- lib/pki: root CA provisioning on first run (~/.dcntrlized/pki/), per-service
leaf identity issuance (90d, refreshed at start), revocation with CRL
- main: EnsureCA on startup
- start: inject CA + identity mounts and AUTH_* mTLS env into compose services
- uninstall: revoke the service's cert (CRL entry published)
The shared dcntrlized-db Postgres service is now treated as Maestro
infrastructure: it is hidden from the service grid and auto-started
before any app container when already installed.
- Container model gains role/hidden/capabilities; registry items gain
hidden; installed metadata persists manifest capabilities so stopped
services still surface them.
- Registry marks the shared database image as hidden (OCI annotation,
label, or name fallback).
- Compose label rewrite merges existing service labels instead of
replacing them, so org.dcntrlized.role/hidden survive.
- New infra helpers ensure the external dcntrlized_net network and
start the database on the prod path and before each StartContainer.
- Watcher skips manifest fetch for db-role containers and persists
capabilities from the manifest.
- spec.yaml documents the new fields.
Admin
Dcntrlized Auto CopyLeft Bot