atlas
fd2861c097
reset the failed container unit before stopping it in the link-refusal vm subtest
2026-10-30 08:52:50 +01:00
atlas
e46ad07226
add a per-agent egress log mode
2026-10-30 08:52:22 +01:00
atlas
221c3f35a1
remove the hive-c0re forge-credential chain nothing reads any more
...
With no nix build on the hive, the boot publish of the forge token for nix has no reader. Removes the ForgeSweep node, the token file, the git credential helper and hive-c0re's forge gitconfig sections.
2026-10-29 22:55:31 +01:00
atlas
4590b04cac
remove the hive's local build of agent closures
...
A rebuild or create downloads the closure the swarm built and applies it; with none to deploy it fails and changes nothing. hive-priv takes a store path instead of an internal/meta commit and builds nothing.
2026-10-29 22:17:07 +01:00
atlas
70538fb209
move c0re.hyperhiveFlake to deploy.hyperhiveFlake
2026-10-29 14:31:20 +01:00
atlas
e8190a4972
pin the container units in the hive collector's journal allow-list
2026-10-29 13:03:54 +01:00
atlas
c9096484d7
fold the container units into the one journalUnits definition
2026-10-29 12:52:54 +01:00
atlas
e316e683c3
ship container unit journals through the hive collector
2026-10-29 12:49:03 +01:00
atlas
fa5293e90a
read the squid options at their new path in the otel fixture; pin the env on a host with a store identity
2026-10-29 09:53:20 +01:00
atlas
da16487800
move the squid host options to deploy.hive-controller.squid
2026-10-29 09:53:20 +01:00
atlas
c9b5705ad8
share one hive-priv request helper across the vm tests
2026-10-29 08:51:31 +01:00
atlas
525de62b06
move the small per-service host options to deploy.<service>
2026-10-29 08:44:11 +01:00
atlas
51b0a02e95
wait for the wg-hive peers before pinging in the vm test
2026-10-29 08:27:38 +01:00
atlas
ce14c9b001
wait for hive-priv's reply to a daemon-reload in the link-refusal subtest
2026-10-29 08:27:29 +01:00
atlas
7e2f4ce7c8
always include a hive's own allowedDomains in the rendered swarm-wide list
2026-10-29 08:25:22 +01:00
atlas
c5a876b845
derive an agent's backend hosts into the egress allow list at the controller
2026-10-29 08:25:22 +01:00
atlas
4f32948a97
warn when the in-swarm cache runs under another domain
2026-10-29 08:24:44 +01:00
atlas
74f463c40e
move the c0re host options to deploy.hive-controller
2026-10-29 01:08:41 +01:00
atlas
525cbe0355
count readers, not writers, of the pull token in the cache's roster pin
2026-10-29 00:09:12 +01:00
atlas
f22f4ee6ac
let the operator's oidc login write the cache's tokens and facts
2026-10-29 00:09:12 +01:00
atlas
e0d2350902
ignore a failed warn-only root check: prefix its ExecStartPre with a dash
2026-10-28 23:52:37 +01:00
atlas
24afc89ab3
run the root check warn-only on hyperhive's own containers, per unit, not on the container@ template
2026-10-28 23:50:58 +01:00
atlas
c191975aab
check every container's root before its start, through the container@ template
2026-10-28 23:50:58 +01:00
atlas
1c3118e9cd
add two-vm wg-hive mesh test to vmTests
2026-10-28 23:44:58 +01:00
atlas
ad06ce04a8
pin the security headers in the swarm api 401 location property
2026-10-28 23:37:22 +01:00
atlas
ec14977949
build the single-host fixture's nginx config in a check so gixy runs in ci
2026-10-28 23:37:22 +01:00
atlas
46693b3c25
repeat the security headers in the swarm api 401 location
2026-10-28 23:37:22 +01:00
atlas
9ed7ebab91
fetch vale styles in nix, pinned, and drop vale sync
2026-10-28 23:08:48 +01:00
damocles
6dbb18b6d4
drop the hive-side matrix code: sweep, hivectl matrix and the apiUrl option
2026-10-28 23:04:55 +01:00
atlas
a00bcb8c05
merge the self-scrape into each collector's settings instead of defining them twice
2026-10-28 23:02:18 +01:00
atlas
73c966a7eb
container collectors scrape their own telemetry and push it up their hop
2026-10-28 23:02:18 +01:00
atlas
2095bb2d0f
compare the seed file in the unit environment as a path string
2026-10-28 23:01:43 +01:00
atlas
c9abc2a42b
make squid's allowed domains editable at runtime in the swarm ui
2026-10-28 23:01:43 +01:00
atlas
86e80250bb
remove the partial salvage dir when a salvage fails
...
