atlas
b68a8ef290
swarm-authelia: run the secret publisher and a journal forwarder inside the container ...
swarm-secret-publish and its path unit now run inside authelia's container,
beside the mint, and read each client secret at the path authelia writes it.
The host unit and host path unit, which read the secrets through the
container's root on the host, are gone, and so is
deploy.authelia.hostClientSecretDir, which only they read. The publisher keeps
its store identity, the secret-publisher leaf. The host hands the leaf and the
store's CA into the container as nspawn system credentials, and the unit loads
them; where this host mints the leaf, the container waits for swarm-bao-pki.
Authelia does not wait for the publisher, which retries every 30 seconds while
the store is down.
The container also runs the journal forwarder the other service containers
run, pushing to a receiver of its own on the swarm collector (serviceProducers
swarm-authelia) as a new machine OIDC client (swarm.authelia.otel.clientId)
that authelia registers for itself and the publisher carries to the store. The
fetch unit reads it back under the publisher's leaf, also handed to it as a
system credential, so the swarm-secret-publisher policy gains read on that one
leaf; its stanza keeps create and update, which the exact path would otherwise
take from the services/* prefix. Without the leaf the forwarder is off.
The container drops --link-journal=host, and the host collector stops reading
it. The services' "nothing at <path>" errors name the publisher in authelia's
container.
2026-10-17 00:28:16 +02:00
drop option renames and removals older than two weeks
2026-10-16 22:04:57 +02:00
swarm-authelia: run the secret publisher and a journal forwarder inside the container
2026-10-17 00:28:16 +02:00
drop option renames and removals older than two weeks
2026-10-16 22:04:57 +02:00
swarm-bao-agent-pki: decide openbao's restart on the shared locale-independent compare
2026-10-13 17:00:56 +02:00
swarm-grafana /dashboards
push ci run metrics to victoriametrics, with a grafana board
2026-10-16 20:43:11 +02:00
bao: disable the unused approle auth method, declaratively
2026-09-28 22:58:36 +02:00
drop option renames and removals older than two weeks
2026-10-16 22:04:57 +02:00
swarm-authelia: run the secret publisher and a journal forwarder inside the container
2026-10-17 00:28:16 +02:00
hive-forge: the controller-token mint writes straight to the store, and the on-disk token goes
2026-10-16 17:48:56 +02:00
make bao readers want swarm-bao-pki and drop its start limit
2026-10-16 18:29:38 +02:00
swarm-authelia: run the secret publisher and a journal forwarder inside the container
2026-10-17 00:28:16 +02:00
bao: OIDC login to the browser UI via authelia, as a metadata-only viewer
2026-09-28 19:56:38 +02:00
swarm-builder, swarm-claude-login, swarm-review-classifier: forward each container's journal to the swarm collector
2026-10-16 09:10:04 +02:00
push ci run metrics to victoriametrics, with a grafana board
2026-10-16 20:43:11 +02:00
swarm-ci-runner, swarm-grafana, swarm-victorialogs: forward each container's journal to the swarm collector
2026-10-16 11:22:51 +02:00
swarm-builder, swarm-claude-login, swarm-review-classifier: forward each container's journal to the swarm collector
2026-10-16 09:10:04 +02:00
nix: gate hive-c0re on deploy.hive-controller.enable, drop hyperhive.enable
2026-09-26 01:19:49 +02:00
glue: the controller's authelia and otel environment moves out of the controller module
2026-10-14 10:15:29 +02:00
glue: the controller's authelia and otel environment moves out of the controller module
2026-10-14 10:15:29 +02:00
glue: forge's controller-dependent settings move out of the forge module
2026-10-13 22:14:28 +02:00
nix: gate hive-c0re on deploy.hive-controller.enable, drop hyperhive.enable
2026-09-26 01:19:49 +02:00
hive-forge, hive-matrix: forward each container's journal to the swarm collector
2026-10-16 13:50:23 +02:00
nix: gate hive-c0re on deploy.hive-controller.enable, drop hyperhive.enable
2026-09-26 01:19:49 +02:00
swarm-ci-runner, swarm-grafana, swarm-victorialogs: forward each container's journal to the swarm collector
2026-10-16 11:22:51 +02:00
glue: hive-otel's ordering after authelia moves out of the otel module
2026-10-13 22:04:52 +02:00
hive-tls: the gateway leaf uses the services-issuer identity, not a hive's
2026-10-06 14:54:07 +02:00
swarm-logs-auth: check agent tokens on the log store's query route
2026-10-13 08:38:05 +02:00
swarm-nats, matrix: the queue's and matrix-ctl's store identity paths are their own, not the hive's
2026-10-06 12:04:48 +02:00
swarm: OIDC clients registered wherever authelia runs; nats + matrix secrets from bao
2026-10-05 09:58:02 +02:00
hive-forge, hive-matrix: forward each container's journal to the swarm collector
2026-10-16 13:50:23 +02:00
swarm metrics store: the read API needs Grafana's bearer or an operator session
2026-10-15 10:48:20 +02:00
swarm-nats: the auth responder's store identity path is its own, not the hive's
2026-10-06 10:04:30 +02:00
