Added some bug tasks which came out of real world testing

go/daemon/network/network.go

@@ -495,8 +495,9 @@ func (n *network) initialize(
 	}
 
 	// Do this now so that everything is stable before returning. This also
-	// serves a dual-purpose, as it makes sure that the PUT from the postChildrenInit
-	// above has propagated from the local garage instance, if there is one.
+	// serves a dual-purpose, as it makes sure that the PUT from the
+	// postChildrenInit above has propagated from the local garage instance, if
+	// there is one.
 	n.logger.Info(ctx, "Reloading hosts from network storage")
 	if err = n.reloadHosts(ctx); err != nil {
 		return fmt.Errorf("Reloading network bootstrap: %w", err)

tasks/bugs/garage-apply-layout-before-stopping-instance.md

@@ -0,0 +1,14 @@
+---
+type: host
+---
+
+When removing a storage allocation the new layout should be applied _before_ the
+impacted garage instance is shut down. Isle should ideally also wait for the
+impacted instance to no longer be in the "draining" state prior to shutting it
+down, if possible.
+
+Some care needs to be taken in the case of the `daemon.yml` file being used for
+configuration. The daemon should probably initially load using the old
+configuration, and only then apply the new configuration as if it were applied
+using `SetConfig`. This way the garage instance being removed can be brought
+back up, drained, then shut down again.

tasks/bugs/garage-credential-propagation-fix.md

@@ -0,0 +1,13 @@
+---
+type: task
+---
+
+It seems in real world testing that this error came up after `isle storage
+allocation add` had already completed:
+
+```
+ERROR [daemon/networks/micropelago.net] Background job failed errMsg="getting hosts from garage: listing objects: Forbidden: No such key: XXXXXXXXXXXXXXXXXXXXXXXXXX" workerLabel=reloadHosts
+```
+
+Isle should wait until bucket credentials are propagated to the new garage
+instance before considering it to be online.

tasks/bugs/include-garage-firewall-entries.md

@@ -0,0 +1,9 @@
+---
+type: task
+---
+
+When listing firewall entries using `isle vpn firewall list`, any firewall
+entries which are automatically included for garage (and all other services in
+the future) should be included in the returned list as well. These should be
+annotated in such a way that the user understands they are automatically
+generated and can't be changed.

tasks/bugs/set-config-dont-commit-new-config-on-err.md

@@ -1,5 +1,7 @@
 ---
 type: task
+after:
+  - ./garage-apply-layout-before-stopping-instance.md
 ---
 
 When SetConfig is called, but ends up erroring, the new config should not end up