- a failure between creating the dir and the rename removes that dir only
- give the ephemeral-rootfs vm test a 4 GiB disk so the space check passes
2026-10-28 23:01:04 +01:00
atlas
836b15a46e
harden the ephemeral-root salvage: clone, check space, lock
...
- clone each file with FICLONE, copy the data only where that fails
- skip the salvage when the copy would leave too little free space
- hold a per-container flock and one copy at a time across containers
- run WriteNspawnFlags on the blocking pool
2026-10-28 23:01:04 +01:00
atlas
bbc2a83771
print the vm test's priv response and journal only on failure
2026-10-28 22:04:09 +01:00
atlas
2b4fd52b0a
make the vm test's priv request wait for the salvage reply
2026-10-28 22:04:09 +01:00
atlas
b4ce4e0d90
put hello and tree in the agent-ephemeral-rootfs vm closure
2026-10-28 22:04:09 +01:00
atlas
6708ef804f
root the build the pre-start check names
2026-10-28 21:59:43 +01:00
atlas
a44a7256a7
check the container root before each start
2026-10-28 21:59:43 +01:00
damocles
ae9c3444bc
test the invite room check and the no-homeserver sweep, drop the last space wording
2026-10-28 21:07:32 +01:00
damocles
fd01848d4d
also stop provisioning the hive space and make hivectl matrix invite take a room
2026-10-28 20:57:41 +01:00
damocles
c7f3706597
stop provisioning the hive-chat room in the matrix sweep
2026-10-28 20:44:48 +01:00
atlas
099af86cd2
raise the cert role token ttl to 1h
2026-10-28 20:35:11 +01:00
atlas
00df3ccffb
give cert-auth role tokens a 15m ttl so logins stop leaving 32-day leases
2026-10-28 20:35:11 +01:00
atlas
81439fa710
run agent containers on an ephemeral root, salvaging the old one first
...
hive-priv copies a stopped container's root to the agent's work dir and
renames it aside before passing nspawn --ephemeral; the agent's nix state
moves to the persistent profiles bind. Adds the agent-ephemeral-rootfs vm
test and a module-eval case for the nix state redirect.
2026-10-28 20:00:12 +01:00
atlas
181c42dae1
collector dashboard: query the service.name the collectors emit, lint dashboard names
2026-10-28 19:57:35 +01:00
iris
24f6690fe5
swarm-ui vhost: cache by name, 404 a missing file, carry a content security policy
...
After a deploy a browser could keep the old entry document, which named a
bundle that no longer exists, and the missing script was answered with the
entry document, so the page was blank with only a MIME-type error to say why.
The hashed bundle is immutable and a missing file is a 404; the entry document,
the worker, the manifest, the icons and the theme's colors.css are revalidated.
The pages carry a content security policy. The service worker fetches its shell
past the HTTP cache, logs a failed install, refreshes the cached entry document
on each navigation and holds cache writes open with waitUntil. The proxy test
pins the cache rules, the 404s and the policy; docs/swarm/ui.md says what the
browser keeps.
2026-10-28 19:56:55 +01:00
atlas
e78a529ec2
squid: base allow list for every authed user, and no start limit on the list reload
2026-10-28 19:44:26 +01:00
atlas
10fdf06334
squid self-check: use a public canary, drop the swarm service names from the allow list
2026-10-28 19:44:26 +01:00
