atlas
34e142bb5c
hive-matrix: run the homeserver in its own netns, behind a unix socket ...
tuwunel bound `0.0.0.0:<httpPort>` in the host netns, so the homeserver
port was open on every host address, and the gateway proxied to it on
host loopback.
The container now sets `privateNetwork = true` and hangs off the hive
bridge with a DHCP lease, the same attach the CI runner, builder and
review classifier use (resolvconf on, `networking.nameservers` the bridge
IP). tuwunel listens only on `/run/hive-matrix/tuwunel.sock`, a host
directory (root:nginx 0770) bind-mounted into the container; its primary
group is nginx's gid and the socket is 0660. The gateway's `/_matrix/`
location proxies to the socket.
The static resolv.conf goes: it existed because resolvconf's host
tracking came up empty in the shared netns.
`swarm.matrix.httpPort` and `{swarm,deploy}.matrix.openFirewall` are
removed with a message: there is no host port to choose or open. The
`.well-known/matrix/*` fallback to `<hive>:<httpPort>` is dropped with
them; it only rendered with `gatewayHost = null`, which the homeserver's
SSO assertion already rejects.
Part of #4815 .
2026-10-15 09:52:06 +02:00
agents: swap the agent's bao leaf in with one rename
2026-10-11 10:00:43 +02:00
module-eval: evaluate shared fixture configs once
2026-10-13 08:14:50 +02:00
nix: split module-eval into per-subsystem checks
2026-09-20 04:25:54 +02:00
module-eval: evaluate shared fixture configs once
2026-10-13 08:14:50 +02:00
subagent, bash: run each subagent run and bash task in its own cgroup
2026-10-13 12:25:27 +02:00
module-eval: evaluate shared fixture configs once
2026-10-13 08:14:50 +02:00
module-eval: evaluate shared fixture configs once
2026-10-13 08:14:50 +02:00
module-eval: restore agentWith in agent-queue-bao.nix
2026-10-13 14:56:25 +02:00
agents: swap the agent's bao leaf in with one rename
2026-10-11 10:00:43 +02:00
module-eval: agent-user test asserts the heal_own_dir form
2026-10-09 11:30:30 +02:00
swarm-bao-agent-pki: decide openbao's restart on the shared locale-independent compare
2026-10-13 17:00:56 +02:00
hive-matrix: run the homeserver in its own netns, behind a unix socket
2026-10-15 09:52:06 +02:00
review classifier: run on ACP when the swarm settings choose it
2026-10-14 10:14:36 +02:00
module-eval: evaluate shared fixture configs once
2026-10-13 08:14:50 +02:00
module-eval: evaluate shared fixture configs once
2026-10-13 08:14:50 +02:00
swarm-bao-pki: enabling a service mints its client leaf on the same switch
2026-10-15 08:31:33 +02:00
swarm-bao-pki: enabling a service mints its client leaf on the same switch
2026-10-15 08:31:33 +02:00
swarm-otel: scrape nats through its published name
2026-10-15 08:03:46 +02:00
swarm-otel: scrape grafana through its published name
2026-10-14 23:45:04 +02:00
hive otel: keep file_storage defined when the collector authenticates upstream
2026-10-14 10:13:58 +02:00
module-eval: evaluate shared fixture configs once
2026-10-13 08:14:50 +02:00
module-eval: assert the severity table once, not once per tier
2026-09-20 14:23:56 +02:00
authelia: a user outside a rule's group is denied instead of falling through to one_factor
2026-10-14 23:41:13 +02:00
module-eval: evaluate shared fixture configs once
2026-10-13 08:14:50 +02:00
swarm: refuse swarm.hives keys that are not valid hive identifiers
2026-10-12 21:45:50 +02:00
swarm-bao-pki: enabling a service mints its client leaf on the same switch
2026-10-15 08:31:33 +02:00
swarm-otel: scrape nats through its published name
2026-10-15 08:03:46 +02:00
glue: the secret publisher's authelia-dependent settings move out of the publisher module
2026-10-14 01:52:53 +02:00
module-eval: three duplicate nixosSystem fixtures come from shared.nix
2026-10-15 08:29:58 +02:00
swarm snapshot store: the receiver socket binds the mesh address even when wg-hive comes up after sockets.target
2026-10-15 08:27:54 +02:00
module-eval: evaluate shared fixture configs once
2026-10-13 08:14:50 +02:00
swarm-otel: scrape nats through its published name
2026-10-15 08:03:46 +02:00
hive-matrix: run the homeserver in its own netns, behind a unix socket
2026-10-15 09:52:06 +02:00
34e142bb5c