atlas
7d95973d83
swarmctl: --swarm works after the subcommand, takes a bare domain, and login defaults to the host's swarm ...
`swarmctl login --swarm X` failed with "unexpected argument", and
`login --help` listed no `--swarm`: the flag was only accepted before the
verb. `--swarm` and `--ca-file` are now global, so they parse on either side
of the subcommand and show in every subcommand's help.
`--swarm` / `SWARMCTL_SWARM` accept a bare domain and prepend `https://`.
A value with a scheme is parsed as before, so `http://` is still refused.
On a swarm-controller host, the swarmctl wrapper sets
`SWARMCTL_LOGIN_DEFAULT_SWARM=https://<swarm.domain>` (`--set-default`).
Only `login` reads it, after `--swarm` and `SWARMCTL_SWARM`. The wrapper
does not set `SWARMCTL_SWARM`: that would send every socket verb (agent
create, schedule, inference, forge) through the gateway and make each need
a login. Other verbs resolve exactly as before.
No CA file is wired. The only CA material the module names is the
controller's assembled trust bundle (system CAs plus the hive anchor).
`--ca-file` hands every certificate in it to rustls-platform-verifier as
an extra root, and that fails the whole client on any one it cannot
parse, so pointing it at the system CAs is a risk nothing here can test.
The controller daemon trusts the same CA through `SSL_CERT_FILE`, which
skips unparsable certificates; using that for swarmctl is left open.
Machines that are not swarm-controller hosts (an operator laptop) get no
default; that case waits on an answer in the issue.
Fixes #5239
2026-10-14 10:15:09 +02:00
swarm-logs: authenticate as the agent with its own queue secret
2026-10-13 08:38:05 +02:00
swarm-otel: declare forgejo's published scrape target on every host
2026-10-13 22:15:13 +02:00
swarm CA: describe the store's pki root as the only anchor in docs and comments
2026-10-05 21:17:10 +02:00
swarm-bao-agent-pki: decide openbao's restart on the shared locale-independent compare
2026-10-13 17:00:56 +02:00
swarm-grafana /dashboards
swarm-grafana: drop stale windows from the subscription usage line, match sibling panel interval
2026-10-07 23:54:53 +02:00
bao: disable the unused approle auth method, declaratively
2026-09-28 22:58:36 +02:00
swarm-builder: build each agent config PR head and post a commit status
2026-10-14 03:30:46 +02:00
swarm-builder: scope the forge token to the forge, one build at a time, opt-in
2026-10-14 03:30:46 +02:00
grafana: mint the admin password into the store and apply it on every start
2026-10-12 15:16:53 +02:00
glue: consumers' start-after-bao ordering moves into one glue module
2026-10-13 22:05:16 +02:00
swarm-builder: build each agent config PR head and post a commit status
2026-10-14 03:30:46 +02:00
bao: OIDC login to the browser UI via authelia, as a metadata-only viewer
2026-09-28 19:56:38 +02:00
swarm-builder: build each agent config PR head and post a commit status
2026-10-14 03:30:46 +02:00
nix: gate hive-c0re on deploy.hive-controller.enable, drop hyperhive.enable
2026-09-26 01:19:49 +02:00
swarm: OIDC clients registered wherever authelia runs; nats + matrix secrets from bao
2026-10-05 09:58:02 +02:00
glue: forge's controller-dependent settings move out of the forge module
2026-10-13 22:14:28 +02:00
nix: gate hive-c0re on deploy.hive-controller.enable, drop hyperhive.enable
2026-09-26 01:19:49 +02:00
nix: gate hive-c0re on deploy.hive-controller.enable, drop hyperhive.enable
2026-09-26 01:19:49 +02:00
glue: hive-otel's ordering after authelia moves out of the otel module
2026-10-13 22:04:52 +02:00
hive-tls: the gateway leaf uses the services-issuer identity, not a hive's
2026-10-06 14:54:07 +02:00
swarm-logs-auth: check agent tokens on the log store's query route
2026-10-13 08:38:05 +02:00
swarm-nats, matrix: the queue's and matrix-ctl's store identity paths are their own, not the hive's
2026-10-06 12:04:48 +02:00
swarm: OIDC clients registered wherever authelia runs; nats + matrix secrets from bao
2026-10-05 09:58:02 +02:00
swarm-nats: the auth responder's store identity path is its own, not the hive's
2026-10-06 10:04:30 +02:00
swarm-nats, matrix: the queue's and matrix-ctl's store identity paths are their own, not the hive's
2026-10-06 12:04:48 +02:00
