atlas
962c1548eb
swarm-controller: revoke matrix admin from former operators ...
The operator admin sync now also takes homeserver admin away. It records
each user id it sends `make-user-admin` for in
`operator-matrix-admins.json` under the controller's state directory
(written to a temporary file and renamed over it; a missing file is an
empty set). On each pass, a recorded account that is no longer in
authelia's `admins` group but is still joined to `#admins:<server>` is
sent `!admin users force-leave-room <user> <admin room id>` as `@swarm`,
over the same `/_matrix` path the grant uses. Leaving that room is what
ends tuwunel admin.
It never revokes an admin it didn't grant, `@swarm`, tuwunel's server
user (`@conduit:<server>`), an agent's account (the store's
`hive-agent-*` cert roles, the same roster the agent account mint uses),
or anyone in the new `services.hyperhive.swarm.matrix.adminSync.ignoreUsers`
list. That list reaches the daemon as
`SWARM_CONTROLLER_MATRIX_ADMIN_SYNC_IGNORE_USERS`. It also never sends a
revoke that would leave `#admins` with no member besides `@swarm` and the
server user.
A revoke is sent at most once per account per controller process, like a
grant. A recorded account that is out of both the group and the room is
dropped from the file.
Closes #4799
2026-10-05 12:39:02 +02:00
nix: comments state current behaviour, not history
2026-10-05 09:58:50 +02:00
nix: leave unit-script comments untouched outside swarm-bao-pki
2026-10-05 09:59:05 +02:00
nix: finish the current-behaviour comment sweep in touched files
2026-10-05 09:58:57 +02:00
nix: comments state current behaviour, not history
2026-10-05 09:58:50 +02:00
swarm-grafana /dashboards
hive-agent: export ACP-reported cost and context fill over OTLP
2026-09-30 22:24:06 +02:00
bao: disable the unused approle auth method, declaratively
2026-09-28 22:58:36 +02:00
swarm: OIDC clients registered wherever authelia runs; nats + matrix secrets from bao
2026-10-05 09:58:02 +02:00
nix: finish the current-behaviour comment sweep in touched files
2026-10-05 09:58:57 +02:00
swarm: OIDC clients registered wherever authelia runs; nats + matrix secrets from bao
2026-10-05 09:58:02 +02:00
nix: finish the current-behaviour comment sweep in touched files
2026-10-05 09:58:57 +02:00
bao: OIDC login to the browser UI via authelia, as a metadata-only viewer
2026-09-28 19:56:38 +02:00
nix: gate hive-c0re on deploy.hive-controller.enable, drop hyperhive.enable
2026-09-26 01:19:49 +02:00
swarm: OIDC clients registered wherever authelia runs; nats + matrix secrets from bao
2026-10-05 09:58:02 +02:00
nix: gate hive-c0re on deploy.hive-controller.enable, drop hyperhive.enable
2026-09-26 01:19:49 +02:00
nix: gate hive-c0re on deploy.hive-controller.enable, drop hyperhive.enable
2026-09-26 01:19:49 +02:00
hive-tls: a store-only host without a hive starts its gateway with the store sealed
2026-10-04 19:45:14 +02:00
nix: gate hive-c0re on deploy.hive-controller.enable, drop hyperhive.enable
2026-09-26 01:19:49 +02:00
swarm: OIDC clients registered wherever authelia runs; nats + matrix secrets from bao
2026-10-05 09:58:02 +02:00
module-eval: set the hive-controller option only in tests that need a hive
2026-10-05 09:58:13 +02:00
nix: gate hive-c0re on deploy.hive-controller.enable, drop hyperhive.enable
2026-09-26 01:19:49 +02:00
swarm: OIDC clients registered wherever authelia runs; nats + matrix secrets from bao
2026-10-05 09:58:02 +02:00
nix: comments state current behaviour, not history
2026-10-05 09:58:50 +02:00
nix: gate hive-c0re on deploy.hive-controller.enable, drop hyperhive.enable
2026-09-26 01:19:49 +02:00
nix: gate hive-c0re on deploy.hive-controller.enable, drop hyperhive.enable
2026-09-26 01:19:49 +02:00
ops: update option pointers after grafana/bao split
2026-10-01 09:53:04 +02:00
ops: update option pointers after otel split
2026-10-01 13:00:40 +02:00
nix: finish the current-behaviour comment sweep in touched files
2026-10-05 09:58:57 +02:00
swarm-controller: revoke matrix admin from former operators
2026-10-05 12:39:02 +02:00
nix: comments state current behaviour, not history
2026-10-05 09:58:50 +02:00
fix(nix): require swarm domain only when a hyperhive service is enabled
2026-10-02 13:09:45 +02:00
hive-priv: create agent socket dirs on start; drop hyperhive-agents.conf
2026-09-27 18:55:33 +02:00
nix: leave unit-script comments untouched outside swarm-bao-pki
2026-10-05 09:59:05 +02:00
nix: finish the current-behaviour comment sweep in touched files
2026-10-05 09:58:57 +02:00
swarm-controller: read the queue client secret from the store, drop the file
2026-09-28 19:01:05 +02:00
nix: comments state current behaviour, not history
2026-10-05 09:58:50 +02:00
swarm-ui: apply the operator's stylix theme, same as the dashboard already does
2026-08-24 14:28:25 +02:00
nix: finish the current-behaviour comment sweep in touched files
2026-10-05 09:58:57 +02:00
nix: comments state current behaviour, not history
2026-10-05 09:58:50 +02:00
nix: split swarm-bao into service and deploy-mode files
2026-10-01 09:37:36 +02:00
nix: finish the current-behaviour comment sweep in touched files
2026-10-05 09:58:57 +02:00
nix: comments state current behaviour, not history
2026-10-05 09:58:50 +02:00
swarm-controller: revoke matrix admin from former operators
2026-10-05 12:39:02 +02:00
nix: finish the "moved to" comment sweep
2026-10-05 09:59:02 +02:00
nix: finish the current-behaviour comment sweep in touched files
2026-10-05 09:58:57 +02:00
nix: finish the "moved to" comment sweep
2026-10-05 09:59:02 +02:00
nix: finish the current-behaviour comment sweep in touched files
2026-10-05 09:58:57 +02:00
nix: finish the current-behaviour comment sweep in touched files
2026-10-05 09:58:57 +02:00
nix: finish the current-behaviour comment sweep in touched files
2026-10-05 09:58:57 +02:00
nix: comments state current behaviour, not history
2026-10-05 09:58:50 +02:00
nix: run the forge on one host per swarm (deploy.forgejo.enable)
2026-09-24 23:56:07 +02:00
swarm: OIDC clients registered wherever authelia runs; nats + matrix secrets from bao
2026-10-05 09:58:02 +02:00
deploy: move the wireguard mesh out of the namespace hives read
2026-09-07 14:24:52 +02:00
nix: finish the current-behaviour comment sweep in touched files
2026-10-05 09:58:57 +02:00
nix: split swarm-victorialogs into service and deploy-mode files
2026-10-01 10:03:55 +02:00
nix: comments state current behaviour, not history
2026-10-05 09:58:50 +02:00
nix: split swarm-victoriametrics into service and deploy-mode files
2026-10-01 10:03:55 +02:00
swarm-ui: build the forge link from swarm.forge.domain
2026-10-02 20:02:02 +02:00
swarm options: no swarm.* value depends on a deploy option or this host's hive
2026-10-04 18:13:47 +02:00
nix: finish the current-behaviour comment sweep in touched files
2026-10-05 09:58:57 +02:00
962c1548eb