atlas
d5de1e4943
swarm UI: log an agent into claude from its card; the credentials go to bao and the agent picks them up ...
A new swarm service, `swarm-claude-login`, in its own container on the host
that sets `deploy.claude-login.enable` (defaulted on by `allSwarmServices`
where the host has the minter's store leaf, like the review classifier).
- swarm-ui: an agent card showing "login needed" gets a "log in" button.
Its dialog starts the login, shows the URL claude printed, and takes the
pasted code.
- swarm-controller: `POST/DELETE /api/agents/{name}/claude-login` and
`POST /api/agents/{name}/claude-login/code`, behind the swarm UI's
authelia-gated `/api/`, relay the steps to the minter as requests on
`$SWARM.claude-login.request`.
- swarm-claude-login: runs `claude auth login` over piped stdio with HOME
and CLAUDE_CONFIG_DIR in a per-login scratch dir, scrapes the first
https URL, writes the code to stdin, and stores the `.credentials.json`
at `swarm/agents/<agent>/claude-credentials` with a KV v2 write, a new
version over any earlier one. The scratch dir goes on every exit path; a
login waits 15 minutes for its code.
- hive-agent: while parked in `wait_for_login`, reads that leaf every 30 s
under the agent's own cert and installs it only when its KV version is
newer than the one recorded in `<harness>/claude-credentials-version`.
An equal or older version is never put back, because claude rotates the
refresh token and the stored copy is stale after the first refresh.
- swarm-secret-client: `claude_login` paths and `SecretStore::read_versioned`.
- Credentials: a `claude-login` store leaf minted by glue-bao-tls, a
`swarm-claude-login` policy (create/update on
`swarm/agents/+/claude-credentials`, read on its own queue client
secret), an authelia machine client, and a `--claude-login-client`
grant in the queue's auth-callout responder. The unit runs as a static
system user.
The hive's own web-UI login is unchanged.
Refs #5268
2026-10-15 13:26:29 +02:00
swarm-logs: authenticate as the agent with its own queue secret
2026-10-13 08:38:05 +02:00
CI and devshell comments say what the config does: jobTimeout bounds jobs, coverage runs nightly, dead timeout keys removed
2026-10-15 08:27:32 +02:00
hive-matrix: run the homeserver in its own netns, behind a unix socket
2026-10-15 09:52:06 +02:00
swarm-bao-agent-pki: decide openbao's restart on the shared locale-independent compare
2026-10-13 17:00:56 +02:00
swarm-grafana /dashboards
swarm-grafana: drop stale windows from the subscription usage line, match sibling panel interval
2026-10-07 23:54:53 +02:00
bao: disable the unused approle auth method, declaratively
2026-09-28 22:58:36 +02:00
swarm UI: log an agent into claude from its card; the credentials go to bao and the agent picks them up
2026-10-15 13:26:29 +02:00
swarm UI: log an agent into claude from its card; the credentials go to bao and the agent picks them up
2026-10-15 13:26:29 +02:00
swarm metrics store: the read API needs Grafana's bearer or an operator session
2026-10-15 10:48:20 +02:00
swarm metrics store: the read API needs Grafana's bearer or an operator session
2026-10-15 10:48:20 +02:00
swarm UI: log an agent into claude from its card; the credentials go to bao and the agent picks them up
2026-10-15 13:26:29 +02:00
bao: OIDC login to the browser UI via authelia, as a metadata-only viewer
2026-09-28 19:56:38 +02:00
swarm-builder: build each agent config PR head and post a commit status
2026-10-14 03:30:46 +02:00
swarm UI: log an agent into claude from its card; the credentials go to bao and the agent picks them up
2026-10-15 13:26:29 +02:00
nix: gate hive-c0re on deploy.hive-controller.enable, drop hyperhive.enable
2026-09-26 01:19:49 +02:00
glue: the controller's authelia and otel environment moves out of the controller module
2026-10-14 10:15:29 +02:00
glue: the controller's authelia and otel environment moves out of the controller module
2026-10-14 10:15:29 +02:00
glue: forge's controller-dependent settings move out of the forge module
2026-10-13 22:14:28 +02:00
nix: gate hive-c0re on deploy.hive-controller.enable, drop hyperhive.enable
2026-09-26 01:19:49 +02:00
nix: gate hive-c0re on deploy.hive-controller.enable, drop hyperhive.enable
2026-09-26 01:19:49 +02:00
glue: hive-otel's ordering after authelia moves out of the otel module
2026-10-13 22:04:52 +02:00
hive-tls: the gateway leaf uses the services-issuer identity, not a hive's
2026-10-06 14:54:07 +02:00
swarm-logs-auth: check agent tokens on the log store's query route
2026-10-13 08:38:05 +02:00
swarm-nats, matrix: the queue's and matrix-ctl's store identity paths are their own, not the hive's
2026-10-06 12:04:48 +02:00
swarm: OIDC clients registered wherever authelia runs; nats + matrix secrets from bao
2026-10-05 09:58:02 +02:00
swarm metrics store: the read API needs Grafana's bearer or an operator session
2026-10-15 10:48:20 +02:00
