Own the intent.
Containerise the service.

One directory. Replaceable servers.

Cix is the durable source of truth for users, groups, IDs, bcrypt password hashes, SSH keys, group membership, and search capability. Register one or more running glauth containers and Cix renders the complete current directory into each provider’s config. Glauth’s watcher reloads records live; listener configuration is API-owned separately, including plain LDAP and opt-in LDAPS ports.

• Human accounts remain API-managed records even if every LDAP container is rebuilt.
• ldap_provision creates a container-owned service account, generates a fresh secret, delivers it inside the workload, and removes the account with that container.
• ldap_client stages NSS/PAM configuration so workloads can authenticate users live through LDAP; allowed groups can restrict which identities may log in.
• Host login uses the same directory: LDAP bind first when enabled, with local verification only as an availability fallback—not a second password truth. The daemon’s own LDAP bind can also be configured to use TLS.
• Plain LDAP remains the default until an operator enables TLS. Turning LDAPS on changes the listener and client endpoint, and uses the delivered certificate identity; TLS is refused when a registered server has no certificate.
• Listener changes can request a sequenced server restart, one provider at a time, so a plain configuration update does not unexpectedly interrupt directory service.

Trust the chain. Keep the keys on the host.

PKI is a managed platform service: Cix bootstraps a root CA, can add a single intermediate tier, and issues leaf certificates for workloads. The two-tier chain is delivered into a container before its first process starts, so TLS services receive their identity as part of creation rather than through a fragile post-start patch.

• pki_issue creates and delivers a container-owned certificate; a separately named certificate can be delivered when the identity must outlive a container replacement.
• Issued certificates expose metadata and public certificate material through /v1/pki/certs; private keys are not returned by inspection endpoints.
• The complete PKI store can be exported encrypted under an operator passphrase and imported into an install with no CA yet.
• A deliberate reset regenerates the CA chain, reissues tracked leaves, and redelivers replacement certificates to live owners.

/v1/pki/intermediate/v1/pki/export/v1/pki/import/v1/pki/reset

Records in Cix. Answers from dnsmasq.

DNS records and upstream forwarders are API-owned state. Registered dnsmasq containers receive the full current hosts and forwarding configuration through their own filesystem view, then reload on SIGHUP.

• One update synchronises every registered replica.
• dns_register can bind a workload’s lifecycle to its own DNS record.
• dns provision creates replicas, registers them, resolves their real addresses, and configures the host resolver as one re-runnable API workflow.
• Providers serve standard DNS; Cix does not hand-roll a DNS server.

Durable policy. Honest lease ownership.

Cix owns ranges, reservations, server assignment, and the deterministic slicing of a range across redundant dnsmasq containers. Short-lived leases remain owned by the server that issued them and are read live from that provider—never copied into DNS as stale second truth.

• Static reservation changes synchronise live.
• One DHCP service can serve several networks, with each option tagged to its network.
• Range changes restart only affected providers through the rolling restart mechanism.
• The same container may provide DNS and DHCP, making its own leases immediately resolvable; Cix reports that pairing without entangling the two APIs.
• Replicas receive disjoint address slices because dnsmasq has no shared failover database.

Durable locally. Forwarded optionally.

Cix’s consolidated host log store remains the source read by the API and dashboard. Register a syslog container and every subsequent container-sourced log line is additionally emitted as a real RFC 3164 UDP datagram.

• The durable Cix copy is retained even if forwarding fails.
• Kernel, cixd, and audit records stay local; only container log lines enter this forwarding path.
• The message carries the originating container name.
• A syslog target never receives its own captured output, preventing a feedback loop.

Containerised sources. Host-owned clock.

Running chrony containers can register as internal time sources. Cix resolves their live addresses afresh and queries them before configured upstream servers. The final host clock change remains in cixd, because clock_settime() requires host-namespace authority that should not be handed into a container.

• Registered providers are ordinary NTP servers for other workloads.
• Host synchronisation is automatic hourly or operator-triggered.
• NTP registration is pure bookkeeping: the live protocol is already the source of its answer.