jochen 41e640d668 Have genesis trust its registry before pushing to it (issue 92) ...

Genesis pushed the control plane's image to the mesh's plain-HTTP registry
before anything told the container runtime to trust it; the docker module
that writes that trust is applied long after. Genesis now writes the trust
itself at the registry step, with the same into-json writer and a reload,
for the address given and the node's mesh name on the node's registry
port, and refuses before any push unless the runtime says it trusts each.
The docker module later finds the mesh name there and takes it over
without a change.

2026-10-12 16:13:11 +02:00

..

testdata

Delete a forwarded opening the way ufw accepts it, and read a fresh machine's resolver as not in use — both measured on a lab machine (hq ADR 0100)

2026-09-22 17:37:01 +02:00

adopt_in_place_test.go

inspect by kind, not the ambiguous bare form — a same-named network stops a container from ever being found

2026-09-24 19:50:16 +02:00

adopted_test.go

Reload the guard for a changed table and restart it only for a changed unit, as the controller declares it (hq ADR 0103)

2026-09-22 18:33:57 +02:00

adopted.go

Reload the guard for a changed table and restart it only for a changed unit, as the controller declares it (hq ADR 0103)

2026-09-22 18:33:57 +02:00

apply_test.go

Refuse every file once the mesh has spoken, plan the cutover as one, and let the kept declaration repair the mode

2026-09-23 23:35:49 +02:00

apply.go

An apply leaves a container a maintenance window holds still (hq issue 224)

2026-10-05 18:27:04 +02:00

bootstrap.go

Have genesis trust its registry before pushing to it (issue 92)

2026-10-12 16:13:11 +02:00

build_test.go

Raise a process-form controller at genesis as the container it replaces (hq issue 223)

2026-10-04 01:47:33 +02:00

build.go

Raise a process-form controller at genesis as the container it replaces (hq issue 223)

2026-10-04 01:47:33 +02:00

builder_test.go

A re-run does not replace the registered forge with whatever checkout it was given

2026-09-22 21:56:42 +02:00

builder.go

The packages port given at genesis is a module's setting, like every other

2026-09-22 21:40:02 +02:00

choices_test.go

The installer goes as far as it can, and asks where a human must choose

2026-09-15 21:56:23 +02:00

choices.go

The installer goes as far as it can, and asks where a human must choose

2026-09-15 21:56:23 +02:00

control_test.go

Format control_test.go so the gate's fmt step passes on main

2026-09-26 23:51:36 +02:00

control.go

The pinning line shows the built image's id, not one digit of it

2026-09-21 15:27:13 +02:00

enrol_test.go

The installer lets the first node onto the bus it raised

2026-10-08 01:33:30 +02:00

enrol.go

Say controller in the installer's and the token's words, as the glossary does

2026-10-08 01:46:21 +02:00

genesis_forge_test.go

A taken container keeps a found network, a left-out module is kept, and genesis raises the forge as its module declares (hq ADR 0163)

2026-10-01 23:45:05 +02:00

genesis_form_test.go

Raise a process-form controller at genesis as the container it replaces (hq issue 223)

2026-10-04 01:47:33 +02:00

genesis_form.go

Raise a process-form controller at genesis as the container it replaces (hq issue 223)

2026-10-04 01:47:33 +02:00

genesis_handover_test.go

Raise a process-form controller at genesis as the container it replaces (hq issue 223)

2026-10-04 01:47:33 +02:00

inuse_test.go

A taken container keeps a found network, a left-out module is kept, and genesis raises the forge as its module declares (hq ADR 0163)

2026-10-01 23:45:05 +02:00

inuse.go

Exempt only the daemons a fresh machine was measured to run from counting as in use (hq ADR 0101)

2026-09-22 19:57:52 +02:00

load_test.go

Rename mesh-control -> mesh-controller, substrate -> foundation

2026-09-16 18:40:40 +02:00

load.go

Rename mesh-control -> mesh-controller, substrate -> foundation

2026-09-16 18:40:40 +02:00

module.go

Raise a machine in use adopted: keep its firewall, load no dropping table, guard the mesh's own ports, and take only the mesh's own modules (hq ADR 0100)

