atlas
40557ffb74
fix( #3527 ): count the hive half, not the assembled bundle ...
The guard inspected the assembled file for any certificate. The system
store always holds certificates, so it passed unconditionally — including
in the one case it was written to catch, where the hive CA half
contributed nothing.
That half is the only one that matters here: every name these consumers
verify is issued by our own CA, so a bundle of nothing but public CAs is,
for this purpose, an empty bundle that measures as full. The failure is
silent and total — the unit reports success and every egress TLS call to
a swarm service then fails.
Counts the source on its own before assembling, and checks the result
carries what both halves brought, so a source truncated between the count
and the copy is caught too.
Scope is stated at the guard: it proves the anchor was contributed, not
that it is usable. A consumer reading only the first certificate ignores
it regardless, which is what took the swarm collector down, and no check
on this file can see that. Only a handshake can.
2026-08-19 20:16:16 +02:00
fix(otel): let the SDK resolve hive-c0re's OTLP endpoint
2026-08-19 01:38:54 +02:00
fix( #3500 ): make the swarm-controller forge account a site admin
2026-08-19 17:13:54 +02:00
docs+nix: fix stale certFingerprint/HYPERHIVE_PEERS references (hyperhive#3294)
2026-08-15 19:56:11 +02:00
fix( #3527 ): count the hive half, not the assembled bundle
2026-08-19 20:16:16 +02:00
feat( #3125 ): a swarm-tier OTEL collector, in its own container
2026-08-18 21:02:18 +02:00
feat(nix): move the forge host options under services.hyperhive.swarm
2026-08-05 03:44:53 +02:00
feat( #3162 ): warn when a hive with an existing homeserver has not pinned serverName
2026-08-18 12:29:31 +02:00
docs(network): drop the otel reasoning instead of restating it
2026-08-19 02:04:57 +02:00
fix( #2573 ): also add /etc/tmpfiles.d to hive-priv ReadWritePaths (same EROFS class)
2026-07-18 16:39:20 +02:00
fix( #3462 ): apply the name check in the unit that runs on the deploy
2026-08-18 21:54:38 +02:00
refactor(nix): a hive's domain comes out of the swarm directory
2026-08-05 22:43:17 +02:00
fix( #3343 ): move the all-local queue derivations into the deployment mode
2026-08-16 19:37:49 +02:00
otel: wait for the telemetry client secret instead of racing it
2026-08-19 15:34:40 +02:00
swarm-authelia: give each hive client an audience and JWT access tokens
2026-08-19 15:27:09 +02:00
fix(nix): a missing swarm-services leaf must not kill the whole gateway
2026-08-06 00:30:22 +02:00
fix( #3363 ): swarm containers write their own resolver file
2026-08-17 17:30:15 +02:00
swarm-ui: show the swarm's name as the page title and top-left brand
2026-08-18 18:34:56 +02:00
fix( #3471 ): keep Metrics Drilldown, which declarativePlugins had silently removed
2026-08-18 22:40:59 +02:00
fix( #3363 ): give the queue's auth responder the hive CA
2026-08-17 19:57:44 +02:00
fix( #3524 ): stop naming the trust bundle as the oidc issuer anchor
2026-08-19 18:23:42 +02:00
docs+nix: fix stale certFingerprint/HYPERHIVE_PEERS references (hyperhive#3294)
2026-08-15 19:56:11 +02:00
feat( #3125 ): reshape the hive-to-swarm OTEL hop by domain
2026-08-18 21:02:18 +02:00
refactor( #2862 ): keep the option at services.hyperhive.snapshotStore
2026-07-31 19:03:24 +02:00
feat( #3255 ): expose the controller's webhook endpoint through the swarm vhost
2026-08-18 12:28:09 +02:00
fix( #3363 ): swarm containers write their own resolver file
2026-08-17 17:30:15 +02:00
docs+nix: fix stale certFingerprint/HYPERHIVE_PEERS references (hyperhive#3294)
2026-08-15 19:56:11 +02:00
fix( #3462 ): the swarm-services leaf never covered grafana, metrics or otel
2026-08-18 21:54:38 +02:00
40557ffb74