atlas
4152000a3b
hive-ci: run the runner credential precondition with full privileges ...
The token file is 0600 root-owned and the precondition ran as the unit's
dynamic gitea-runner user, so it could not read it -- and it did not fail
closed. `[ -s ]` succeeds on a stat alone, grep then died with EACCES,
and `! grep` turned that error into true, so the gate exited 0 on a file
it had never read. It has reported 'a real token is present' without
looking for its entire existence, which is why the runner kept retrying
instead of holding still and saying why.
Prefix the step with + so it runs with full privileges. This grants the
runner nothing new: tokenFile becomes EnvironmentFile=, which systemd
already reads as root before dropping privileges, so the payload never
passes through an unprivileged reader either way -- the + only lets the
gate observe what systemd observes.
Also assert readability separately and loudly, rather than folding it
into the placeholder test: an unreadable file and a real token produced
the same verdict, so 'I could not look' was indistinguishable from 'I
looked and it is fine'.
2026-08-26 22:47:31 +02:00
swarm-otel: collect only the units the swarm's services declare
2026-08-24 22:05:45 +02:00
forge, matrix: SSO is not optional
2026-08-24 23:06:25 +02:00
swarm-otel: collect only the units the swarm's services declare
2026-08-24 22:05:45 +02:00
fix( #3527 ): a missing source must report as zero, not as empty
2026-08-19 20:27:00 +02:00
swarm-grafana /dashboards
swarm-grafana: provision log store and metrics store dashboards
2026-08-26 21:37:31 +02:00
feat(swarm-victorialogs): a log store for the swarm
2026-08-24 16:36:18 +02:00
hive-ci: run the runner credential precondition with full privileges
2026-08-26 22:47:31 +02:00
forge, matrix: SSO is not optional
2026-08-24 23:06:25 +02:00
docs(network): drop the otel reasoning instead of restating it
2026-08-19 02:04:57 +02:00
fix( #2573 ): also add /etc/tmpfiles.d to hive-priv ReadWritePaths (same EROFS class)
2026-07-18 16:39:20 +02:00
fix( #3462 ): apply the name check in the unit that runs on the deploy
2026-08-18 21:54:38 +02:00
refactor(nix): a hive's domain comes out of the swarm directory
2026-08-05 22:43:17 +02:00
fix( #3343 ): move the all-local queue derivations into the deployment mode
2026-08-16 19:37:49 +02:00
otel: say which of processes/process is configured
2026-08-26 18:34:44 +02:00
swarm-ui: apply the operator's stylix theme, same as the dashboard already does
2026-08-24 14:28:25 +02:00
swarm-authelia: collect the journal of the unit that actually runs
2026-08-26 01:06:50 +02:00
swarm-otel: collect only the units the swarm's services declare
2026-08-24 22:05:45 +02:00
fix( #3363 ): swarm containers write their own resolver file
2026-08-17 17:30:15 +02:00
swarm-otel: collect only the units the swarm's services declare
2026-08-24 22:05:45 +02:00
swarm-grafana: provision log store and metrics store dashboards
2026-08-26 21:37:31 +02:00
swarm-nats: manual callout needs all four keys, not two
2026-08-24 23:06:59 +02:00
swarm-otel: request the bearer-authz scope on the metrics scrape
2026-08-26 18:34:21 +02:00
docs+nix: fix stale certFingerprint/HYPERHIVE_PEERS references (hyperhive#3294)
2026-08-15 19:56:11 +02:00
feat(swarm): start the log store with the other required services
2026-08-24 17:00:38 +02:00
refactor( #2862 ): keep the option at services.hyperhive.snapshotStore
2026-07-31 19:03:24 +02:00
swarm-ui: swap colors.css via a plain nginx location, not a package-copy derivation
2026-08-24 14:28:25 +02:00
swarm-otel: collect only the units the swarm's services declare
2026-08-24 22:05:45 +02:00
swarm-otel: collect only the units the swarm's services declare
2026-08-24 22:05:45 +02:00
docs+nix: fix stale certFingerprint/HYPERHIVE_PEERS references (hyperhive#3294)
2026-08-15 19:56:11 +02:00
swarm: publish an authenticated gateway vhost for VictoriaLogs
2026-08-24 18:43:26 +02:00
4152000a3b