atlas
6c1ab87f68
swarm-otel: declare forgejo's published scrape target on every host ...
The forgejo entry in `swarm.otel.publishedScrapeTargets` was declared
under `deploy.forgejo.enable`, so it existed only in the forge host's
evaluation. Its two readers evaluate elsewhere: the collector renders
its prometheus jobs from its own host's list, and authelia registers
the collector client's audience from its own host's list. With the
forge, the collector and authelia on different hosts, the collector
had no forgejo job and authelia would have refused its token.
Declare the entry unconditionally in swarm-otel-service.nix, keyed on
`swarm.forge.domain`, which every host evaluates identically. A swarm
with no forge scrapes a name that answers nothing and shows a failing
job, the same trade the collector and grafana OIDC clients already make.
Single-host render is unchanged: the entry already existed there.
Part of #5205
2026-10-13 22:15:13 +02:00
swarm-logs: authenticate as the agent with its own queue secret
2026-10-13 08:38:05 +02:00
swarm-otel: declare forgejo's published scrape target on every host
2026-10-13 22:15:13 +02:00
swarm CA: describe the store's pki root as the only anchor in docs and comments
2026-10-05 21:17:10 +02:00
swarm-bao-agent-pki: decide openbao's restart on the shared locale-independent compare
2026-10-13 17:00:56 +02:00
swarm-grafana /dashboards
swarm-grafana: drop stale windows from the subscription usage line, match sibling panel interval
2026-10-07 23:54:53 +02:00
bao: disable the unused approle auth method, declaratively
2026-09-28 22:58:36 +02:00
glue: forge's controller-dependent settings move out of the forge module
2026-10-13 22:14:28 +02:00
nix: warn on the ignored swarm-ui switches instead of failing eval
2026-10-13 20:05:19 +02:00
grafana: mint the admin password into the store and apply it on every start
2026-10-12 15:16:53 +02:00
glue: consumers' start-after-bao ordering moves into one glue module
2026-10-13 22:05:16 +02:00
swarm-logs-auth: check agent tokens on the log store's query route
2026-10-13 08:38:05 +02:00
bao: OIDC login to the browser UI via authelia, as a metadata-only viewer
2026-09-28 19:56:38 +02:00
nix: gate hive-c0re on deploy.hive-controller.enable, drop hyperhive.enable
2026-09-26 01:19:49 +02:00
swarm: OIDC clients registered wherever authelia runs; nats + matrix secrets from bao
2026-10-05 09:58:02 +02:00
glue: forge's controller-dependent settings move out of the forge module
2026-10-13 22:14:28 +02:00
nix: gate hive-c0re on deploy.hive-controller.enable, drop hyperhive.enable
2026-09-26 01:19:49 +02:00
nix: gate hive-c0re on deploy.hive-controller.enable, drop hyperhive.enable
2026-09-26 01:19:49 +02:00
glue: hive-otel's ordering after authelia moves out of the otel module
2026-10-13 22:04:52 +02:00
hive-tls: the gateway leaf uses the services-issuer identity, not a hive's
2026-10-06 14:54:07 +02:00
swarm-logs-auth: check agent tokens on the log store's query route
2026-10-13 08:38:05 +02:00
swarm-nats, matrix: the queue's and matrix-ctl's store identity paths are their own, not the hive's
2026-10-06 12:04:48 +02:00
swarm: OIDC clients registered wherever authelia runs; nats + matrix secrets from bao
2026-10-05 09:58:02 +02:00
swarm-nats: the auth responder's store identity path is its own, not the hive's
2026-10-06 10:04:30 +02:00
swarm-nats, matrix: the queue's and matrix-ctl's store identity paths are their own, not the hive's
2026-10-06 12:04:48 +02:00
swarm: OIDC clients registered wherever authelia runs; nats + matrix secrets from bao
2026-10-05 09:58:02 +02:00
