# Examples ## `foundation-first-node.lock` The one genesis bundle (novox/hq ADR 0331): what a machine must be before a mesh exists — the bootstrap in [novox/hq `07-the-foundation.md`](https://git.novox.be/novox/hq), whole, on the bus the mesh runs on: ``` 0 a container runtime, and a filter before anything listens 1 the store runs 2 a database per context `inventory`, `identity` and `licences` 3 those contexts' schemas mesh-controller migrate 4 the bus's certificate mesh-controller broker certificate 5 the bus runs NATS as mesh-broker-nats, where the nats module keeps it (ADR 0333), with the controller's account as its first user 6 the control plane runs mesh-controller serve, given the bus (MESH_BUS_NATS) ``` **A machine that applies this is a mesh** — one node, with nothing joined to it yet, which is exactly what the first node is (novox/hq ADR 0004). From here it hands out tokens and everything else joins the ordinary way. It is a **template**: `mesh-bootstrap` reads it, makes the store's superuser and the controller's account on the bus, and writes them where the template says `bootstrap` (internal/bootstrap, rootsecrets.go). A template whose bus connection it does not recognise is refused at preflight, naming the placeholder it looked for. The bundle that raised the previous broker was deleted with ADR 0331; there is one bundle, and every lab bed names it. **The bus is raised where the `nats` module keeps it** (novox/hq ADR 0333): the container `mesh-broker-nats`, its configuration and user list in `/var/lib/nats-module/conf`, its streams in `/var/lib/mesh-broker-nats`, its certificate in `/var/lib/mesh-broker-tls`, published on the node's bus port. At the installer's broker step the module adopts it: its own image replaces the upstream one, once, on the same streams, users and certificate. `internal/bootstrap` holds the bundle to the module's manifest. Build an installer carrying a builder, and point it at this: ``` make bootstrap IMAGE= mesh-bootstrap --bundle examples/foundation-first-node.lock … ``` **The registry address is the lab's.** The images are written as `192.0.2.250:5000/…@sha256:…`; the lab rewrites the third-party ones to upstream references by the same digest, and the installer replaces the control plane's with the image it built.