jochen
c3b2fce0a2
ADR 0380's secret-given announcement asks operator-channel.tell over the bus; the genesis bundle's first user list must already carry that publish subject, in the same place the controller composes it (internal/broker, mesh-controller ms-835 435468c1), or a first node's controller starts without the grant until its own first composition.
Examples
foundation-first-node.lock
The one genesis bundle (novox/hq ADR 0331): what a machine must be before a mesh exists — the
bootstrap in novox/hq 07-the-foundation.md, whole, on the bus the
mesh runs on:
0 a container runtime, and a filter before anything listens
1 the store runs
2 a database per context `inventory`, `identity` and `licences`
3 those contexts' schemas mesh-controller migrate
4 the bus's certificate mesh-controller broker certificate
5 the bus runs NATS as mesh-broker-nats, where the nats module keeps it
(ADR 0333), with the controller's account as its first user
6 the control plane runs mesh-controller serve, given the bus (MESH_BUS_NATS)
A machine that applies this is a mesh — one node, with nothing joined to it yet, which is exactly what the first node is (novox/hq ADR 0004). From here it hands out tokens and everything else joins the ordinary way.
It is a template: mesh-bootstrap reads it, makes the store's superuser and the controller's
account on the bus, and writes them where the template says bootstrap (internal/bootstrap,
rootsecrets.go). A template whose bus connection it does not recognise is refused at preflight,
naming the placeholder it looked for. The bundle that raised the previous broker was deleted with
ADR 0331; there is one bundle, and every lab bed names it.
The bus is raised where the nats module keeps it (novox/hq ADR 0333): the container
mesh-broker-nats, its configuration and user list in /var/lib/nats-module/conf, its streams in
/var/lib/mesh-broker-nats, its certificate in /var/lib/mesh-broker-tls, published on the node's bus
port. At the installer's broker step the module adopts it: its own image replaces the upstream one, once,
on the same streams, users and certificate. internal/bootstrap holds the bundle to the module's manifest.
Build an installer carrying a builder, and point it at this:
make bootstrap IMAGE=<builder image>
mesh-bootstrap --bundle examples/foundation-first-node.lock …
The registry address is the lab's. The images are written as 192.0.2.250:5000/…@sha256:…; the
lab rewrites the third-party ones to upstream references by the same digest, and the installer
replaces the control plane's with the image it built.