Since 2026-10-04 the mesh held photos from the catalogue's stub — a server and an admin client —
which dropped the eef and filip sites and the api, flip and filip-api routes. This definition could
not simply be rebuilt: it named photos-api.novox.be and its own host paths, and transcribed the
bucket. Endpoints are named and every route names one; the client is told the api's composed name;
paths are the mesh's ${dir:state}; the bucket is the one the store derives (hq ADR 0202), the same
mesh-novox-photos the data lives in.
The provisioner creates the granted user inside the granted database —
mongo's own db-scoped convention — so authSource is the database's name.
Found by testing the credential before the cutover window, not during it.
The hand-authored proxy serves flip.novox.be beside filip.novox.be and
filip-api.novox.be beside photos-api.novox.be; the module must contribute
all six names before those files can retire.
MINIO_BUCKET names what the s3-bucket grant actually scopes the key to:
the provisioner derives mesh-novox-photos from the grant account and
ignores the contributed bucket name — the objects move there in the
cutover window, the pattern nextcloud set.
The mesh builds all three images from this repository and a commit
(novox/hq ADR 0069) — the Drone pipeline that built outside Docker and
copied its output in retires with the predecessor. One module carries the
API and every client instance: eef and filip are the same built client
under two names, which is a second route contribution, not a second
module (ADR 0015 — an application is one repository).
The clients drop nginx and its bash startup script: the node the API
already needs serves the static build too (client-server/serve.mjs —
files, the SPA fallback, env-config.js from the environment), so the
whole module stands on one declared base.
What the machine serves does not move: the same four public names, the
same four machine ports. MongoDB, the bucket and every credential arrive
as mesh grants instead of hand-set environment; SUPER_ADMIN_KEY stops
being a default written in code and becomes a minted secret.
jochen
jschoubben