atlas
2a25ec3dff
authelia: render the swarm apex's operator rules wherever authelia runs ...
The apex's `operatorsOnly` pair was guarded on
`deploy.swarm-controller.enable`, which is true only on the host that
runs the controller and with it the swarm UI's vhost. When authelia runs
on another host, that vhost still asks it, but the authelia host
rendered no rule for the apex at all, so every session reached the
swarm UI and its `/api/` through `default_policy = one_factor`.
The pair now renders whenever the swarm domain is set, like the bao UI's
pair. No vhost on a host that doesn't serve the apex asks about it, so
the extra rules there are inert. authelia 4.39.20's `validate-config`
accepts them on an authelia-only host's rendered access_control.
module-eval-swarm-otel-identity gains a case on the existing
`autheliaOnly` fixture (authelia without the controller): the apex has
exactly the allow+deny pair, the rule list is closed, and an account in
no group is refused `/api/agents` while `group:admins` passes.
Fixes #5120
2026-10-14 23:41:13 +02:00
agents: swap the agent's bao leaf in with one rename
2026-10-11 10:00:43 +02:00
module-eval: evaluate shared fixture configs once
2026-10-13 08:14:50 +02:00
nix: split module-eval into per-subsystem checks
2026-09-20 04:25:54 +02:00
module-eval: evaluate shared fixture configs once
2026-10-13 08:14:50 +02:00
subagent, bash: run each subagent run and bash task in its own cgroup
2026-10-13 12:25:27 +02:00
module-eval: evaluate shared fixture configs once
2026-10-13 08:14:50 +02:00
module-eval: evaluate shared fixture configs once
2026-10-13 08:14:50 +02:00
module-eval: restore agentWith in agent-queue-bao.nix
2026-10-13 14:56:25 +02:00
agents: swap the agent's bao leaf in with one rename
2026-10-11 10:00:43 +02:00
module-eval: agent-user test asserts the heal_own_dir form
2026-10-09 11:30:30 +02:00
swarm-bao-agent-pki: decide openbao's restart on the shared locale-independent compare
2026-10-13 17:00:56 +02:00
swarmctl: on a controller host, trust the swarm's root without SWARMCTL_CA_FILE
2026-10-14 12:49:16 +02:00
review classifier: run on ACP when the swarm settings choose it
2026-10-14 10:14:36 +02:00
module-eval: evaluate shared fixture configs once
2026-10-13 08:14:50 +02:00
module-eval: evaluate shared fixture configs once
2026-10-13 08:14:50 +02:00
swarm-builder: scope the forge token to the forge, one build at a time, opt-in
2026-10-14 03:30:46 +02:00
swarm-logs-auth: run as a static user so nginx reaches its socket
2026-10-14 17:55:28 +02:00
swarm-otel: authelia is no longer declared as both a loopback and a published scrape target
2026-10-14 10:28:48 +02:00
glue: otel scrape targets for authelia, grafana and nats move out of the services
2026-10-14 01:40:40 +02:00
hive otel: keep file_storage defined when the collector authenticates upstream
2026-10-14 10:13:58 +02:00
module-eval: evaluate shared fixture configs once
2026-10-13 08:14:50 +02:00
module-eval: assert the severity table once, not once per tier
2026-09-20 14:23:56 +02:00
authelia: a user outside a rule's group is denied instead of falling through to one_factor
2026-10-14 23:41:13 +02:00
module-eval: evaluate shared fixture configs once
2026-10-13 08:14:50 +02:00
swarm: refuse swarm.hives keys that are not valid hive identifiers
2026-10-12 21:45:50 +02:00
glue: otel scrape targets for authelia, grafana and nats move out of the services
2026-10-14 01:40:40 +02:00
module-eval: evaluate shared fixture configs once
2026-10-13 08:14:50 +02:00
glue: the secret publisher's authelia-dependent settings move out of the publisher module
2026-10-14 01:52:53 +02:00
module-eval: evaluate shared fixture configs once
2026-10-13 08:14:50 +02:00
module-eval: evaluate shared fixture configs once
2026-10-13 08:14:50 +02:00
authelia: render the swarm apex's operator rules wherever authelia runs
2026-10-14 23:41:13 +02:00
swarm-victoriametrics: require 1.153.0, carry the history off the DynamicUser path
2026-10-14 18:15:20 +02:00
2a25ec3dff