atlas
bd79b58e78
log the agent bridge's forwarded flows in the hive_egress table
...
A forward chain in the hive-owned nft table logs each new flow from the agent bridge to the uplink (v4 and v6) and counts every packet. It never blocks. The mesh interface is skipped. Logging is rate limited per source address; a flow that limit cannot log gets one line from a shared limit with its own prefix. services.hyperhive.network.egress.forward selects accept, log (default) or drop; drop is refused at evaluation until the interception it needs exists.
2026-11-12 09:20:51 +01:00
atlas
eb39a90057
load the agent-bridge to loopback drop in its own nft table
2026-11-11 16:54:07 +01:00
atlas
ea1564fba7
hive-squid test: wait for the agent, retry no-answer connects, print evidence on failure
2026-11-11 10:08:19 +01:00
atlas
dd5fde848f
squid blocks a runtime deny list from the controller in every egress mode, ahead of the allow list
2026-11-04 22:16:35 +01:00
atlas
e46ad07226
add a per-agent egress log mode
2026-10-30 08:52:22 +01:00
atlas
da16487800
move the squid host options to deploy.hive-controller.squid
2026-10-29 09:53:20 +01:00
atlas
7e2f4ce7c8
always include a hive's own allowedDomains in the rendered swarm-wide list
2026-10-29 08:25:22 +01:00
atlas
c9abc2a42b
make squid's allowed domains editable at runtime in the swarm ui
2026-10-28 23:01:43 +01:00
atlas
e78a529ec2
squid: base allow list for every authed user, and no start limit on the list reload
2026-10-28 19:44:26 +01:00
atlas
10fdf06334
squid self-check: use a public canary, drop the swarm service names from the allow list
2026-10-28 19:44:26 +01:00
atlas
4eb27543e5
move vm tests out of checks into a nightly vmTests workflow
2026-10-28 18:41:42 +01:00
atlas
b551eb02ff
send agent traffic through squid once its hive announces it
2026-10-28 17:24:34 +01:00
atlas
86e9f49fe6
resolve the self-check's deny canary in the squid VM test
2026-10-28 17:23:33 +01:00
atlas
e8868d52a8
deny the IPv6 unspecified address at squid
2026-10-28 17:23:33 +01:00
atlas
3d9561a9a6
deny private and reserved destinations for every squid user
2026-10-28 17:23:33 +01:00
atlas
501445ebc3
apply each agent's internet flag to its squid credential
2026-10-28 17:23:33 +01:00
atlas
b7adb90f53
require a proxy credential at squid and prove it in the self-check
2026-10-28 13:50:35 +01:00
atlas
5513a6e875
rename the access-log variable in the squid vm test so it stops shadowing the driver's logger
2026-10-27 20:59:06 +01:00
atlas
a2cf6fe8bb
deploy squid on every hive host, with exporter, journal forwarding and self-check
2026-10-27 20:59:06 +01:00
