atlas
217b3f1cea
swarm-otel: scrape nats through its published name ...
The queue's metrics were scraped over loopback from the exporter, declared
only where the queue and the collector share a host, so a collector on any
other host had no job for it. Its target is now declared on every host as
`https://<swarm.nats.domain>/metrics`, and the queue's host gets a gateway
vhost on that name serving `= /metrics` from the exporter behind the
collector's auth subrequest (`/__nats_metrics_authz`, the forge's shape).
Every other path there is 403; the monitoring endpoint is never proxied.
The rules derived from `publishedScrapeTargets` admit the collector's
client and deny every other subject. The loopback entry, and with it
`glue-otel-scrape-targets.nix`, is gone.
In self-signed mode the vhost serves the queue's own `swarm-nats` leaf
(issued for exactly that name, `server_flag` set), copied 0640
root:nginx by `swarm-nats-gateway-cert`; until the leaf exists that unit
writes a throwaway pair, so nginx never starts on a missing file. The
name stays out of `swarm.serviceDomains`, so a host whose only swarm
service is the queue fronts no services name and its gateway neither
waits for nor needs the swarm-services leaf: no services-issuer pair has
to be placed on it. With ACME or an operator cert the vhost uses the
gateway's own TLS, as every other name does.
The queue's host now enables the gateway (`mkDefault`), as every other
swarm service's host does.
Fixes #5205
2026-10-15 08:03:46 +02:00
swarm-logs: authenticate as the agent with its own queue secret
2026-10-13 08:38:05 +02:00
swarm-authelia: match the metrics rules with or without a query string
2026-10-14 10:15:41 +02:00
swarm CA: describe the store's pki root as the only anchor in docs and comments
2026-10-05 21:17:10 +02:00
swarm-bao-agent-pki: decide openbao's restart on the shared locale-independent compare
2026-10-13 17:00:56 +02:00
swarm-grafana /dashboards
swarm-grafana: drop stale windows from the subscription usage line, match sibling panel interval
2026-10-07 23:54:53 +02:00
bao: disable the unused approle auth method, declaratively
2026-09-28 22:58:36 +02:00
swarm-otel: scrape nats through its published name
2026-10-15 08:03:46 +02:00
swarm builder: the all-swarm-services switch turns it on, like every other swarm service
2026-10-15 05:44:37 +02:00
grafana: mint the admin password into the store and apply it on every start
2026-10-12 15:16:53 +02:00
glue: consumers' start-after-bao ordering moves into one glue module
2026-10-13 22:05:16 +02:00
swarm-builder: build each agent config PR head and post a commit status
2026-10-14 03:30:46 +02:00
bao: OIDC login to the browser UI via authelia, as a metadata-only viewer
2026-09-28 19:56:38 +02:00
swarm-builder: build each agent config PR head and post a commit status
2026-10-14 03:30:46 +02:00
nix: gate hive-c0re on deploy.hive-controller.enable, drop hyperhive.enable
2026-09-26 01:19:49 +02:00
glue: the controller's authelia and otel environment moves out of the controller module
2026-10-14 10:15:29 +02:00
glue: the controller's authelia and otel environment moves out of the controller module
2026-10-14 10:15:29 +02:00
glue: forge's controller-dependent settings move out of the forge module
2026-10-13 22:14:28 +02:00
nix: gate hive-c0re on deploy.hive-controller.enable, drop hyperhive.enable
2026-09-26 01:19:49 +02:00
nix: gate hive-c0re on deploy.hive-controller.enable, drop hyperhive.enable
2026-09-26 01:19:49 +02:00
glue: hive-otel's ordering after authelia moves out of the otel module
2026-10-13 22:04:52 +02:00
hive-tls: the gateway leaf uses the services-issuer identity, not a hive's
2026-10-06 14:54:07 +02:00
swarm-logs-auth: check agent tokens on the log store's query route
2026-10-13 08:38:05 +02:00
swarm-nats, matrix: the queue's and matrix-ctl's store identity paths are their own, not the hive's
2026-10-06 12:04:48 +02:00
swarm: OIDC clients registered wherever authelia runs; nats + matrix secrets from bao
2026-10-05 09:58:02 +02:00
swarm-nats: the auth responder's store identity path is its own, not the hive's
2026-10-06 10:04:30 +02:00
swarm-nats, matrix: the queue's and matrix-ctl's store identity paths are their own, not the hive's
