atlas
f5a609911c
read privateUsers from the closure record at start, and move the data owner option under hive-controller
2026-11-01 17:06:18 +01:00
atlas
bfdf603d12
run opted-in agents in a user namespace with a dedicated data owner
2026-11-01 17:06:18 +01:00
atlas
fd2861c097
reset the failed container unit before stopping it in the link-refusal vm subtest
2026-10-30 08:52:50 +01:00
atlas
e46ad07226
add a per-agent egress log mode
2026-10-30 08:52:22 +01:00
atlas
da16487800
move the squid host options to deploy.hive-controller.squid
2026-10-29 09:53:20 +01:00
atlas
c9b5705ad8
share one hive-priv request helper across the vm tests
2026-10-29 08:51:31 +01:00
atlas
51b0a02e95
wait for the wg-hive peers before pinging in the vm test
2026-10-29 08:27:38 +01:00
atlas
ce14c9b001
wait for hive-priv's reply to a daemon-reload in the link-refusal subtest
2026-10-29 08:27:29 +01:00
atlas
7e2f4ce7c8
always include a hive's own allowedDomains in the rendered swarm-wide list
2026-10-29 08:25:22 +01:00
atlas
74f463c40e
move the c0re host options to deploy.hive-controller
2026-10-29 01:08:41 +01:00
atlas
24afc89ab3
run the root check warn-only on hyperhive's own containers, per unit, not on the container@ template
2026-10-28 23:50:58 +01:00
atlas
c191975aab
check every container's root before its start, through the container@ template
2026-10-28 23:50:58 +01:00
atlas
1c3118e9cd
add two-vm wg-hive mesh test to vmTests
2026-10-28 23:44:58 +01:00
atlas
c9abc2a42b
make squid's allowed domains editable at runtime in the swarm ui
2026-10-28 23:01:43 +01:00
atlas
86e80250bb
remove the partial salvage dir when a salvage fails
...
- a failure between creating the dir and the rename removes that dir only
- give the ephemeral-rootfs vm test a 4 GiB disk so the space check passes
2026-10-28 23:01:04 +01:00
atlas
bbc2a83771
print the vm test's priv response and journal only on failure
2026-10-28 22:04:09 +01:00
atlas
2b4fd52b0a
make the vm test's priv request wait for the salvage reply
2026-10-28 22:04:09 +01:00
atlas
b4ce4e0d90
put hello and tree in the agent-ephemeral-rootfs vm closure
2026-10-28 22:04:09 +01:00
atlas
6708ef804f
root the build the pre-start check names
2026-10-28 21:59:43 +01:00
atlas
a44a7256a7
check the container root before each start
2026-10-28 21:59:43 +01:00
atlas
81439fa710
run agent containers on an ephemeral root, salvaging the old one first
...
hive-priv copies a stopped container's root to the agent's work dir and
renames it aside before passing nspawn --ephemeral; the agent's nix state
moves to the persistent profiles bind. Adds the agent-ephemeral-rootfs vm
test and a module-eval case for the nix state redirect.
2026-10-28 20:00:12 +01:00
atlas
e78a529ec2
squid: base allow list for every authed user, and no start limit on the list reload
2026-10-28 19:44:26 +01:00
atlas
10fdf06334
squid self-check: use a public canary, drop the swarm service names from the allow list
2026-10-28 19:44:26 +01:00
atlas
4eb27543e5
move vm tests out of checks into a nightly vmTests workflow
2026-10-28 18:41:42 +01:00
atlas
b551eb02ff
send agent traffic through squid once its hive announces it
2026-10-28 17:24:34 +01:00
atlas
86e9f49fe6
resolve the self-check's deny canary in the squid VM test
2026-10-28 17:23:33 +01:00
atlas
e8868d52a8
deny the IPv6 unspecified address at squid
2026-10-28 17:23:33 +01:00
atlas
3d9561a9a6
deny private and reserved destinations for every squid user
2026-10-28 17:23:33 +01:00
atlas
501445ebc3
apply each agent's internet flag to its squid credential
2026-10-28 17:23:33 +01:00
atlas
b7adb90f53
require a proxy credential at squid and prove it in the self-check
2026-10-28 13:50:35 +01:00
atlas
5513a6e875
rename the access-log variable in the squid vm test so it stops shadowing the driver's logger
2026-10-27 20:59:06 +01:00
atlas
a2cf6fe8bb
deploy squid on every hive host, with exporter, journal forwarding and self-check
2026-10-27 20:59:06 +01:00
