atlas
0e5eb1e8d6
glue-matrix-bao-token: the store's first reader ...
Fetches an opaque 32-byte value and writes it where hive-matrix.nix
already looks, so the homeserver never learns the store exists.
Chosen over authelia's OIDC secret deliberately: that one needs a
.secret AND a matching .digest, so shipping it first would debug 'can a
reader authenticate and get bytes back' and 'did we write authelia's
file format right' at once, with an SSO outage as the failure mode. Here
the failure is narrow -- new agent accounts cannot be provisioned,
existing ones untouched.
Every failure path keeps the local token: no such key, sealed store,
unreachable store, empty value. The activation script's mint-if-absent
is untouched, so a hive with no store behaves exactly as it does today.
matrixMachine is a literal because hive-matrix.nix declares no `machine`
option -- `matrixCfg.machine` parses cleanly and fails at module-system
resolution, which is the kind of error only reading the target module
catches.
2026-08-30 19:01:10 +02:00
matrix: forward the homeserver URL from client hives too
2026-08-30 15:17:02 +02:00
deploy: move the forge CI runner toggle out of swarm
2026-08-30 16:07:21 +02:00
gateway: move verifiedProxyTo's 42-line rationale comment to docs/gateway.md
2026-08-28 10:48:26 +02:00
fix( #3527 ): a missing source must report as zero, not as empty
2026-08-19 20:27:00 +02:00
swarm-grafana /dashboards
grafana: rank the by-label panel as bars, and stop calling it open issues
2026-08-28 13:23:25 +02:00
glue-matrix-bao-token: the store's first reader
2026-08-30 19:01:10 +02:00
deploy: which host runs the secret store is its own decision
2026-08-30 18:54:35 +02:00
glue-bao-tls: mint the store an identity it can hold before it is up
2026-08-30 19:01:10 +02:00
glue-matrix-bao-token: the store's first reader
2026-08-30 19:01:10 +02:00
deploy: move the forge CI runner toggle out of swarm
2026-08-30 16:07:21 +02:00
deploy: move the matrix homeserver toggle out of swarm
2026-08-30 15:17:02 +02:00
require network isolation, deleting the residual non-isolated branch
2026-08-30 03:32:08 +02:00
fix( #2573 ): also add /etc/tmpfiles.d to hive-priv ReadWritePaths (same EROFS class)
2026-07-18 16:39:20 +02:00
deploy: give every option an enable, and name the controller one
2026-08-30 04:23:22 +02:00
refactor(nix): a hive's domain comes out of the swarm directory
2026-08-05 22:43:17 +02:00
local-defaults: assert the controller through deploy, not the old alias
2026-08-30 04:23:22 +02:00
deploy: name the swarm collector swarm-otel, not otel
2026-08-30 04:23:22 +02:00
swarm-ui: apply the operator's stylix theme, same as the dashboard already does
2026-08-24 14:28:25 +02:00
deploy: name the swarm collector swarm-otel, not otel
2026-08-30 04:23:22 +02:00
swarm-bao: run the swarm's secret store in a container
2026-08-30 19:01:10 +02:00
swarm-otel: collect only the units the swarm's services declare
2026-08-24 22:05:45 +02:00
fix( #3363 ): swarm containers write their own resolver file
2026-08-17 17:30:15 +02:00
deploy: name the swarm collector swarm-otel, not otel
2026-08-30 04:23:22 +02:00
deploy: name the swarm collector swarm-otel, not otel
2026-08-30 04:23:22 +02:00
deploy: name the swarm collector swarm-otel, not otel
2026-08-30 04:23:22 +02:00
deploy: name the swarm collector swarm-otel, not otel
2026-08-30 04:23:22 +02:00
docs+nix: fix stale certFingerprint/HYPERHIVE_PEERS references (hyperhive#3294)
2026-08-15 19:56:11 +02:00
deploy: which host runs the secret store is its own decision
2026-08-30 18:54:35 +02:00
refactor( #2862 ): keep the option at services.hyperhive.snapshotStore
2026-07-31 19:03:24 +02:00
deploy: give every option an enable, and name the controller one
2026-08-30 04:23:22 +02:00
deploy: retention is the store host's decision, not the swarm's
2026-08-30 16:23:48 +02:00
deploy: retention is the store host's decision, not the swarm's
2026-08-30 16:23:48 +02:00
docs+nix: fix stale certFingerprint/HYPERHIVE_PEERS references (hyperhive#3294)
2026-08-15 19:56:11 +02:00
deploy: name the swarm collector swarm-otel, not otel
2026-08-30 04:23:22 +02:00
0e5eb1e8d6