swarm-bao-pki: sign every other hive's three store leaves
2026-10-12 21:41:28 +02:00
nix: run the review classifier in a container of its own when a host enables it
2026-10-12 13:11:21 +02:00
nix: gate hive-c0re on deploy.hive-controller.enable, drop hyperhive.enable
2026-09-26 01:19:49 +02:00
ops: update option pointers after grafana/bao split
2026-10-01 09:53:04 +02:00
ops: update option pointers after otel split
2026-10-01 13:00:40 +02:00
swarm-controller: revoke matrix admin from former operators
2026-10-05 12:39:02 +02:00
glue: consumers' start-after-bao ordering moves into one glue module
2026-10-13 22:05:16 +02:00
nix: run swarm-ui wherever swarm-controller runs
2026-10-13 20:05:19 +02:00
swarm-ci-runner: run the forge CI runner as a swarm service
2026-10-05 13:55:37 +02:00
hive-tls: the root fetch presents the hive identity, as on main
2026-10-06 14:54:07 +02:00
hive CA: catch a deleted CA file however its path is spelled
2026-10-05 21:17:10 +02:00
nix: finish the current-behaviour comment sweep in touched files
2026-10-05 09:58:57 +02:00
swarm-nats: take the callout issuer and user keys from the store
2026-10-06 14:53:33 +02:00
nats-callout-removed: remove the container's OIDC secret copy here, ungated
2026-10-06 15:25:29 +02:00
glue: consumers' start-after-bao ordering moves into one glue module
2026-10-13 22:05:16 +02:00
swarm-ui: apply the operator's stylix theme, same as the dashboard already does
2026-08-24 14:28:25 +02:00
swarmctl: log in with the operator's own SSO account and reach the controller through the swarm domain
2026-10-12 01:25:58 +02:00
nix: run swarm-ui wherever swarm-controller runs
2026-10-13 20:05:19 +02:00
nix: split swarm-bao into service and deploy-mode files
2026-10-01 09:37:36 +02:00
swarm-bao-agent-pki: decide openbao's restart on the shared locale-independent compare
2026-10-13 17:00:56 +02:00
glue: consumers' start-after-bao ordering moves into one glue module
2026-10-13 22:05:16 +02:00
nix: run swarm-ui wherever swarm-controller runs
2026-10-13 20:05:19 +02:00
grafana: the published vhost refuses /metrics
2026-10-13 21:42:29 +02:00
glue: consumers' start-after-bao ordering moves into one glue module
2026-10-13 22:05:16 +02:00
nix: finish the "moved to" comment sweep
2026-10-05 09:59:02 +02:00
glue: consumers' start-after-bao ordering moves into one glue module
2026-10-13 22:05:16 +02:00
swarm-otel: declare forgejo's published scrape target on every host
2026-10-13 22:15:13 +02:00
glue: consumers' start-after-bao ordering moves into one glue module
2026-10-13 22:05:16 +02:00
swarm CA: retire the host-held root CA, the store holds the only anchor
2026-10-05 21:17:10 +02:00
nix: allSwarmServices turns on the review classifier
2026-10-12 13:11:21 +02:00
nix: allSwarmServices turns on the review classifier
2026-10-12 13:11:21 +02:00
nix: run the review classifier in a container of its own when a host enables it
2026-10-12 13:11:21 +02:00
deploy: move the wireguard mesh out of the namespace hives read
2026-09-07 14:24:52 +02:00
nix: run swarm-ui wherever swarm-controller runs
2026-10-13 20:05:19 +02:00
nix: split swarm-victorialogs into service and deploy-mode files
2026-10-01 10:03:55 +02:00
swarm-logs-auth: check agent tokens on the log store's query route
2026-10-13 08:38:05 +02:00
nix: follow-ups from the service/deploy split
2026-10-05 19:12:46 +02:00
swarm-victoriametrics: forward only the store's read API
2026-10-13 08:13:37 +02:00
swarm options: no swarm.* value depends on a deploy option or this host's hive
2026-10-04 18:13:47 +02:00
swarm-logs-auth: check agent tokens on the log store's query route
2026-10-13 08:38:05 +02:00
6c1ab87f68