atlas
6630a51022
trust the swarm services ca in swarm-ci-metrics ...
The poller's forge, authelia and collector calls go to leaves issued by
the swarm's own CA, and its reqwest/rustls roots come from SSL_CERT_FILE,
which the unit never set. Every pass since it was deployed fails
"invalid peer certificate: UnknownIssuer" before pushing, so the CI runs
dashboard has no hyperhive.ci.run.* samples (#5438 ).
- nix/host-modules/swarm-ci-metrics.nix: import lib/hive-ca-trust.nix and
register a host trustBundle for the unit, as swarm-controller does; it
adds swarm-ci-metrics-ca-bundle.service and sets SSL_CERT_FILE.
- nix/module-eval/ci-metrics.nix: a case asserting the unit's
SSL_CERT_FILE is its bundle path when self-signed, with the bundle
unit's ordering, and absent where the poller is off.
- docs/swarm/ci-metrics.md: how the poller trusts the swarm's CA.
2026-10-17 23:28:03 +02:00
module-eval: restore seven zero-cost literal-pin cases
2026-10-17 08:00:29 +02:00
module-eval: restore seven zero-cost literal-pin cases
2026-10-17 08:00:29 +02:00
nix: split module-eval into per-subsystem checks
2026-09-20 04:25:54 +02:00
module-eval: evaluate shared fixture configs once
2026-10-13 08:14:50 +02:00
subagent, bash: run each subagent run and bash task in its own cgroup
2026-10-13 12:25:27 +02:00
remove otel.metricIntervalMs and the host-level otel.debug
2026-10-17 08:00:14 +02:00
module-eval: drop 18 redundant cases and merge assertion-only hosts
2026-10-17 08:00:29 +02:00
add swarm-metrics, an agent CLI for the metrics store
2026-10-17 10:10:17 +02:00
module-eval: drop 18 redundant cases and merge assertion-only hosts
2026-10-17 08:00:29 +02:00
module-eval: restore seven zero-cost literal-pin cases
2026-10-17 08:00:29 +02:00
hive-tls owns the per-host list of locally fronted service domains
2026-10-17 23:26:53 +02:00
module-eval: drop 18 redundant cases and merge assertion-only hosts
2026-10-17 08:00:29 +02:00
swarm-bao: the agent-token checkers' cert roles issue batch tokens
2026-10-17 16:28:27 +02:00
module-eval: drop 18 redundant cases and merge assertion-only hosts
2026-10-17 08:00:29 +02:00
make bao readers want swarm-bao-pki and drop its start limit
2026-10-16 18:29:38 +02:00
archetypes: build an archetype agent from its archetype's module on the hive
2026-10-17 16:27:21 +02:00
trust the swarm services ca in swarm-ci-metrics
2026-10-17 23:28:03 +02:00
hive-tls owns the per-host list of locally fronted service domains
2026-10-17 23:26:53 +02:00
drop option renames and removals older than two weeks
2026-10-16 22:04:57 +02:00
grafana: forward the host env to the logs datasource plugin
2026-10-16 23:20:16 +02:00
swarm-authelia: run the secret publisher and a journal forwarder inside the container
2026-10-17 00:28:16 +02:00
hive-tls owns the per-host list of locally fronted service domains
2026-10-17 23:26:53 +02:00
module-eval: assert the severity table once, not once per tier
2026-09-20 14:23:56 +02:00
share the flake's pkgs in host module-eval fixtures
2026-10-17 12:31:57 +02:00
move the hive's vhosts and matrix discovery out of the gateway
2026-10-17 15:07:33 +02:00
module-eval: drop 18 redundant cases and merge assertion-only hosts
2026-10-17 08:00:29 +02:00
module-eval: restore seven zero-cost literal-pin cases
2026-10-17 08:00:29 +02:00
hive-tls owns the per-host list of locally fronted service domains
2026-10-17 23:26:53 +02:00
swarm-authelia: run the secret publisher and a journal forwarder inside the container
2026-10-17 00:28:16 +02:00
victorialogs and victoriametrics: own the package for each auth responder they run
2026-10-17 18:38:25 +02:00
module-eval: restore seven zero-cost literal-pin cases
2026-10-17 08:00:29 +02:00
swarm-otel: keep the collector's OIDC secret on the host's /run, not in the container's root
2026-10-15 21:45:48 +02:00
authelia: allow only the collector to write to the log store's ingest path
2026-10-17 14:51:35 +02:00
hive-tls owns the per-host list of locally fronted service domains
2026-10-17 23:26:53 +02:00
6630a51022