swarm: OIDC clients registered wherever authelia runs; nats + matrix secrets from bao
2026-10-05 09:58:02 +02:00
glue: otel scrape targets for authelia, grafana and nats move out of the services
2026-10-14 01:40:40 +02:00
swarm-bao-pki: sign every other hive's three store leaves
2026-10-12 21:41:28 +02:00
nix: run the review classifier in a container of its own when a host enables it
2026-10-12 13:11:21 +02:00
glue: the secret publisher's authelia-dependent settings move out of the publisher module
2026-10-14 01:52:53 +02:00
nix: gate hive-c0re on deploy.hive-controller.enable, drop hyperhive.enable
2026-09-26 01:19:49 +02:00
ops: update option pointers after grafana/bao split
2026-10-01 09:53:04 +02:00
ops: update option pointers after otel split
2026-10-01 13:00:40 +02:00
swarm-controller: revoke matrix admin from former operators
2026-10-05 12:39:02 +02:00
glue: consumers' start-after-bao ordering moves into one glue module
2026-10-13 22:05:16 +02:00
nix: run swarm-ui wherever swarm-controller runs
2026-10-13 20:05:19 +02:00
swarm-ci-runner: run the forge CI runner as a swarm service
2026-10-05 13:55:37 +02:00
hive-tls: the root fetch presents the hive identity, as on main
2026-10-06 14:54:07 +02:00
hive CA: catch a deleted CA file however its path is spelled
2026-10-05 21:17:10 +02:00
nix: finish the current-behaviour comment sweep in touched files
2026-10-05 09:58:57 +02:00
swarm-nats: take the callout issuer and user keys from the store
2026-10-06 14:53:33 +02:00
nats-callout-removed: remove the container's OIDC secret copy here, ungated
2026-10-06 15:25:29 +02:00
hive otel: keep file_storage defined when the collector authenticates upstream
2026-10-14 10:13:58 +02:00
swarm-ui: apply the operator's stylix theme, same as the dashboard already does
2026-08-24 14:28:25 +02:00
swarmctl: log in with the operator's own SSO account and reach the controller through the swarm domain
2026-10-12 01:25:58 +02:00
glue: otel scrape targets for authelia, grafana and nats move out of the services
2026-10-14 01:40:40 +02:00
nix: split swarm-bao into service and deploy-mode files
2026-10-01 09:37:36 +02:00
review classifier: run on ACP when the swarm settings choose it
2026-10-14 10:14:36 +02:00
swarm-builder: scope the forge token to the forge, one build at a time, opt-in
2026-10-14 03:30:46 +02:00
glue: consumers' start-after-bao ordering moves into one glue module
2026-10-13 22:05:16 +02:00
swarmctl: --swarm works after the subcommand, takes a bare domain, and login defaults to the host's swarm
2026-10-14 10:15:09 +02:00
grafana: the published vhost refuses /metrics
2026-10-13 21:42:29 +02:00
glue: otel scrape targets for authelia, grafana and nats move out of the services
2026-10-14 01:40:40 +02:00
nix: finish the "moved to" comment sweep
2026-10-05 09:59:02 +02:00
swarm-builder: build each agent config PR head and post a commit status
2026-10-14 03:30:46 +02:00
glue: otel scrape targets for authelia, grafana and nats move out of the services
2026-10-14 01:40:40 +02:00
glue: consumers' start-after-bao ordering moves into one glue module
2026-10-13 22:05:16 +02:00
swarm CA: retire the host-held root CA, the store holds the only anchor
2026-10-05 21:17:10 +02:00
swarm-builder: scope the forge token to the forge, one build at a time, opt-in
2026-10-14 03:30:46 +02:00
review classifier: run on ACP when the swarm settings choose it
2026-10-14 10:14:36 +02:00
swarm-builder: build each agent config PR head and post a commit status
2026-10-14 03:30:46 +02:00
deploy: move the wireguard mesh out of the namespace hives read
2026-09-07 14:24:52 +02:00
nix: run swarm-ui wherever swarm-controller runs
2026-10-13 20:05:19 +02:00
nix: split swarm-victorialogs into service and deploy-mode files
2026-10-01 10:03:55 +02:00
swarm-victorialogs: size the agent-auth limit for a host booting its agents together
2026-10-14 01:54:54 +02:00
nix: follow-ups from the service/deploy split
2026-10-05 19:12:46 +02:00
swarm-victoriametrics: forward only the store's read API
2026-10-13 08:13:37 +02:00
swarm options: no swarm.* value depends on a deploy option or this host's hive
2026-10-04 18:13:47 +02:00
swarm-builder: build each agent config PR head and post a commit status
2026-10-14 03:30:46 +02:00
7d95973d83