atlas
10fdf06334
squid self-check: use a public canary, drop the swarm service names from the allow list
2026-10-28 19:44:26 +01:00
iris
ae2ecab9f2
swarm-grafana: the bao dashboard reads openbao's journal
...
The bao board was nine metrics panels, so a gap in log delivery looked like
a quiet bao. Three panels read the log store for openbao.service: lines
delivered over time, WARN and ERROR lines over time, and the recent WARN and
ERROR lines themselves. A module-eval case pins them by query.
2026-10-28 19:28:12 +01:00
iris
4d5a65a185
swarm-ui: a request that finds the login ended reloads the page to the login
...
The gateway answered every non-page request without a session with a login
redirect, which fetch and EventSource cannot follow across origins, so polls,
forms and streams failed with errors that said nothing about the session. It
now answers anything that does not ask for text/html with a 401 and a
WWW-Authenticate header, and the swarm UI reloads on that 401, from a wrapped
fetch (one place for every call) and from a probe after a stream dies. A second
reload within ten seconds is skipped so a page that keeps answering 401 cannot
loop. The proxy test and the docs follow.
2026-10-28 19:19:26 +01:00
atlas
d29f63d4cf
keep the backend file order case independent of the proxy file
2026-10-28 17:24:34 +01:00
atlas
b551eb02ff
send agent traffic through squid once its hive announces it
2026-10-28 17:24:34 +01:00
atlas
e8868d52a8
deny the IPv6 unspecified address at squid
2026-10-28 17:23:33 +01:00
atlas
3d9561a9a6
deny private and reserved destinations for every squid user
2026-10-28 17:23:33 +01:00
atlas
501445ebc3
apply each agent's internet flag to its squid credential
2026-10-28 17:23:33 +01:00
atlas
fd63b402e1
fetch the self-check's password as a systemd credential
2026-10-28 13:50:35 +01:00
atlas
b7adb90f53
require a proxy credential at squid and prove it in the self-check
2026-10-28 13:50:35 +01:00
atlas
52d532ff5a
render squid's users file from this hive's proxy credentials
2026-10-28 13:50:35 +01:00
atlas
ec06a91deb
mint per-agent proxy credentials and a per-hive squid self-check credential
2026-10-28 13:50:35 +01:00
atlas
b845630023
keep the cache's key and pull token for hive-priv in a root-only directory
2026-10-28 10:23:01 +01:00
atlas
57b04d6c49
let the operator set, replace and remove an agent's backend env from the swarm ui
2026-10-28 08:49:32 +01:00
atlas
28be594f79
ship the cache host init units' journal through the hive collector
2026-10-28 08:49:14 +01:00
atlas
75e9e205e3
fetch the agent's backend env file from the store, seeded from the existing file
...
the agent's own root unit reads swarm/agents/<agent>/backend-env into /run and
creates it from backendEnvironmentFile with -cas=0 when the store holds nothing.
the shared agent policy gains create (not update) on that one leaf. the harness
and the subagent daemon load the old file first and the fetched one after it.
2026-10-28 01:24:29 +01:00
atlas
1e5070796d
copy the cache's pull facts to each hive and create them in the in-swarm cache
...
the in-swarm cache stores its address, name and public key beside its tokens, create-only. swarm-controller copies the four cache facts to swarm/hives/<hive>/attic/* every five minutes, with read on the sources and write on the copies. part 1 of 3: nothing reads the copies until the hive reader and probe land.
