---
title: "1.16.2 — Exact brownfield ingress and role-aware nodes"
description: "django-mojo lets brownfield AWS fleets bind NLBs to an exact pre-existing security group, explicitly control target-group client-address preservation, and declare which nodes run framework ASGI. Provisioning proves the ingress boundary and non-request nodes revoke request service before they can be…"
date: "2026-08-22"
tags: ["release"]
canonical: "https://django-mojo.sitesmojo.com/changelog/1-16-2/"
---

django-mojo lets brownfield AWS fleets bind NLBs to an exact pre-existing security group, explicitly control target-group client-address preservation, and declare which nodes run framework ASGI. Provisioning proves the ingress boundary and non-request nodes revoke request service before they can be reported ready, while existing managed and omitted configurations retain their prior behavior.

### Added

- Brownfield NLBs can bind one exact pre-existing security group at creation and independently declare client-IP preservation for API and Certbot target groups.
- Brownfield nodes can declare whether the framework ASGI request service should run, independently of load-balancer target registration.

### Changed

- Non-request nodes stop and disable framework ASGI, skip its readiness probe, and leave application-specific worker, scheduler, MCP, and Sites services to project hooks.
- Brownfield planning and canary evidence now bind each node’s request-service selection.

### Security

- NLB provisioning proves the declared NLB-to-node security-group boundary, rejects world-open target access, and blocks immutable security-group drift before mutation.
- Malformed sealed request-service authority fails closed by revoking framework ASGI instead of granting request-serving authority.

### Upgrade notes

- Existing managed deployments and brownfield manifests that omit the new fields require no changes; their previous topology and ASGI behavior are preserved.
- An NLB security group must be bound when the NLB is created. Declaring a missing or different group for an existing NLB stops before mutation because its first security group cannot be added later.
- `request_service: false` controls only framework ASGI and is separate from load-balancer target registration. Project hooks must start and prove the node’s intended role-specific service.