1.16.2 — Exact brownfield ingress and role-aware nodes

2026-08-22

django-mojo lets brownfield AWS fleets bind NLBs to an exact pre-existing security group, explicitly control target-group client-address preservation, and declare which nodes run framework ASGI. Provisioning proves the ingress boundary and non-request nodes revoke request service before they can be reported ready, while existing managed and omitted configurations retain their prior behavior.

Added

• Brownfield NLBs can bind one exact pre-existing security group at creation and independently declare client-IP preservation for API and Certbot target groups.
• Brownfield nodes can declare whether the framework ASGI request service should run, independently of load-balancer target registration.

Changed

• Non-request nodes stop and disable framework ASGI, skip its readiness probe, and leave application-specific worker, scheduler, MCP, and Sites services to project hooks.
• Brownfield planning and canary evidence now bind each node’s request-service selection.

Security

• NLB provisioning proves the declared NLB-to-node security-group boundary, rejects world-open target access, and blocks immutable security-group drift before mutation.
• Malformed sealed request-service authority fails closed by revoking framework ASGI instead of granting request-serving authority.

Upgrade notes

• Existing managed deployments and brownfield manifests that omit the new fields require no changes; their previous topology and ASGI behavior are preserved.
• An NLB security group must be bound when the NLB is created. Declaring a missing or different group for an existing NLB stops before mutation because its first security group cannot be added later.
• request_service: false controls only framework ASGI and is separate from load-balancer target registration. Project hooks must start and prove the node’s intended role-specific service.