2026-10-28 01:19:56 +01:00
atlas
c79c41e004
warn when a hive host without a leaf names the otel oidc secret file
2026-10-28 00:46:19 +01:00
atlas
606817a994
default swarm.attic domain and cache to the swarm's own cache on every host
2026-10-27 22:16:26 +01:00
atlas
078aed1335
refuse unlisted squid names before any destination lookup
2026-10-27 20:59:06 +01:00
atlas
a2cf6fe8bb
deploy squid on every hive host, with exporter, journal forwarding and self-check
2026-10-27 20:59:06 +01:00
atlas
d5c5862654
keep the matrix appservice registration in bao, with the host file as the last copy
2026-10-27 17:33:06 +01:00
atlas
a572fb6a7f
forward the attic container's journal to the swarm collector
2026-10-27 16:03:23 +01:00
atlas
99fab06348
keep authelia's keys in bao, seeded from the existing key files
2026-10-27 16:01:57 +01:00
atlas
e77459d2cb
count the cache's container in the service-container cases
2026-10-27 14:28:51 +01:00
atlas
458a046b8d
run attic as a swarm service with deploy.attic.enable
2026-10-27 13:04:17 +01:00
atlas
f59ed01353
fix the builder cache module-eval case and document the external cache
2026-10-27 13:02:43 +01:00
atlas
bd214b9f3e
require both attic options, follow attic's cache-name rule, read the token from a file
2026-10-27 13:02:43 +01:00
atlas
0849afec80
push green meta builds to the attic cache and record cached
2026-10-27 13:02:43 +01:00
atlas
c4e8d5b540
match the guest's legacy key path in the grafana tmpfiles check, not the /run secrets dir
2026-10-27 13:00:13 +01:00
atlas
a4e48a7bca
store the forge webhook secret and grafana's secret key in bao, seeded from the existing files
2026-10-27 13:00:13 +01:00
atlas
50c1f2a3d1
add rea agent module and reverse-engineer archetype
2026-10-27 11:33:04 +01:00
atlas
eac7f2a7c1
queue collector exports on disk and retry without a time limit
2026-10-26 23:19:59 +01:00
atlas
31670da795
granter role no-op deletes the dead bootstrap token
2026-10-26 19:19:06 +01:00
atlas
99d2ed5b9e
build a failed meta build once more, and treat a timeout or missing grant as no verdict
2026-10-26 18:52:33 +01:00
atlas
5e64048e53
gate each deploy on a swarm build of the agent from internal/meta
2026-10-26 18:52:33 +01:00
atlas
3db835fb57
granter role unit: no-op when the granter login works, delete the token after success
2026-10-26 18:49:02 +01:00
atlas
0c6e8fc5a2
move hiveName to deploy.hive-controller; only a hive host needs a name
2026-10-26 18:47:49 +01:00
atlas
0cbfa806d3
hive collector runs only on hive hosts; review classifier pushes metrics through its forwarder
2026-10-26 15:58:44 +01:00
atlas
03796f1964
add one shared templated hive policy keyed on the cert alias name
2026-10-26 11:36:55 +01:00
atlas
3925534db6
note forceServiceConfigs scope: services only, callers only
2026-10-25 21:50:35 +01:00
atlas
549c198449
force each container's unit configs in the checks about it
2026-10-25 21:50:35 +01:00
atlas
4cdf807afc
add one shared templated agent policy and name each agent's bao entity after it
2026-10-25 21:50:06 +01:00
atlas
078696aaee
export bao client-cert not_before/not_after gauges and alert past 80% of lifetime
2026-10-25 19:02:49 +01:00
atlas
b79896c237
hive reads the forge for nix as its own account, not core
...
hive-c0re copies the hive's store read token to /run/hyperhive/forge-hive-token
for nix's git credential helper, and no longer mints, reads or falls back to
the core admin token. drops the core user sweep, avatar upload, webhook
cleanup and hive-priv's RunForgeAdmin.
2026-10-25 18:06:48 +01:00
iris
cea4827918
nix: the dashboard vhost's expected locations include /api/whoami
2026-10-25 15:25:20 +01:00
atlas
2e7d49bb88
serve matrix discovery at the swarm apex, keep the pinned hive case
2026-10-25 12:15:22 +01:00
atlas
96405621d7
keep each hive's otel oidc secret on /run, not /var/lib
2026-10-25 11:16:24 +01:00
atlas
19680a8b78
service urls carry no gateway port, httpsPort is listen-only
2026-10-25 10:45:54 +01:00
atlas
4d9b7e0ca9
agent store leaf: 7 days instead of 90
2026-10-25 10:23:35 +01:00
