atlas
09ad7386b2
forge: hand the OIDC client secret to forgejo from /run, not from the container's disk ...
swarm-bao-forge-oidc fetched the forge's OIDC client secret from bao and wrote
it to /var/lib/nixos-containers/hive-forge/var/lib/forgejo-oidc/<id>.secret,
on the container's persistent root, where it outlived a bao rotation and was
in every backup of that tree.
Now the fetch writes it to /run/hive-forge-oidc/<id>.secret on the host
(tmpfs, root 0400). The directory is bound read-only into the container at
the same path, and forgejo-sso-source loads it through LoadCredential. A
tmpfiles rule creates the directory at boot, so the bind source always
exists, and removes the old persistent copy.
After a reboot the file is absent until the fetch succeeds, and
forgejo-sso-source fails to start until then; the fetch starts it again once
it writes the file. Logins keep working meanwhile: forgejo holds the secret
in its login-source row.
deploy.forgejo.sso.clientSecretFile (and its old swarm.forge.sso name) is
removed: it only chose where in the container the fetched file landed. The
fetch no longer needs the container's forgejo uid, so it no longer fails on a
fresh host before the container has created its state dir.
Part of #4998 .
2026-10-15 21:21:50 +02:00
agents: swap the agent's bao leaf in with one rename
2026-10-11 10:00:43 +02:00
module-eval: evaluate shared fixture configs once
2026-10-13 08:14:50 +02:00
nix: split module-eval into per-subsystem checks
2026-09-20 04:25:54 +02:00
module-eval: evaluate shared fixture configs once
2026-10-13 08:14:50 +02:00
subagent, bash: run each subagent run and bash task in its own cgroup
2026-10-13 12:25:27 +02:00
module-eval: evaluate shared fixture configs once
2026-10-13 08:14:50 +02:00
module-eval: evaluate shared fixture configs once
2026-10-13 08:14:50 +02:00
module-eval: restore agentWith in agent-queue-bao.nix
2026-10-13 14:56:25 +02:00
agents: swap the agent's bao leaf in with one rename
2026-10-11 10:00:43 +02:00
module-eval: agent-user test asserts the heal_own_dir form
2026-10-09 11:30:30 +02:00
swarm-bao-agent-pki: decide openbao's restart on the shared locale-independent compare
2026-10-13 17:00:56 +02:00
swarm UI: an alerts page, read by the controller with a Viewer Grafana token from bao
2026-10-15 15:16:21 +02:00
swarm UI: an alerts page, read by the controller with a Viewer Grafana token from bao
2026-10-15 15:16:21 +02:00
module-eval: evaluate shared fixture configs once
2026-10-13 08:14:50 +02:00
module-eval: evaluate shared fixture configs once
2026-10-13 08:14:50 +02:00
swarm-bao-pki: enabling a service mints its client leaf on the same switch
2026-10-15 08:31:33 +02:00
swarm UI: log an agent into claude from its card; the credentials go to bao and the agent picks them up
2026-10-15 13:26:29 +02:00
forge: hand the OIDC client secret to forgejo from /run, not from the container's disk
2026-10-15 21:21:50 +02:00
swarm UI: an alerts page, read by the controller with a Viewer Grafana token from bao
2026-10-15 15:16:21 +02:00
hive otel: keep file_storage defined when the collector authenticates upstream
2026-10-14 10:13:58 +02:00
hive-tls: bound each store attempt so a silent store fails into a retry
2026-10-15 11:21:47 +02:00
module-eval: assert the severity table once, not once per tier
2026-09-20 14:23:56 +02:00
authelia: a user outside a rule's group is denied instead of falling through to one_factor
2026-10-14 23:41:13 +02:00
module-eval: evaluate shared fixture configs once
2026-10-13 08:14:50 +02:00
swarm: refuse swarm.hives keys that are not valid hive identifiers
2026-10-12 21:45:50 +02:00
agent permissions: one set, tool groups included, set at agent creation
2026-10-15 18:01:40 +02:00
forge: hand the OIDC client secret to forgejo from /run, not from the container's disk
2026-10-15 21:21:50 +02:00
glue: the secret publisher's authelia-dependent settings move out of the publisher module
2026-10-14 01:52:53 +02:00
module-eval: three duplicate nixosSystem fixtures come from shared.nix
2026-10-15 08:29:58 +02:00
swarm snapshot store: the receiver socket binds the mesh address even when wg-hive comes up after sockets.target
2026-10-15 08:27:54 +02:00
module-eval: evaluate shared fixture configs once
2026-10-13 08:14:50 +02:00
forge: hand the OIDC client secret to forgejo from /run, not from the container's disk
2026-10-15 21:21:50 +02:00
module-eval, credentials.md: count the Grafana controller-token unit among the store's readers
2026-10-15 15:16:21 +02:00
09ad7386b2