jochen
4dde21f0ab
The bundle raised the store as mesh-store, on upstream postgres, in a docker volume; the postgres module keeps it as postgres, on its pgvector image, in /var/lib/mesh-store owned 999:70, reading its superuser password from a file. The store step refused, and genesis stopped at step 17 of 24. The bundle now raises the store with the module's name, image, data directory and password file, and every step of the bundle and the installer reaches it by that name. The refusal to raise a store over data it cannot open looks for a cluster in the store's directory, no longer for the old volume.
Examples
foundation-first-node.lock
The one genesis bundle (novox/hq ADR 0331): what a machine must be before a mesh exists — the
bootstrap in novox/hq 07-the-foundation.md, whole, on the bus the
mesh runs on:
0 a container runtime, and a filter before anything listens
1 the store runs
2 a database per context `inventory`, `identity` and `licences`
3 those contexts' schemas mesh-controller migrate
4 the bus's certificate mesh-controller broker certificate
5 the bus runs NATS as mesh-broker-nats, where the nats module keeps it
(ADR 0333), with the controller's account as its first user
6 the control plane runs mesh-controller serve, given the bus (MESH_BUS_NATS)
A machine that applies this is a mesh — one node, with nothing joined to it yet, which is exactly what the first node is (novox/hq ADR 0004). From here it hands out tokens and everything else joins the ordinary way.
It is a template: mesh-bootstrap reads it, makes the store's superuser and the controller's
account on the bus, and writes them where the template says bootstrap (internal/bootstrap,
rootsecrets.go). A template whose bus connection it does not recognise is refused at preflight,
naming the placeholder it looked for. The bundle that raised the previous broker was deleted with
ADR 0331; there is one bundle, and every lab bed names it.
The bus is raised where the nats module keeps it (novox/hq ADR 0333): the container
mesh-broker-nats, its configuration and user list in /var/lib/nats-module/conf, its streams in
/var/lib/mesh-broker-nats, its certificate in /var/lib/mesh-broker-tls, published on the node's bus
port. At the installer's broker step the module adopts it: its own image replaces the upstream one, once,
on the same streams, users and certificate. internal/bootstrap holds the bundle to the module's manifest.
Build an installer carrying a builder, and point it at this:
make bootstrap IMAGE=<builder image>
mesh-bootstrap --bundle examples/foundation-first-node.lock …
The registry address is the lab's. The images are written as 192.0.2.250:5000/…@sha256:…; the
lab rewrites the third-party ones to upstream references by the same digest, and the installer
replaces the control plane's with the image it built.