTS.controller.>\", \"_INBOX.enrol.>\", \"mesh.control.>\", \"mesh.mod.*.tool.>\", \"mesh.node.>\", \"mesh.seat.mesh-build-machine.accept.>\", \"mesh.seat.mesh-controller.event.applied\", \"mesh.seat.mesh-controller.event.built-before\", \"mesh.seat.mesh-controller.event.refused\"] }\n        subscribe: { allow: [\"$JS.API.>\", \"_DELIVER.controller\", \"_DELIVER.controller.>\", \"_INBOX.controller.>\", \"mesh.control.>\", \"mesh.mod.mesh-catalog.event.catching-up\", \"mesh.mod.mesh-catalog.event.upgraded\", \"mesh.mod.gitea.event.pull.merged\", \"mesh.seat.mesh-build-machine.event.built\"] }\n        allow_responses: { max: 1, ttl: \"1m\" }\n      } }\n    ]\n  }\n}\n"
    },
    {
      "id": "broker",
Author	SHA1	Message	Date
jschoubben	c171c64d3a	Genesis lets the control plane state its own facts A mesh raised from nothing must be able to say what it applied and what a machine refused (novox/hq ADR 0134), and the first user list is what permits it. Kept in step with the controller's own composition by the test that reads this file.	2026-09-28 16:07:20 +02:00
mesh-admin	0dc5515099	Merge pull request 'A resource's owner is read to the last dot, because a module's name may contain one' (#42 ) from fix/a-resources-owner-is-read-to-the-last-dot into main	2026-09-28 13:45:01 +00:00