atlas
72f5e39278
hive-tls: stage bao pki root in every hive's trust bundle ...
A self-signed hive fronting no swarm service name never filled
`$svcroot` (/var/lib/hive-tls/swarm-services-root.pem): the only writer
was `swarm-services-cert`'s issuance, which exits early on
`want_svc=0`. So those hives' trust-bundle.pem lacked the store's `pki`
root, even though every other hive's swarm-service names chain to it.
On `want_svc=0`, `swarm-services-cert` now reads the root from the
store's unauthenticated `GET /v1/pki/ca/pem`, over the hive's existing
BAO_ADDR, `deploy.bao.serverCaFile` and reader identity
(`deploy.bao.clientCertFile`/`clientKeyFile`) at the TLS layer only; no
login. It writes `$svcroot` and restarts `hive-tls-ca` when the root
changed, as the issuing path already does. The daily
`swarm-services-cert-renew` timer runs the same script, so the copy
follows a root rotation.
The gateway no longer `Requires=` `swarm-services-cert` on such a host:
nginx reads nothing that unit writes there, and the fetch retries
against a sealed store.
`hivectl peer-config` prints the root as step 2 of the self-signed
instructions: the swarm's service names are issued under it, not the
swarm root.
No new option. Refs #4588 .
2026-10-04 14:37:50 +02:00
matrix: serve the web client unconditionally; link it from the swarm domain
2026-10-02 20:02:02 +02:00
swarm-ui: build the forge link from swarm.forge.domain
2026-10-02 20:02:02 +02:00
config PRs: remove the hive's config-PR webhook, poll and core merge
2026-10-02 23:13:03 +02:00
refresh-consumer: key the restart on the file's mtime, not a pre-write compare
2026-09-30 07:45:47 +02:00
swarm-grafana /dashboards
hive-agent: export ACP-reported cost and context fill over OTLP
2026-09-30 22:24:06 +02:00
bao: disable the unused approle auth method, declaratively
2026-09-28 22:58:36 +02:00
nix: split swarm-otel into service and deploy-mode files
2026-10-01 13:00:40 +02:00
matrix: serve the web client unconditionally; link it from the swarm domain
2026-10-02 20:02:02 +02:00
swarm-bao: write every swarm-* grant as a bao granter, not with a 24h token
2026-09-27 22:57:46 +02:00
swarm-otel: ship the whole host journal, drop user sessions after it
2026-09-30 23:01:49 +02:00
bao: OIDC login to the browser UI via authelia, as a metadata-only viewer
2026-09-28 19:56:38 +02:00
nix: gate hive-c0re on deploy.hive-controller.enable, drop hyperhive.enable
2026-09-26 01:19:49 +02:00
nix: gate hive-c0re on deploy.hive-controller.enable, drop hyperhive.enable
2026-09-26 01:19:49 +02:00
nix: gate hive-c0re on deploy.hive-controller.enable, drop hyperhive.enable
2026-09-26 01:19:49 +02:00
swarm-otel: ship the whole host journal, drop user sessions after it
2026-09-30 23:01:49 +02:00
nix: gate hive-c0re on deploy.hive-controller.enable, drop hyperhive.enable
2026-09-26 01:19:49 +02:00
swarm-nats-auth: verify an agent's own token against the store
2026-09-28 08:24:52 +02:00
nix: gate hive-c0re on deploy.hive-controller.enable, drop hyperhive.enable
2026-09-26 01:19:49 +02:00
swarm-otel: ship the whole host journal, drop user sessions after it
2026-09-30 23:01:49 +02:00
nix: gate hive-c0re on deploy.hive-controller.enable, drop hyperhive.enable
2026-09-26 01:19:49 +02:00
nix: gate hive-c0re on deploy.hive-controller.enable, drop hyperhive.enable
2026-09-26 01:19:49 +02:00
ops: update option pointers after grafana/bao split
2026-10-01 09:53:04 +02:00
ops: update option pointers after otel split
2026-10-01 13:00:40 +02:00
forge: always behind the gateway; drop behindGateway
2026-10-02 18:50:42 +02:00
nix: split hive-matrix into service and deploy-mode files
2026-10-01 13:00:25 +02:00
matrix: serve the web client unconditionally; link it from the swarm domain
2026-10-02 20:02:02 +02:00
fix(nix): require swarm domain only when a hyperhive service is enabled
2026-10-02 13:09:45 +02:00
hive-priv: create agent socket dirs on start; drop hyperhive-agents.conf
2026-09-27 18:55:33 +02:00
hive-tls: stage bao pki root in every hive's trust bundle
2026-10-04 14:37:50 +02:00
github: PATs live in swarm bao; the agent fetches them itself
2026-10-02 17:48:27 +02:00
swarm-controller: read the queue client secret from the store, drop the file
2026-09-28 19:01:05 +02:00
ops: update option pointers after otel split
2026-10-01 13:00:40 +02:00
swarm-ui: apply the operator's stylix theme, same as the dashboard already does
2026-08-24 14:28:25 +02:00
nix: split swarm-authelia into service and deploy-mode files
2026-10-01 10:25:19 +02:00
swarm-ui: build authelia/grafana/metrics/logs links from swarm domains
2026-10-02 19:45:02 +02:00
nix: split swarm-bao into service and deploy-mode files
2026-10-01 09:37:36 +02:00
swarm UI: delete linked accounts
2026-10-03 00:56:39 +02:00
swarm-otel: ship the whole host journal, drop user sessions after it
2026-09-30 23:01:49 +02:00
swarm-ui: build the forge link from swarm.forge.domain
2026-10-02 20:02:02 +02:00
nix: split swarm-grafana into service and deploy-mode files
2026-10-01 09:30:21 +02:00
swarm-ui: build the forge link from swarm.forge.domain
2026-10-02 20:02:02 +02:00
nix: split swarm-bao into service and deploy-mode files
2026-10-01 09:37:36 +02:00
swarm-controller: create every agent's subagent stream
2026-10-03 01:34:01 +02:00
nix: split swarm-otel into service and deploy-mode files
2026-10-01 13:00:40 +02:00
ops: update option pointers after otel split
2026-10-01 13:00:40 +02:00
docs+nix: fix stale certFingerprint/HYPERHIVE_PEERS references (hyperhive#3294)
2026-08-15 19:56:11 +02:00
nix: run the forge on one host per swarm (deploy.forgejo.enable)
2026-09-24 23:56:07 +02:00
swarm-otel: ship the whole host journal, drop user sessions after it
2026-09-30 23:01:49 +02:00
deploy: move the wireguard mesh out of the namespace hives read
2026-09-07 14:24:52 +02:00
swarm UI: send a message to an agent, without its hive
2026-10-04 03:02:14 +02:00
nix: split swarm-victorialogs into service and deploy-mode files
2026-10-01 10:03:55 +02:00
swarm-ui: build the forge link from swarm.forge.domain
2026-10-02 20:02:02 +02:00
nix: split swarm-victoriametrics into service and deploy-mode files
2026-10-01 10:03:55 +02:00
swarm-ui: build the forge link from swarm.forge.domain
2026-10-02 20:02:02 +02:00
nix: gate hive-c0re on deploy.hive-controller.enable, drop hyperhive.enable
2026-09-26 01:19:49 +02:00
bao: serve the browser UI to admins via a loopback-only listener
2026-09-28 19:31:02 +02:00
72f5e39278