vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

add a per-agent egress log mode

Browse source
This commit is contained in:
atlas 2026-10-30 02:18:39 +01:00 • committed by mara
commit e46ad07226
1 changed files with 637 additions and 31 deletions
Download patch file Download diff file Expand all files Collapse all files

15
docs/swarm/ui.md
View file

@ -583,11 +583,16 @@ refuses, for example, a percentage with a leading zero. The dialog shows the
refusal's reason under the fields and leaves them as you typed them.
Below the list, **internet** shows whether the agent's traffic may leave the
host unfiltered: `unrestricted`, `restricted`, or `unrestricted (legacy)` when
the swarm never set the flag, which counts as on. The **restrict** or
**allow unrestricted** badge flips it with a `PUT` that carries the stored
permission list along with the flag, because a `PUT` without the list resets a
stored list to the default. An agent with no stored list sends the flag alone.
host unfiltered: `unrestricted`, `restricted`, `log`, or `unrestricted (legacy)`
when the swarm never set the flag, which counts as on. `log` is `restricted`
that allows what the list would refuse and logs each such request as
`would_deny`; it stays until you change it. The badges for the other two
modes (**allow unrestricted**, **log**, **restrict**) set the mode with a
`PUT` that carries the stored permission list along with the flags, because a
`PUT` without the list resets a stored list to the default. An agent with no
stored list sends the flags alone. `log` sends `unrestricted_internet: false`
with `internet_log: true`; the other two leave `internet_log` out, which ends
logging.
The hive's egress proxy applies the flag to each agent's proxy credential (see
[the egress proxy](../networking/network.md#egress-proxy-squid)). An agent sends its
credential from its next start after it has fetched it, so a flag change applies