atlas
5a5a4ddd15
ci: let the runner execute what it builds ...
The upstream gitea-actions-runner unit uses DynamicUser, and systemd
mounts a dynamic unit's state directory noexec. Measured from a job's
own /proc/self/mountinfo on the live runner, with /tmp as the control:
the state dir carries noexec, /tmp does not, and a script written and
chmod +x'd in the workspace fails execve with EACCES while the same
script in /tmp runs.
This was invisible for as long as every workflow compiled inside the
nix sandbox and executed nothing from the workspace. The first job that
built a binary into the runner's own target dir -- an instrumented
coverage run -- died on its first build script.
ExecPaths= re-mounts the state dir executable. Both spellings are
listed with the ignore-if-absent prefix because ExecPaths resolves
against the host root, where the dynamic-user layout makes
/var/lib/gitea-runner a symlink into private/.
2026-08-27 14:48:47 +02:00
swarm-otel: collect only the units the swarm's services declare
2026-08-24 22:05:45 +02:00
hive-forge: enable the per-label and per-repository issue metrics
2026-08-27 00:16:04 +02:00
swarm-otel: collect only the units the swarm's services declare
2026-08-24 22:05:45 +02:00
fix( #3527 ): a missing source must report as zero, not as empty
2026-08-19 20:27:00 +02:00
swarm-grafana /dashboards
swarm-grafana: provision log store and metrics store dashboards
2026-08-26 21:37:31 +02:00
feat(swarm-victorialogs): a log store for the swarm
2026-08-24 16:36:18 +02:00
ci: let the runner execute what it builds
2026-08-27 14:48:47 +02:00
forge, matrix: SSO is not optional
2026-08-24 23:06:25 +02:00
docs(network): drop the otel reasoning instead of restating it
2026-08-19 02:04:57 +02:00
fix( #2573 ): also add /etc/tmpfiles.d to hive-priv ReadWritePaths (same EROFS class)
2026-07-18 16:39:20 +02:00
fix( #3462 ): apply the name check in the unit that runs on the deploy
2026-08-18 21:54:38 +02:00
refactor(nix): a hive's domain comes out of the swarm directory
2026-08-05 22:43:17 +02:00
fix( #3343 ): move the all-local queue derivations into the deployment mode
2026-08-16 19:37:49 +02:00
otel: give host metrics a host identity via resourcedetection
2026-08-27 10:49:30 +02:00
swarm-ui: apply the operator's stylix theme, same as the dashboard already does
2026-08-24 14:28:25 +02:00
swarm-authelia: stop answering machine callers with a 200 error page
2026-08-27 14:04:18 +02:00
swarm-otel: collect only the units the swarm's services declare
2026-08-24 22:05:45 +02:00
fix( #3363 ): swarm containers write their own resolver file
2026-08-17 17:30:15 +02:00
swarm-otel: collect only the units the swarm's services declare
2026-08-24 22:05:45 +02:00
swarm-grafana: provision log store and metrics store dashboards
2026-08-26 21:37:31 +02:00
swarm-nats: manual callout needs all four keys, not two
2026-08-24 23:06:59 +02:00
swarm-otel: request the bearer-authz scope on the metrics scrape
2026-08-26 18:34:21 +02:00
docs+nix: fix stale certFingerprint/HYPERHIVE_PEERS references (hyperhive#3294)
2026-08-15 19:56:11 +02:00
feat(swarm): start the log store with the other required services
2026-08-24 17:00:38 +02:00
refactor( #2862 ): keep the option at services.hyperhive.snapshotStore
2026-07-31 19:03:24 +02:00
swarm-ui: swap colors.css via a plain nginx location, not a package-copy derivation
2026-08-24 14:28:25 +02:00
swarm-otel: collect only the units the swarm's services declare
2026-08-24 22:05:45 +02:00
swarm-otel: collect only the units the swarm's services declare
2026-08-24 22:05:45 +02:00
docs+nix: fix stale certFingerprint/HYPERHIVE_PEERS references (hyperhive#3294)
2026-08-15 19:56:11 +02:00
swarm: publish an authenticated gateway vhost for VictoriaLogs
2026-08-24 18:43:26 +02:00
5a5a4ddd15