swarm-nats: the auth responder's store identity path is its own, not the hive's
2026-10-06 10:04:30 +02:00
swarm-nats, matrix: the queue's and matrix-ctl's store identity paths are their own, not the hive's
2026-10-06 12:04:48 +02:00
swarm: OIDC clients registered wherever authelia runs; nats + matrix secrets from bao
2026-10-05 09:58:02 +02:00
glue: nats firewall on the wireguard interface moves out of the nats module
2026-10-14 10:15:19 +02:00
swarm-bao-pki: sign every other hive's three store leaves
2026-10-12 21:41:28 +02:00
nix: run the review classifier in a container of its own when a host enables it
2026-10-12 13:11:21 +02:00
glue: the secret publisher's authelia-dependent settings move out of the publisher module
2026-10-14 01:52:53 +02:00
nix: gate hive-c0re on deploy.hive-controller.enable, drop hyperhive.enable
2026-09-26 01:19:49 +02:00
ops: update option pointers after grafana/bao split
2026-10-01 09:53:04 +02:00
ops: update option pointers after otel split
2026-10-01 13:00:40 +02:00
hive-matrix: run the homeserver in its own netns, behind a unix socket
2026-10-15 09:52:06 +02:00
hive-matrix: run the homeserver in its own netns, behind a unix socket
2026-10-15 09:52:06 +02:00
nix: run swarm-ui wherever swarm-controller runs
2026-10-13 20:05:19 +02:00
swarm-ci-runner: run the forge CI runner as a swarm service
2026-10-05 13:55:37 +02:00
hive-tls: bound each store attempt so a silent store fails into a retry
2026-10-15 11:21:47 +02:00
hive CA: catch a deleted CA file however its path is spelled
2026-10-05 21:17:10 +02:00
nix: finish the current-behaviour comment sweep in touched files
2026-10-05 09:58:57 +02:00
swarm-nats: take the callout issuer and user keys from the store
2026-10-06 14:53:33 +02:00
nats-callout-removed: remove the container's OIDC secret copy here, ungated
2026-10-06 15:25:29 +02:00
hive otel: keep file_storage defined when the collector authenticates upstream
2026-10-14 10:13:58 +02:00
swarm-ui: apply the operator's stylix theme, same as the dashboard already does
2026-08-24 14:28:25 +02:00
hive-matrix: run the homeserver in its own netns, behind a unix socket
2026-10-15 09:52:06 +02:00
swarm metrics store: the read API needs Grafana's bearer or an operator session
2026-10-15 10:48:20 +02:00
nix: split swarm-bao into service and deploy-mode files
2026-10-01 09:37:36 +02:00
swarm UI: log an agent into claude from its card; the credentials go to bao and the agent picks them up
2026-10-15 13:26:29 +02:00
swarm-bao-pki: enabling a service mints its client leaf on the same switch
2026-10-15 08:31:33 +02:00
glue: consumers' start-after-bao ordering moves into one glue module
2026-10-13 22:05:16 +02:00
swarm UI: log an agent into claude from its card; the credentials go to bao and the agent picks them up
2026-10-15 13:26:29 +02:00
swarmctl: on a controller host, trust the swarm's root without SWARMCTL_CA_FILE
2026-10-14 12:49:16 +02:00
swarm-otel: scrape grafana through its published name
2026-10-14 23:45:04 +02:00
swarm metrics store: the read API needs Grafana's bearer or an operator session
2026-10-15 10:48:20 +02:00
hive-matrix: run the homeserver in its own netns, behind a unix socket
2026-10-15 09:52:06 +02:00
swarm UI: log an agent into claude from its card; the credentials go to bao and the agent picks them up
2026-10-15 13:26:29 +02:00
swarm-otel: scrape nats through its published name
2026-10-15 08:03:46 +02:00
swarm-victoriametrics: own network namespace, gateway over a unix socket
2026-10-14 18:15:20 +02:00
swarm CA: retire the host-held root CA, the store holds the only anchor
2026-10-05 21:17:10 +02:00
swarm UI: log an agent into claude from its card; the credentials go to bao and the agent picks them up
2026-10-15 13:26:29 +02:00
swarm-bao-pki: enabling a service mints its client leaf on the same switch
2026-10-15 08:31:33 +02:00
swarm UI: log an agent into claude from its card; the credentials go to bao and the agent picks them up
2026-10-15 13:26:29 +02:00
swarm snapshot store: the receiver socket binds the mesh address even when wg-hive comes up after sockets.target
2026-10-15 08:27:54 +02:00
swarm-ui: name the group the operator rule actually requires
2026-10-14 23:41:13 +02:00
CI and devshell comments say what the config does: jobTimeout bounds jobs, coverage runs nightly, dead timeout keys removed
2026-10-15 08:27:32 +02:00
swarm-victoriametrics: own network namespace, gateway over a unix socket
2026-10-14 18:15:20 +02:00
swarm-victoriametrics: own network namespace, gateway over a unix socket
2026-10-14 18:15:20 +02:00
swarm metrics store: the read API needs Grafana's bearer or an operator session
2026-10-15 10:48:20 +02:00
swarm options: no swarm.* value depends on a deploy option or this host's hive
2026-10-04 18:13:47 +02:00
swarm UI: log an agent into claude from its card; the credentials go to bao and the agent picks them up
2026-10-15 13:26:29 +02:00
d5de1e4943