2026-10-06 12:04:48 +02:00
swarm: OIDC clients registered wherever authelia runs; nats + matrix secrets from bao
2026-10-05 09:58:02 +02:00
glue: nats firewall on the wireguard interface moves out of the nats module
2026-10-14 10:15:19 +02:00
swarm-bao-pki: sign every other hive's three store leaves
2026-10-12 21:41:28 +02:00
nix: run the review classifier in a container of its own when a host enables it
2026-10-12 13:11:21 +02:00
glue: the secret publisher's authelia-dependent settings move out of the publisher module
2026-10-14 01:52:53 +02:00
nix: gate hive-c0re on deploy.hive-controller.enable, drop hyperhive.enable
2026-09-26 01:19:49 +02:00
ops: update option pointers after grafana/bao split
2026-10-01 09:53:04 +02:00
ops: update option pointers after otel split
2026-10-01 13:00:40 +02:00
swarm-controller: revoke matrix admin from former operators
2026-10-05 12:39:02 +02:00
glue: consumers' start-after-bao ordering moves into one glue module
2026-10-13 22:05:16 +02:00
nix: run swarm-ui wherever swarm-controller runs
2026-10-13 20:05:19 +02:00
swarm-ci-runner: run the forge CI runner as a swarm service
2026-10-05 13:55:37 +02:00
hive-tls: the root fetch presents the hive identity, as on main
2026-10-06 14:54:07 +02:00
hive CA: catch a deleted CA file however its path is spelled
2026-10-05 21:17:10 +02:00
nix: finish the current-behaviour comment sweep in touched files
2026-10-05 09:58:57 +02:00
swarm-nats: take the callout issuer and user keys from the store
2026-10-06 14:53:33 +02:00
nats-callout-removed: remove the container's OIDC secret copy here, ungated
2026-10-06 15:25:29 +02:00
hive otel: keep file_storage defined when the collector authenticates upstream
2026-10-14 10:13:58 +02:00
swarm-ui: apply the operator's stylix theme, same as the dashboard already does
2026-08-24 14:28:25 +02:00
swarm-otel: scrape authelia through its published name
2026-10-14 10:15:41 +02:00
authelia: render the swarm apex's operator rules wherever authelia runs
2026-10-14 23:41:13 +02:00
nix: split swarm-bao into service and deploy-mode files
2026-10-01 09:37:36 +02:00
glue: the controller's authelia and otel environment moves out of the controller module
2026-10-14 10:15:29 +02:00
swarm builder: the all-swarm-services switch turns it on, like every other swarm service
2026-10-15 05:44:37 +02:00
glue: consumers' start-after-bao ordering moves into one glue module
2026-10-13 22:05:16 +02:00
swarmctl: on a controller host, trust the swarm's root without SWARMCTL_CA_FILE
2026-10-14 12:49:16 +02:00
swarm-otel: scrape grafana through its published name
2026-10-14 23:45:04 +02:00
swarm-otel: scrape grafana through its published name
2026-10-14 23:45:04 +02:00
swarm-otel: scrape nats through its published name
2026-10-15 08:03:46 +02:00
swarm-otel: scrape nats through its published name
2026-10-15 08:03:46 +02:00
swarm-otel: scrape nats through its published name
2026-10-15 08:03:46 +02:00
swarm-victoriametrics: own network namespace, gateway over a unix socket
2026-10-14 18:15:20 +02:00
swarm CA: retire the host-held root CA, the store holds the only anchor
2026-10-05 21:17:10 +02:00
swarm builder: the all-swarm-services switch turns it on, like every other swarm service
2026-10-15 05:44:37 +02:00
review classifier: run on ACP when the swarm settings choose it
2026-10-14 10:14:36 +02:00
swarm-builder: build each agent config PR head and post a commit status
2026-10-14 03:30:46 +02:00
deploy: move the wireguard mesh out of the namespace hives read
2026-09-07 14:24:52 +02:00
swarm-ui: name the group the operator rule actually requires
2026-10-14 23:41:13 +02:00
nix: split swarm-victorialogs into service and deploy-mode files
2026-10-01 10:03:55 +02:00
swarm-victoriametrics: own network namespace, gateway over a unix socket
2026-10-14 18:15:20 +02:00
swarm-victoriametrics: own network namespace, gateway over a unix socket
2026-10-14 18:15:20 +02:00
swarm-victoriametrics: require 1.153.0, carry the history off the DynamicUser path
2026-10-14 18:15:20 +02:00
swarm options: no swarm.* value depends on a deploy option or this host's hive
2026-10-04 18:13:47 +02:00
swarm-otel: scrape nats through its published name
2026-10-15 08:03:46 +02:00
217b3f1cea