atlas
4e5a642928
hive CA: delete ca.pem, ca-previous.pem and ca-key.pem, the bundle is the store's root ...
The gateway leaf comes from the store's pki mount, so a hive CA's
certificates anchor nothing and its key is a secret outside the store.
- hive-tls-ca writes trust-bundle.pem from swarm-services-root.pem alone;
the ca.pem and ca-previous.pem slots are gone.
- Every host deletes ca.pem, ca-previous.pem and ca-key.pem in
deploy.hive-controller.tls.stateDir with tmpfiles `r` rules that follow
the option. The removal shim, now host-ca-removed.nix, holds these
beside the /var/lib/swarm-ca rule and the swarm.ca.* removals.
- deploy.bao.clientCaFile, deploy.bao.serverCaFile and
deploy.swarm-controller.hiveClientCaFile naming /var/lib/swarm-ca or one
of the deleted hive CA files fail evaluation, naming the store's mTLS CA
(/var/lib/swarm-bao-pki/ca.pem on the store's host) as the replacement.
module-eval hive-tls covers the single-anchor bundle, the deletion (incl.
a relocated stateDir) and the assertion on all three options.
Refs #4588
2026-10-05 21:17:10 +02:00
forge: external forge accounts live in swarm bao; the agent fetches them itself
2026-10-01 18:05:33 +02:00
github swarm bao: address argus review on #4892
2026-10-02 17:54:45 +02:00
nix: split module-eval into per-subsystem checks
2026-09-20 04:25:54 +02:00
nix: comments state current behaviour, not history
2026-10-05 09:58:50 +02:00
nix: split module-eval into per-subsystem checks
2026-09-20 04:25:54 +02:00
module-eval: assert the severity table once, not once per tier
2026-09-20 14:23:56 +02:00
nix: split module-eval into per-subsystem checks
2026-09-20 04:25:54 +02:00
hive-agent: the swarm queue connection is required; retry, then exit
2026-10-04 22:24:51 +02:00
module-eval: pin a claude agent's subagent store identity
2026-10-03 01:34:01 +02:00
agents: chown work/ recursively only on owner mismatch
2026-10-05 13:01:14 +02:00
matrix: drop the per-hive appservice and its unused token
2026-10-05 07:48:17 +02:00
swarm-controller: revoke matrix admin from former operators
2026-10-05 12:39:02 +02:00
swarm-ci-runner: run the forge CI runner as a swarm service
2026-10-05 13:55:37 +02:00
module-eval: set the hive-controller option only in tests that need a hive
2026-10-05 09:58:13 +02:00
nix: finish the current-behaviour comment sweep in touched files
2026-10-05 09:58:57 +02:00
swarm-ci-runner: run the forge CI runner as a swarm service
2026-10-05 13:55:37 +02:00
swarm-ci-runner: load the registration token in a register unit of its own
2026-10-05 16:33:24 +02:00
nix: comments state current behaviour, not history
2026-10-05 09:58:50 +02:00
swarm-bao: give the store's collector an explicit self-telemetry port
2026-09-23 18:04:33 +02:00
hive CA: delete ca.pem, ca-previous.pem and ca-key.pem, the bundle is the store's root
2026-10-05 21:17:10 +02:00
module-eval: assert the severity table once, not once per tier
2026-09-20 14:23:56 +02:00
module-eval: set the hive-controller option only in tests that need a hive
2026-10-05 09:58:13 +02:00
module-eval: set the hive-controller option only in tests that need a hive
2026-10-05 09:58:13 +02:00
nix: finish the current-behaviour comment sweep in touched files
2026-10-05 09:58:57 +02:00
nix: finish the current-behaviour comment sweep in touched files
2026-10-05 09:58:57 +02:00
module-eval: set the hive-controller option only in tests that need a hive
2026-10-05 09:58:13 +02:00
nix: comments state current behaviour, not history
2026-10-05 09:58:50 +02:00
nix: follow-ups from the service/deploy split
2026-10-05 19:12:46 +02:00
swarm-bao: refuse a remote reader that named seven of the eight leaves
2026-09-23 10:11:42 +02:00
swarm CA: retire the host-held root CA, the store holds the only anchor
2026-10-05 21:17:10 +02:00
4e5a642928