atlas
3c79c5eb5d
swarm-nats: the auth responder's store identity path is its own, not the hive's ...
glue-nats-auth-bao-identity.nix defaulted deploy.nats.authBaoClient{Cert,Key}File
to a sibling of deploy.bao.clientCertFile, which is the hive's own store
reader. That tied a swarm service to a hive identity, pointed a store host
whose reader was moved at a file nobody mints, and on a queue host without
the store that held only a placed hive reader invented a nats-auth.pem path
that passed the eval assertion and failed at runtime.
The glue is now gated on the store running on this host (deploy.bao.enable,
the condition glue-bao-tls.nix mints under) and names the directory the
minting unit writes to, shared through nix/host-modules/lib/bao-pki-dir.nix.
A queue host without the store gets no default and the eval assertion
refuses it until the responder's own leaf is named; the assertion message
now names deploy.bao.enable as where the default comes from.
On a default store host the evaluated paths are unchanged:
/var/lib/swarm-bao-pki/nats-auth{,-key}.pem.
Refs #4921
2026-10-06 10:04:30 +02:00
forge: external forge accounts live in swarm bao; the agent fetches them itself
2026-10-01 18:05:33 +02:00
github swarm bao: address argus review on #4892
2026-10-02 17:54:45 +02:00
nix: split module-eval into per-subsystem checks
2026-09-20 04:25:54 +02:00
nix: comments state current behaviour, not history
2026-10-05 09:58:50 +02:00
nix: split module-eval into per-subsystem checks
2026-09-20 04:25:54 +02:00
module-eval: assert the severity table once, not once per tier
2026-09-20 14:23:56 +02:00
nix: split module-eval into per-subsystem checks
2026-09-20 04:25:54 +02:00
hive-agent: the swarm queue connection is required; retry, then exit
2026-10-04 22:24:51 +02:00
module-eval: pin a claude agent's subagent store identity
2026-10-03 01:34:01 +02:00
agents: chown work/ recursively only on owner mismatch
2026-10-05 13:01:14 +02:00
matrix: drop the per-hive appservice and its unused token
2026-10-05 07:48:17 +02:00
swarm-controller: revoke matrix admin from former operators
2026-10-05 12:39:02 +02:00
swarm-bao: deny the secret publisher the callout xkey's seed
2026-10-05 23:25:36 +02:00
module-eval: set the hive-controller option only in tests that need a hive
2026-10-05 09:58:13 +02:00
nix: finish the current-behaviour comment sweep in touched files
2026-10-05 09:58:57 +02:00
swarm-ci-runner: run the forge CI runner as a swarm service
2026-10-05 13:55:37 +02:00
deploy: forward swarm.forge.ci to deploy.ci-runner, say what the forwarded enable needs
2026-10-05 21:36:11 +02:00
nix: comments state current behaviour, not history
2026-10-05 09:58:50 +02:00
swarm-bao: give the store's collector an explicit self-telemetry port
2026-09-23 18:04:33 +02:00
hive CA: catch a deleted CA file however its path is spelled
2026-10-05 21:17:10 +02:00
module-eval: assert the severity table once, not once per tier
2026-09-20 14:23:56 +02:00
module-eval: set the hive-controller option only in tests that need a hive
2026-10-05 09:58:13 +02:00
module-eval: set the hive-controller option only in tests that need a hive
2026-10-05 09:58:13 +02:00
nix: finish the current-behaviour comment sweep in touched files
2026-10-05 09:58:57 +02:00
swarm-nats: the auth responder's store identity path is its own, not the hive's
2026-10-06 10:04:30 +02:00
module-eval: set the hive-controller option only in tests that need a hive
2026-10-05 09:58:13 +02:00
nix: comments state current behaviour, not history
2026-10-05 09:58:50 +02:00
nix: follow-ups from the service/deploy split
2026-10-05 19:12:46 +02:00
swarm-bao: refuse a remote reader that named seven of the eight leaves
2026-09-23 10:11:42 +02:00
swarm CA: retire the host-held root CA, the store holds the only anchor
2026-10-05 21:17:10 +02:00
3c79c5eb5d