atlas
b551eb02ff
send agent traffic through squid once its hive announces it
2026-10-28 17:24:34 +01:00
atlas
86e9f49fe6
resolve the self-check's deny canary in the squid VM test
2026-10-28 17:23:33 +01:00
atlas
e8868d52a8
deny the IPv6 unspecified address at squid
2026-10-28 17:23:33 +01:00
atlas
3d9561a9a6
deny private and reserved destinations for every squid user
2026-10-28 17:23:33 +01:00
atlas
501445ebc3
apply each agent's internet flag to its squid credential
2026-10-28 17:23:33 +01:00
atlas
cbe41bea54
rebuild an agent's closure when the binary cache lost it
2026-10-28 13:51:01 +01:00
atlas
fd63b402e1
fetch the self-check's password as a systemd credential
2026-10-28 13:50:35 +01:00
atlas
b7adb90f53
require a proxy credential at squid and prove it in the self-check
2026-10-28 13:50:35 +01:00
atlas
52d532ff5a
render squid's users file from this hive's proxy credentials
2026-10-28 13:50:35 +01:00
atlas
ec06a91deb
mint per-agent proxy credentials and a per-hive squid self-check credential
2026-10-28 13:50:35 +01:00
atlas
b845630023
keep the cache's key and pull token for hive-priv in a root-only directory
2026-10-28 10:23:01 +01:00
atlas
57b04d6c49
let the operator set, replace and remove an agent's backend env from the swarm ui
2026-10-28 08:49:32 +01:00
atlas
28be594f79
ship the cache host init units' journal through the hive collector
2026-10-28 08:49:14 +01:00
atlas
ca194f5c91
state the heal_own_dir cause in the backend env comments
2026-10-28 02:22:55 +01:00
atlas
be3a3af093
say that the backend env leaf and file are agent-writable, and why that is accepted
2026-10-28 01:24:29 +01:00
atlas
75e9e205e3
fetch the agent's backend env file from the store, seeded from the existing file
...
the agent's own root unit reads swarm/agents/<agent>/backend-env into /run and
creates it from backendEnvironmentFile with -cas=0 when the store holds nothing.
the shared agent policy gains create (not update) on that one leaf. the harness
and the subagent daemon load the old file first and the fetched one after it.
2026-10-28 01:24:29 +01:00
atlas
1e5070796d
copy the cache's pull facts to each hive and create them in the in-swarm cache
...
the in-swarm cache stores its address, name and public key beside its tokens, create-only. swarm-controller copies the four cache facts to swarm/hives/<hive>/attic/* every five minutes, with read on the sources and write on the copies. part 1 of 3: nothing reads the copies until the hive reader and probe land.
2026-10-28 01:19:56 +01:00
atlas
c79c41e004
warn when a hive host without a leaf names the otel oidc secret file
2026-10-28 00:46:19 +01:00
atlas
606817a994
default swarm.attic domain and cache to the swarm's own cache on every host
2026-10-27 22:16:26 +01:00
atlas
078aed1335
refuse unlisted squid names before any destination lookup
2026-10-27 20:59:06 +01:00
atlas
5513a6e875
rename the access-log variable in the squid vm test so it stops shadowing the driver's logger
2026-10-27 20:59:06 +01:00
atlas
a2cf6fe8bb
deploy squid on every hive host, with exporter, journal forwarding and self-check
2026-10-27 20:59:06 +01:00
atlas
d5c5862654
keep the matrix appservice registration in bao, with the host file as the last copy
2026-10-27 17:33:06 +01:00
atlas
a572fb6a7f
forward the attic container's journal to the swarm collector
2026-10-27 16:03:23 +01:00
atlas
99fab06348
keep authelia's keys in bao, seeded from the existing key files
2026-10-27 16:01:57 +01:00
atlas
e77459d2cb
count the cache's container in the service-container cases
2026-10-27 14:28:51 +01:00
atlas
458a046b8d
run attic as a swarm service with deploy.attic.enable