2026-09-22 17:32:44 +02:00

network_module_test.go

Genesis assigns mesh-wireguard, not the retired networking bundle (hq ADR 0226)

2026-10-06 14:59:26 +02:00

operator.go

Installer review: secrets are staged privately, and a bundle is 0600 whether or not it existed

2026-09-21 01:26:35 +02:00

phase2_test.go

Refuse an endpoint whose port is not the one the private network's hub binds (hq ADR 0100)

2026-09-22 19:58:37 +02:00

phase2.go

Genesis assigns mesh-wireguard, not the retired networking bundle (hq ADR 0226)

2026-10-06 14:59:26 +02:00

phase3.go

Take the foundation's ports as genesis inputs, check them free, and hand them to the controller as the node's settings (hq ADR 0100)

2026-09-22 17:28:36 +02:00

phase_packages_gitea.go

Genesis raises gitea correctly: host network, honest SQL, matched ROOT_URL

2026-09-16 14:11:36 +02:00

phase_packages.go

A taken container keeps a found network, a left-out module is kept, and genesis raises the forge as its module declares (hq ADR 0163)

2026-10-01 23:45:05 +02:00

ports_test.go

inspect by kind, not the ambiguous bare form — a same-named network stops a container from ever being found

2026-09-24 19:50:16 +02:00

ports.go

inspect by kind, not the ambiguous bare form — a same-named network stops a container from ever being found

2026-09-24 19:50:16 +02:00

preflight_test.go

Rename mesh-control -> mesh-controller, substrate -> foundation

2026-09-16 18:40:40 +02:00

preflight.go

Refuse a converged genesis on a machine in use, naming every container and listener counted (hq ADR 0100)

2026-09-22 17:29:32 +02:00

publish_test.go

Cite the hq issues by the numbers they were given: 285, 286, 287

2026-10-07 02:00:13 +02:00

publish.go

inspect by kind, not the ambiguous bare form — a same-named network stops a container from ever being found

2026-09-24 19:50:16 +02:00

registry_test.go

inspect by kind, not the ambiguous bare form — a same-named network stops a container from ever being found

2026-09-24 19:50:16 +02:00

registry.go

Rename mesh-control -> mesh-controller, substrate -> foundation

2026-09-16 18:40:40 +02:00

retire_test.go

Rename mesh-control -> mesh-controller, substrate -> foundation

2026-09-16 18:40:40 +02:00

retire.go

Refuse a declaration for the other mode, or older than the mesh's last, and say what an apply would change first

2026-09-23 23:15:28 +02:00

rewrite_test.go

Rename mesh-control -> mesh-controller, substrate -> foundation

2026-09-16 18:40:40 +02:00

rewrite.go

Installer review: secrets are staged privately, and a bundle is 0600 whether or not it existed

2026-09-21 01:26:35 +02:00

rootsecrets_test.go

The base filter opens the bus and the registry in the input chain too

2026-09-21 12:28:57 +02:00

rootsecrets.go

Look at what a container mounts directly, accept a pre-upgrade label, and write the genesis secret without a newline

2026-09-23 23:40:27 +02:00

talk.go

Installer review: secrets are staged privately, and a bundle is 0600 whether or not it existed

2026-09-21 01:26:35 +02:00

trust_test.go

Have genesis trust its registry before pushing to it (issue 92)

2026-10-12 16:13:11 +02:00

trust.go

Have genesis trust its registry before pushing to it (issue 92)

2026-10-12 16:13:11 +02:00

verify_test.go

inspect by kind, not the ambiguous bare form — a same-named network stops a container from ever being found

2026-09-24 19:50:16 +02:00

verify.go

inspect by kind, not the ambiguous bare form — a same-named network stops a container from ever being found

2026-09-24 19:50:16 +02:00