0010. xvii-node also manages the platform services

Status: accepted, 2026-10-09

Context

Self-hosters need install, update and rollback with a UI. Updating binaries, systemd units and Caddy config needs root, which a service process must not have.

Decision

xvii-node runs on the control-plane server too. It owns the platform's lifecycle there: installs and updates service binaries (checksum and signature verified), writes systemd units, renders Caddy config through Caddy's admin API, runs migrations by starting the new version, health-checks and rolls back. home is the UI for it; xvii server … is the CLI.

Consequences

One root agent, one protocol, used for platform services and user workloads.
The control-plane xvii-node connects to apps like any node, but platform work works even when apps is down (it reads a local desired-state file that home writes through it).