iris
d516bb890c
remove the forge links from the hive dashboard and the agent page
...
Each agent row on the hive dashboard, and the agent page's link menu, linked
to the agent's forge profile and its config repo. Both are gone, with what
only they used:
- hive-agent no longer builds the two links, the `Forge` link kind, or the
`forge_public_url` field of its state, and no longer reads
`HIVE_FORGE_PUBLIC_URL`. The agent page's link menu and the dashboard row's
icon strip (which skips a forge link an agent not yet rebuilt still sends)
drop their forge handling.
- hive-c0re's dashboard state no longer carries `forge_public_url`.
- `HIVE_FORGE_PUBLIC_URL` is no longer forwarded to agents through the meta
flake (the forwarded-variable list, its test fixture, the controller's
settings and the VM test), so the next meta flake render differs by that
one line. hive-c0re still reads it for the forge URL a hive publishes, so
`swarm.forge.publicUrl` stays, with its description corrected.
- The docs stop describing the links.
2026-11-07 13:43:44 +01:00
atlas
af434e1374
nightly vm test: full single-host swarm setup up to the meta flake
2026-11-06 21:08:41 +01:00
atlas
af739dc8ea
refuse a namespaced agent whose /nix/store cannot be idmapped
...
Refs #5888
2026-11-06 12:37:03 +01:00
atlas
d5eb7711e6
move nixBuilds into its own agent module, and have the vm test's agent import it
2026-11-06 09:18:42 +01:00
atlas
5485151ba6
add a per-agent nix builds mode, host or none, carried like privateUsers
2026-11-06 09:18:42 +01:00
atlas
6847ed865a
bind a namespaced agent's socket dir off /run so its owner maps to the agent user
2026-11-06 09:18:16 +01:00
atlas
dd5fde848f
squid blocks a runtime deny list from the controller in every egress mode, ahead of the allow list
2026-11-04 22:16:35 +01:00
atlas
65d75da8db
vm tests: idmap-capable store for the userns subtest, restart nix-daemon via its socket
2026-11-02 18:20:47 +01:00
atlas
da0cdda6a4
vm-nightly: drop placeholder-free f prefixes, enable nix-command on the offline test's path-info
2026-11-02 07:57:07 +01:00
atlas
4d85ec4c21
nightly vm test: the builder's meta build finds a prebuilt agent in an offline store
2026-11-01 21:25:32 +01:00
atlas
f5a609911c
read privateUsers from the closure record at start, and move the data owner option under hive-controller
2026-11-01 17:06:18 +01:00
atlas
bfdf603d12
run opted-in agents in a user namespace with a dedicated data owner
2026-11-01 17:06:18 +01:00
atlas
fd2861c097
reset the failed container unit before stopping it in the link-refusal vm subtest
2026-10-30 08:52:50 +01:00
atlas
e46ad07226
add a per-agent egress log mode
2026-10-30 08:52:22 +01:00
atlas
da16487800
move the squid host options to deploy.hive-controller.squid
2026-10-29 09:53:20 +01:00
atlas
c9b5705ad8
share one hive-priv request helper across the vm tests
2026-10-29 08:51:31 +01:00
atlas
51b0a02e95
wait for the wg-hive peers before pinging in the vm test
2026-10-29 08:27:38 +01:00
atlas
ce14c9b001
wait for hive-priv's reply to a daemon-reload in the link-refusal subtest
2026-10-29 08:27:29 +01:00
atlas
7e2f4ce7c8
always include a hive's own allowedDomains in the rendered swarm-wide list
2026-10-29 08:25:22 +01:00
atlas
74f463c40e
move the c0re host options to deploy.hive-controller
2026-10-29 01:08:41 +01:00
atlas
24afc89ab3
run the root check warn-only on hyperhive's own containers, per unit, not on the container@ template
2026-10-28 23:50:58 +01:00
atlas
c191975aab
check every container's root before its start, through the container@ template
2026-10-28 23:50:58 +01:00
atlas
1c3118e9cd
add two-vm wg-hive mesh test to vmTests
2026-10-28 23:44:58 +01:00
atlas
c9abc2a42b
make squid's allowed domains editable at runtime in the swarm ui
2026-10-28 23:01:43 +01:00
atlas
86e80250bb
remove the partial salvage dir when a salvage fails
...
- a failure between creating the dir and the rename removes that dir only
- give the ephemeral-rootfs vm test a 4 GiB disk so the space check passes
2026-10-28 23:01:04 +01:00
atlas
bbc2a83771
print the vm test's priv response and journal only on failure
2026-10-28 22:04:09 +01:00
atlas
2b4fd52b0a
make the vm test's priv request wait for the salvage reply
2026-10-28 22:04:09 +01:00
atlas
b4ce4e0d90
put hello and tree in the agent-ephemeral-rootfs vm closure
2026-10-28 22:04:09 +01:00
atlas
6708ef804f
root the build the pre-start check names
2026-10-28 21:59:43 +01:00
atlas
a44a7256a7
check the container root before each start
2026-10-28 21:59:43 +01:00
atlas
81439fa710
run agent containers on an ephemeral root, salvaging the old one first
...
hive-priv copies a stopped container's root to the agent's work dir and
renames it aside before passing nspawn --ephemeral; the agent's nix state
moves to the persistent profiles bind. Adds the agent-ephemeral-rootfs vm
test and a module-eval case for the nix state redirect.
2026-10-28 20:00:12 +01:00
atlas
e78a529ec2
squid: base allow list for every authed user, and no start limit on the list reload
2026-10-28 19:44:26 +01:00
atlas
10fdf06334
squid self-check: use a public canary, drop the swarm service names from the allow list
2026-10-28 19:44:26 +01:00
atlas
4eb27543e5
move vm tests out of checks into a nightly vmTests workflow
2026-10-28 18:41:42 +01:00
atlas
b551eb02ff
send agent traffic through squid once its hive announces it
2026-10-28 17:24:34 +01:00
atlas
86e9f49fe6
resolve the self-check's deny canary in the squid VM test
2026-10-28 17:23:33 +01:00
atlas
e8868d52a8
deny the IPv6 unspecified address at squid
2026-10-28 17:23:33 +01:00
atlas
3d9561a9a6
deny private and reserved destinations for every squid user
2026-10-28 17:23:33 +01:00
atlas
501445ebc3
apply each agent's internet flag to its squid credential
2026-10-28 17:23:33 +01:00
atlas
b7adb90f53
require a proxy credential at squid and prove it in the self-check
2026-10-28 13:50:35 +01:00
atlas
5513a6e875
rename the access-log variable in the squid vm test so it stops shadowing the driver's logger
2026-10-27 20:59:06 +01:00
atlas
a2cf6fe8bb
deploy squid on every hive host, with exporter, journal forwarding and self-check
2026-10-27 20:59:06 +01:00
