atlas
501445ebc3
apply each agent's internet flag to its squid credential
2026-10-28 17:23:33 +01:00
atlas
fd63b402e1
fetch the self-check's password as a systemd credential
2026-10-28 13:50:35 +01:00
atlas
b7adb90f53
require a proxy credential at squid and prove it in the self-check
2026-10-28 13:50:35 +01:00
atlas
52d532ff5a
render squid's users file from this hive's proxy credentials
2026-10-28 13:50:35 +01:00
atlas
ec06a91deb
mint per-agent proxy credentials and a per-hive squid self-check credential
2026-10-28 13:50:35 +01:00
atlas
b845630023
keep the cache's key and pull token for hive-priv in a root-only directory
2026-10-28 10:23:01 +01:00
atlas
57b04d6c49
let the operator set, replace and remove an agent's backend env from the swarm ui
2026-10-28 08:49:32 +01:00
atlas
28be594f79
ship the cache host init units' journal through the hive collector
2026-10-28 08:49:14 +01:00
atlas
75e9e205e3
fetch the agent's backend env file from the store, seeded from the existing file
...
the agent's own root unit reads swarm/agents/<agent>/backend-env into /run and
creates it from backendEnvironmentFile with -cas=0 when the store holds nothing.
the shared agent policy gains create (not update) on that one leaf. the harness
and the subagent daemon load the old file first and the fetched one after it.
2026-10-28 01:24:29 +01:00
atlas
1e5070796d
copy the cache's pull facts to each hive and create them in the in-swarm cache
...
the in-swarm cache stores its address, name and public key beside its tokens, create-only. swarm-controller copies the four cache facts to swarm/hives/<hive>/attic/* every five minutes, with read on the sources and write on the copies. part 1 of 3: nothing reads the copies until the hive reader and probe land.
2026-10-28 01:19:56 +01:00
atlas
c79c41e004
warn when a hive host without a leaf names the otel oidc secret file
2026-10-28 00:46:19 +01:00
atlas
606817a994
default swarm.attic domain and cache to the swarm's own cache on every host
2026-10-27 22:16:26 +01:00
atlas
078aed1335
refuse unlisted squid names before any destination lookup
2026-10-27 20:59:06 +01:00
atlas
a2cf6fe8bb
deploy squid on every hive host, with exporter, journal forwarding and self-check
2026-10-27 20:59:06 +01:00
atlas
d5c5862654
keep the matrix appservice registration in bao, with the host file as the last copy
2026-10-27 17:33:06 +01:00
atlas
a572fb6a7f
forward the attic container's journal to the swarm collector
2026-10-27 16:03:23 +01:00
atlas
99fab06348
keep authelia's keys in bao, seeded from the existing key files
2026-10-27 16:01:57 +01:00
atlas
e77459d2cb
count the cache's container in the service-container cases
2026-10-27 14:28:51 +01:00
atlas
458a046b8d
run attic as a swarm service with deploy.attic.enable
2026-10-27 13:04:17 +01:00
atlas
f59ed01353
fix the builder cache module-eval case and document the external cache
2026-10-27 13:02:43 +01:00
atlas
bd214b9f3e
require both attic options, follow attic's cache-name rule, read the token from a file
2026-10-27 13:02:43 +01:00
atlas
0849afec80
push green meta builds to the attic cache and record cached
2026-10-27 13:02:43 +01:00
atlas
c4e8d5b540
match the guest's legacy key path in the grafana tmpfiles check, not the /run secrets dir
2026-10-27 13:00:13 +01:00
atlas
a4e48a7bca
store the forge webhook secret and grafana's secret key in bao, seeded from the existing files
2026-10-27 13:00:13 +01:00
atlas
50c1f2a3d1
add rea agent module and reverse-engineer archetype
2026-10-27 11:33:04 +01:00
atlas
eac7f2a7c1
queue collector exports on disk and retry without a time limit
2026-10-26 23:19:59 +01:00
atlas
31670da795
granter role no-op deletes the dead bootstrap token
2026-10-26 19:19:06 +01:00
atlas
99d2ed5b9e
build a failed meta build once more, and treat a timeout or missing grant as no verdict
2026-10-26 18:52:33 +01:00
atlas
5e64048e53
gate each deploy on a swarm build of the agent from internal/meta
2026-10-26 18:52:33 +01:00
atlas
3db835fb57
granter role unit: no-op when the granter login works, delete the token after success
2026-10-26 18:49:02 +01:00
atlas
0c6e8fc5a2
move hiveName to deploy.hive-controller; only a hive host needs a name
2026-10-26 18:47:49 +01:00
atlas
0cbfa806d3
hive collector runs only on hive hosts; review classifier pushes metrics through its forwarder
2026-10-26 15:58:44 +01:00
atlas
03796f1964
add one shared templated hive policy keyed on the cert alias name
2026-10-26 11:36:55 +01:00
atlas
3925534db6
note forceServiceConfigs scope: services only, callers only
2026-10-25 21:50:35 +01:00
atlas
549c198449
force each container's unit configs in the checks about it
2026-10-25 21:50:35 +01:00
atlas
4cdf807afc
add one shared templated agent policy and name each agent's bao entity after it
2026-10-25 21:50:06 +01:00
atlas
078696aaee
export bao client-cert not_before/not_after gauges and alert past 80% of lifetime
2026-10-25 19:02:49 +01:00
atlas
b79896c237
hive reads the forge for nix as its own account, not core
...
hive-c0re copies the hive's store read token to /run/hyperhive/forge-hive-token
for nix's git credential helper, and no longer mints, reads or falls back to
the core admin token. drops the core user sweep, avatar upload, webhook
cleanup and hive-priv's RunForgeAdmin.
2026-10-25 18:06:48 +01:00
iris
cea4827918
nix: the dashboard vhost's expected locations include /api/whoami
2026-10-25 15:25:20 +01:00
atlas
2e7d49bb88
serve matrix discovery at the swarm apex, keep the pinned hive case
2026-10-25 12:15:22 +01:00
atlas
96405621d7
keep each hive's otel oidc secret on /run, not /var/lib
2026-10-25 11:16:24 +01:00
atlas
19680a8b78
service urls carry no gateway port, httpsPort is listen-only
2026-10-25 10:45:54 +01:00
atlas
4d9b7e0ca9
agent store leaf: 7 days instead of 90
2026-10-25 10:23:35 +01:00
atlas
eaf26aaadd
review classifier: export request, verdict, check and run metrics, with a dashboard
...
The controller counts review requests, verdicts and per-check results and times each run; the classifier service counts retried asks. A provisioned Grafana dashboard charts them.
2026-10-24 23:24:31 +02:00
atlas
7680b07fcb
swarm-otel: routes carry a route header and the readiness probe requires it
2026-10-24 23:02:37 +02:00
atlas
41bea3c6d9
swarm-otel: let the collector write its socket dir, and probe every route through nginx
2026-10-24 23:02:37 +02:00
atlas
1325f44707
swarm-otel: route the gateway from the receiver list and check the sockets accept
...
Refs #4815
2026-10-24 23:02:37 +02:00
atlas
ec562ca503
drop port-collision checks against swarm.otel.telemetryPort
...
nothing at runtime: eval no longer asserts against a port the swarm
collector no longer binds in the host netns.
2026-10-24 23:02:37 +02:00
atlas
6b1fc4b040
module-eval: four containers left on the host netns
2026-10-24 23:02:37 +02:00
atlas
e226e65954
swarm-otel: run in its own network namespace, receivers on unix sockets
...
Refs #4815
2026-10-24 23:02:37 +02:00