swarm-nats, matrix: the queue's and matrix-ctl's store identity paths are their own, not the hive's
2026-10-06 12:04:48 +02:00
swarm-nats: forward the queue container's journal to the swarm collector
2026-10-16 09:08:21 +02:00
glue: nats firewall on the wireguard interface moves out of the nats module
2026-10-14 10:15:19 +02:00
swarm-authelia: run the secret publisher and a journal forwarder inside the container
2026-10-17 00:28:16 +02:00
swarm-builder, swarm-claude-login, swarm-review-classifier: forward each container's journal to the swarm collector
2026-10-16 09:10:04 +02:00
swarm-authelia: run the secret publisher and a journal forwarder inside the container
2026-10-17 00:28:16 +02:00
swarm-authelia: run the secret publisher and a journal forwarder inside the container
2026-10-17 00:28:16 +02:00
ops: update option pointers after grafana/bao split
2026-10-01 09:53:04 +02:00
ops: update option pointers after otel split
2026-10-01 13:00:40 +02:00
swarm-ci-runner, swarm-grafana, swarm-victorialogs: forward each container's journal to the swarm collector
2026-10-16 11:22:51 +02:00
swarm-victoriametrics: forward the container's journal to the swarm collector
2026-10-16 14:47:31 +02:00
drop option renames and removals older than two weeks
2026-10-16 22:04:57 +02:00
swarm-authelia: run the secret publisher and a journal forwarder inside the container
2026-10-17 00:28:16 +02:00
drop option renames and removals older than two weeks
2026-10-16 22:04:57 +02:00
hive-priv: lock personality, deny realtime, kernel logs and module loading
2026-10-16 16:06:49 +02:00
gateway: serve the hive dashboard on <hive>.hives.<swarm> behind authelia, drop htpasswd
2026-10-15 21:44:27 +02:00
drop option renames and removals older than two weeks
2026-10-16 22:04:57 +02:00
drop option renames and removals older than two weeks
2026-10-16 22:04:57 +02:00
swarm-nats: take the callout issuer and user keys from the store
2026-10-06 14:53:33 +02:00
nats-callout-removed: remove the container's OIDC secret copy here, ungated
2026-10-06 15:25:29 +02:00
swarm-authelia: run the secret publisher and a journal forwarder inside the container
2026-10-17 00:28:16 +02:00
swarm-ui: apply the operator's stylix theme, same as the dashboard already does
2026-08-24 14:28:25 +02:00
swarm-authelia: run the secret publisher and a journal forwarder inside the container
2026-10-17 00:28:16 +02:00
swarm-authelia: run the secret publisher and a journal forwarder inside the container
2026-10-17 00:28:16 +02:00
nix: split swarm-bao into service and deploy-mode files
2026-10-01 09:37:36 +02:00
swarm-authelia: run the secret publisher and a journal forwarder inside the container
2026-10-17 00:28:16 +02:00
swarm-builder, swarm-claude-login, swarm-review-classifier: forward each container's journal to the swarm collector
2026-10-16 09:10:04 +02:00
push ci run metrics to victoriametrics, with a grafana board
2026-10-16 20:43:11 +02:00
swarm-ci-runner, swarm-grafana, swarm-victorialogs: forward each container's journal to the swarm collector
2026-10-16 11:22:51 +02:00
swarm-builder, swarm-claude-login, swarm-review-classifier: forward each container's journal to the swarm collector
2026-10-16 09:10:04 +02:00
swarm-authelia: run the secret publisher and a journal forwarder inside the container
2026-10-17 00:28:16 +02:00
swarm-ci-runner, swarm-grafana, swarm-victorialogs: forward each container's journal to the swarm collector
2026-10-16 11:22:51 +02:00
swarm-authelia: run the secret publisher and a journal forwarder inside the container
2026-10-17 00:28:16 +02:00
swarm-nats: forward the queue container's journal to the swarm collector
2026-10-16 09:08:21 +02:00
gateway: service modules declare their vhost under gateway.vhosts
2026-10-16 12:47:03 +02:00
swarm-authelia: run the secret publisher and a journal forwarder inside the container
2026-10-17 00:28:16 +02:00
swarm-authelia: run the secret publisher and a journal forwarder inside the container
2026-10-17 00:28:16 +02:00
push ci run metrics to victoriametrics, with a grafana board
2026-10-16 20:43:11 +02:00
swarm-builder, swarm-claude-login, swarm-review-classifier: forward each container's journal to the swarm collector
2026-10-16 09:10:04 +02:00
swarm-authelia: run the secret publisher and a journal forwarder inside the container
2026-10-17 00:28:16 +02:00
snapshot store: bound the transfer on both ends
2026-10-16 11:45:58 +02:00
drop option renames and removals older than two weeks
2026-10-16 22:04:57 +02:00
swarm-ci-runner, swarm-grafana, swarm-victorialogs: forward each container's journal to the swarm collector
2026-10-16 11:22:51 +02:00
gateway: service modules declare their vhost under gateway.vhosts
2026-10-16 12:47:03 +02:00
swarm-victoriametrics: forward the container's journal to the swarm collector
2026-10-16 14:47:31 +02:00
swarm-victoriametrics: forward the container's journal to the swarm collector
2026-10-16 14:47:31 +02:00
swarm options: no swarm.* value depends on a deploy option or this host's hive
2026-10-04 18:13:47 +02:00
swarm-authelia: run the secret publisher and a journal forwarder inside the container
2026-10-17 00:28:16 +02:00
b68a8ef290