2026-10-27 13:04:17 +01:00
atlas
f59ed01353
fix the builder cache module-eval case and document the external cache
2026-10-27 13:02:43 +01:00
atlas
bd214b9f3e
require both attic options, follow attic's cache-name rule, read the token from a file
2026-10-27 13:02:43 +01:00
atlas
0849afec80
push green meta builds to the attic cache and record cached
2026-10-27 13:02:43 +01:00
atlas
c4e8d5b540
match the guest's legacy key path in the grafana tmpfiles check, not the /run secrets dir
2026-10-27 13:00:13 +01:00
atlas
a4e48a7bca
store the forge webhook secret and grafana's secret key in bao, seeded from the existing files
2026-10-27 13:00:13 +01:00
atlas
50c1f2a3d1
add rea agent module and reverse-engineer archetype
2026-10-27 11:33:04 +01:00
atlas
139007e656
stop writing and attaching per-agent and per-hive bao policies
2026-10-27 10:11:02 +01:00
atlas
eac7f2a7c1
queue collector exports on disk and retry without a time limit
2026-10-26 23:19:59 +01:00
atlas
31670da795
granter role no-op deletes the dead bootstrap token
2026-10-26 19:19:06 +01:00
atlas
59456c3c58
retry every failed meta build each round, a timeout included, and drop the attempt count
2026-10-26 18:52:33 +01:00
atlas
99d2ed5b9e
build a failed meta build once more, and treat a timeout or missing grant as no verdict
2026-10-26 18:52:33 +01:00
atlas
5e64048e53
gate each deploy on a swarm build of the agent from internal/meta
2026-10-26 18:52:33 +01:00
atlas
3db835fb57
granter role unit: no-op when the granter login works, delete the token after success
2026-10-26 18:49:02 +01:00
atlas
0c6e8fc5a2
move hiveName to deploy.hive-controller; only a hive host needs a name
2026-10-26 18:47:49 +01:00
iris
b53365e371
docs: put the credentials prose on the overview and the tables on the reference
...
The folded-in secrets.md text sat after the reference's table, so the
reference was half prose. The overview now holds all the prose (where a
secret lives, topologies, the swarm- and hive-level notes, how a reader
reaches the store, the browser UI, adding a secret) and the reference holds
only the tables, each pointing at the section that explains it. No text
dropped; links that asked for the explanation now go to the overview, and
the ones that asked for a list or a row go to the reference.
2026-10-26 18:10:01 +01:00
iris
d273fa8028
docs: fold swarm/secrets.md into the credentials reference
...
secrets.md and credentials-reference.md answered the same question from two
pages. secrets.md's text now follows the reference's table and operating
notes as a 'Where each secret lives' section, unchanged apart from where it
sits. Every link and doc path that named secrets.md (docs, nix comments,
crate READMEs) points at credentials-reference.md; anchors are unchanged.
2026-10-26 18:10:01 +01:00
atlas
0cbfa806d3
hive collector runs only on hive hosts; review classifier pushes metrics through its forwarder
2026-10-26 15:58:44 +01:00
atlas
03796f1964
add one shared templated hive policy keyed on the cert alias name
2026-10-26 11:36:55 +01:00
atlas
3925534db6
note forceServiceConfigs scope: services only, callers only
2026-10-25 21:50:35 +01:00
atlas
549c198449
force each container's unit configs in the checks about it
2026-10-25 21:50:35 +01:00
atlas
4cdf807afc
add one shared templated agent policy and name each agent's bao entity after it
2026-10-25 21:50:06 +01:00
atlas
ca6fc87566
drop the unread HIVE_ASSETS_DIR env from the hive-c0re unit
2026-10-25 21:09:39 +01:00
atlas
e592078868
move client-cert gauges behind an otel feature of swarm-secret-client, drop the crate
2026-10-25 19:02:49 +01:00
