atlas
597fdebaf3
swarm-bao-forge-publisher starts on the deploy that adds it ...
The publisher was wanted only by container@hive-forge.service . A switch
starts a new unit only through the targets that want it, and the container
is already running, so the deploy that introduced the publisher left it dead
until the next container restart or boot; the path unit cannot help, because
the mint's only-once guard never rewrites the file.
- The publisher is also wanted by multi-user.target, like swarm-secret-publish.
- A token file that is not there yet exits 0 instead of waiting 120s and
failing: the path unit runs the publisher when the mint writes it, so a
switch with the forge container down does not fail. TimeoutStartSec is 60.
- swarm-controller loses its After= on the publisher: a switch issues the two
jobs separately, so it ordered nothing there, and the background re-read
covers the gap.
- The controller's background re-read logs at info once the backoff is
capped, one line per five minutes, so a forge host that never got its
publisher leaf stays visible; earlier retries stay at debug.
Refs #4998
2026-10-08 13:59:26 +02:00
swarm CA: describe the store's pki root as the only anchor in docs and comments
2026-10-05 21:17:10 +02:00
swarm-bao-forge-publisher starts on the deploy that adds it
2026-10-08 13:59:26 +02:00
swarm CA: describe the store's pki root as the only anchor in docs and comments
2026-10-05 21:17:10 +02:00
swarm-nats: the auth responder's store identity path is its own, not the hive's
2026-10-06 10:04:30 +02:00
swarm-grafana /dashboards
swarm-grafana: drop stale windows from the subscription usage line, match sibling panel interval
2026-10-07 23:54:53 +02:00
bao: disable the unused approle auth method, declaratively
2026-09-28 22:58:36 +02:00
hive-tls: the gateway leaf uses the services-issuer identity, not a hive's
2026-10-06 14:54:07 +02:00
swarm-controller reads its forge token from the store, not a host file
2026-10-08 13:25:47 +02:00
swarm-controller reads its forge token from the store, not a host file
2026-10-08 13:25:47 +02:00
swarm-controller reads its forge token from the store, not a host file
2026-10-08 13:25:47 +02:00
bao: OIDC login to the browser UI via authelia, as a metadata-only viewer
2026-09-28 19:56:38 +02:00
nix: gate hive-c0re on deploy.hive-controller.enable, drop hyperhive.enable
2026-09-26 01:19:49 +02:00
swarm: OIDC clients registered wherever authelia runs; nats + matrix secrets from bao
2026-10-05 09:58:02 +02:00
nix: gate hive-c0re on deploy.hive-controller.enable, drop hyperhive.enable
2026-09-26 01:19:49 +02:00
nix: gate hive-c0re on deploy.hive-controller.enable, drop hyperhive.enable
2026-09-26 01:19:49 +02:00
hive-tls: the gateway leaf uses the services-issuer identity, not a hive's
2026-10-06 14:54:07 +02:00
swarm-nats, matrix: the queue's and matrix-ctl's store identity paths are their own, not the hive's
2026-10-06 12:04:48 +02:00
swarm: OIDC clients registered wherever authelia runs; nats + matrix secrets from bao
2026-10-05 09:58:02 +02:00
swarm-nats: the auth responder's store identity path is its own, not the hive's
2026-10-06 10:04:30 +02:00
swarm-nats, matrix: the queue's and matrix-ctl's store identity paths are their own, not the hive's
2026-10-06 12:04:48 +02:00
swarm: OIDC clients registered wherever authelia runs; nats + matrix secrets from bao
2026-10-05 09:58:02 +02:00
nix: comments state current behaviour, not history
2026-10-05 09:58:50 +02:00
nix: gate hive-c0re on deploy.hive-controller.enable, drop hyperhive.enable
2026-09-26 01:19:49 +02:00
ops: update option pointers after grafana/bao split
2026-10-01 09:53:04 +02:00
ops: update option pointers after otel split
2026-10-01 13:00:40 +02:00
swarm-controller: revoke matrix admin from former operators
2026-10-05 12:39:02 +02:00
swarm-nats, matrix: the queue's and matrix-ctl's store identity paths are their own, not the hive's
2026-10-06 12:04:48 +02:00
swarm-ci-runner: run the forge CI runner as a swarm service
2026-10-05 13:55:37 +02:00
swarm-ci-runner: run the forge CI runner as a swarm service
2026-10-05 13:55:37 +02:00
hive-tls: the root fetch presents the hive identity, as on main
2026-10-06 14:54:07 +02:00
hive CA: catch a deleted CA file however its path is spelled
2026-10-05 21:17:10 +02:00
nix: finish the current-behaviour comment sweep in touched files
2026-10-05 09:58:57 +02:00
swarm-nats: take the callout issuer and user keys from the store
2026-10-06 14:53:33 +02:00
nats-callout-removed: remove the container's OIDC secret copy here, ungated
2026-10-06 15:25:29 +02:00
swarm CA: describe the store's pki root as the only anchor in docs and comments
2026-10-05 21:17:10 +02:00
swarm-ui: apply the operator's stylix theme, same as the dashboard already does
2026-08-24 14:28:25 +02:00
nix: follow-ups from the service/deploy split
2026-10-05 19:12:46 +02:00
swarm CA: describe the store's pki root as the only anchor in docs and comments
2026-10-05 21:17:10 +02:00
nix: split swarm-bao into service and deploy-mode files
2026-10-01 09:37:36 +02:00
swarm-controller reads its forge token from the store, not a host file
2026-10-08 13:25:47 +02:00
deploy: forward swarm.forge.ci to deploy.ci-runner, say what the forwarded enable needs
2026-10-05 21:36:11 +02:00
swarm-bao-forge-publisher starts on the deploy that adds it
2026-10-08 13:59:26 +02:00
nix: finish the "moved to" comment sweep
2026-10-05 09:59:02 +02:00
swarm CA: describe the store's pki root as the only anchor in docs and comments
2026-10-05 21:17:10 +02:00
nix: finish the "moved to" comment sweep
2026-10-05 09:59:02 +02:00
nats-callout-removed: remove the container's OIDC secret copy here, ungated
2026-10-06 15:25:29 +02:00
swarm-otel: name the port-collision assertion instead of pointing below
2026-10-05 19:22:55 +02:00
swarm CA: describe the store's pki root as the only anchor in docs and comments
2026-10-05 21:17:10 +02:00
swarm CA: retire the host-held root CA, the store holds the only anchor
2026-10-05 21:17:10 +02:00
nix: run the forge on one host per swarm (deploy.forgejo.enable)
2026-09-24 23:56:07 +02:00
swarm-nats-auth: read its own OIDC client secret from the store
2026-10-06 14:54:19 +02:00
deploy: move the wireguard mesh out of the namespace hives read
2026-09-07 14:24:52 +02:00
nix: finish the current-behaviour comment sweep in touched files
2026-10-05 09:58:57 +02:00
nix: split swarm-victorialogs into service and deploy-mode files
2026-10-01 10:03:55 +02:00
nix: comments state current behaviour, not history
2026-10-05 09:58:50 +02:00
nix: follow-ups from the service/deploy split
2026-10-05 19:12:46 +02:00
swarm-ui: build the forge link from swarm.forge.domain
2026-10-02 20:02:02 +02:00
swarm options: no swarm.* value depends on a deploy option or this host's hive
2026-10-04 18:13:47 +02:00
swarm-controller reads its forge token from the store, not a host file
2026-10-08 13:25:47 +02:00
597fdebaf3