The hand-authored proxy serves flip.novox.be beside filip.novox.be and
filip-api.novox.be beside photos-api.novox.be; the module must contribute
all six names before those files can retire.
MINIO_BUCKET names what the s3-bucket grant actually scopes the key to:
the provisioner derives mesh-novox-photos from the grant account and
ignores the contributed bucket name — the objects move there in the
cutover window, the pattern nextcloud set.
The mesh builds all three images from this repository and a commit
(novox/hq ADR 0069) — the Drone pipeline that built outside Docker and
copied its output in retires with the predecessor. One module carries the
API and every client instance: eef and filip are the same built client
under two names, which is a second route contribution, not a second
module (ADR 0015 — an application is one repository).
The clients drop nginx and its bash startup script: the node the API
already needs serves the static build too (client-server/serve.mjs —
files, the SPA fallback, env-config.js from the environment), so the
whole module stands on one declared base.
What the machine serves does not move: the same four public names, the
same four machine ports. MongoDB, the bucket and every credential arrive
as mesh grants instead of hand-set environment; SUPER_ADMIN_KEY stops
being a default written in code and becomes a minted secret.
jschoubben