Repository files (latest commit first)

Filename	Latest commit message	Latest commit date
atlas 836b15a46e harden the ephemeral-root salvage: clone, check space, lock ... - clone each file with FICLONE, copy the data only where that fails - skip the salvage when the copy would leave too little free space - hold a per-container flock and one copy at a time across containers - run WriteNspawnFlags on the blocking pool		2026-10-28 23:01:04 +01:00
..
hive-c0re	test the invite room check and the no-homeserver sweep, drop the last space wording	2026-10-28 21:07:32 +01:00
hive-forge	move hiveName to deploy.hive-controller; only a hive host needs a name	2026-10-26 18:47:49 +01:00
hive-gateway	move hiveName to deploy.hive-controller; only a hive host needs a name	2026-10-26 18:47:49 +01:00
lib	keep the cache's key and pull token for hive-priv in a root-only directory	2026-10-28 10:23:01 +01:00
swarm-grafana/dashboards	collector dashboard: query the service.name the collectors emit, lint dashboard names	2026-10-28 19:57:35 +01:00
bao-bootstrap-policy.hcl	bao: disable the unused approle auth method, declaratively	2026-09-28 22:58:36 +02:00
default.nix	fetch the self-check's password as a systemd credential	2026-10-28 13:50:35 +01:00
deploy.nix	default swarm.attic domain and cache to the swarm's own cache on every host	2026-10-27 22:16:26 +01:00
glue-attic-otel-oidc-client.nix	forward the attic container's journal to the swarm collector	2026-10-27 16:03:23 +01:00
glue-bao-readers-policy-order.nix	copy the cache's pull facts to each hive and create them in the in-swarm cache	2026-10-28 01:19:56 +01:00
glue-bao-readers-store-order.nix	run attic as a swarm service with deploy.attic.enable	2026-10-27 13:04:17 +01:00
glue-bao-tls.nix	copy the cache's pull facts to each hive and create them in the in-swarm cache	2026-10-28 01:19:56 +01:00
glue-bao-ui-oidc-client.nix	bao: OIDC login to the browser UI via authelia, as a metadata-only viewer	2026-09-28 19:56:38 +02:00
glue-builder-oidc-client.nix	swarm-builder, swarm-claude-login, swarm-review-classifier: forward each container's journal to the swarm collector	2026-10-16 09:10:04 +02:00
glue-ci-metrics-otel-oidc-client.nix	push ci run metrics to victoriametrics, with a grafana board	2026-10-16 20:43:11 +02:00
glue-ci-runner-otel-oidc-client.nix	swarm-ci-runner, swarm-grafana, swarm-victorialogs: forward each container's journal to the swarm collector	2026-10-16 11:22:51 +02:00
glue-claude-login-oidc-client.nix	swarm-builder, swarm-claude-login, swarm-review-classifier: forward each container's journal to the swarm collector	2026-10-16 09:10:04 +02:00
glue-controller-bao-identity.nix	move hiveName to deploy.hive-controller; only a hive host needs a name	2026-10-26 18:47:49 +01:00
glue-controller-env.nix	service urls carry no gateway port, httpsPort is listen-only	2026-10-25 10:45:54 +01:00
glue-controller-oidc-client.nix	swarm-controller: get its otlp pushes past the collector, log failures	2026-10-17 09:44:33 +02:00
glue-forge-controller.nix	glue: forge's controller-dependent settings move out of the forge module	2026-10-13 22:14:28 +02:00
glue-forge-oidc-client.nix	nix: gate hive-c0re on deploy.hive-controller.enable, drop hyperhive.enable	2026-09-26 01:19:49 +02:00
glue-forge-otel-oidc-client.nix	hive-forge, hive-matrix: forward each container's journal to the swarm collector	2026-10-16 13:50:23 +02:00
glue-grafana-oidc-client.nix	nix: gate hive-c0re on deploy.hive-controller.enable, drop hyperhive.enable	2026-09-26 01:19:49 +02:00
glue-grafana-otel-oidc-client.nix	swarm-ci-runner, swarm-grafana, swarm-victorialogs: forward each container's journal to the swarm collector	2026-10-16 11:22:51 +02:00
glue-hive-otel-authelia.nix	move hiveName to deploy.hive-controller; only a hive host needs a name	2026-10-26 18:47:49 +01:00
glue-hive-tls-bao-identity.nix	hive-tls: the gateway leaf uses the services-issuer identity, not a hive's	2026-10-06 14:54:07 +02:00
glue-hive-tls-controllers.nix	agents fetch the hive CA from bao at boot instead of the meta flake embedding it	2026-10-19 20:15:13 +02:00
glue-logs-auth-bao-identity.nix	swarm-logs-auth: check agent tokens on the log store's query route	2026-10-13 08:38:05 +02:00
glue-matrix-ctl-bao-identity.nix	swarm-nats, matrix: the queue's and matrix-ctl's store identity paths are their own, not the hive's	2026-10-06 12:04:48 +02:00
glue-matrix-hive-discovery.nix	move hiveName to deploy.hive-controller; only a hive host needs a name	2026-10-26 18:47:49 +01:00
glue-matrix-oidc-client.nix	swarm: OIDC clients registered wherever authelia runs; nats + matrix secrets from bao	2026-10-05 09:58:02 +02:00
glue-matrix-otel-oidc-client.nix	hive-forge, hive-matrix: forward each container's journal to the swarm collector	2026-10-16 13:50:23 +02:00
glue-metrics-auth-bao-identity.nix	add swarm-metrics, an agent CLI for the metrics store	2026-10-17 10:10:17 +02:00
glue-nats-auth-bao-identity.nix	swarm-nats: the auth responder's store identity path is its own, not the hive's	2026-10-06 10:04:30 +02:00
glue-nats-bao-identity.nix	swarm-nats, matrix: the queue's and matrix-ctl's store identity paths are their own, not the hive's	2026-10-06 12:04:48 +02:00
glue-nats-oidc-client.nix	swarm-nats: forward the queue container's journal to the swarm collector	2026-10-16 09:08:21 +02:00
glue-nats-wireguard.nix	glue: nats firewall on the wireguard interface moves out of the nats module	2026-10-14 10:15:19 +02:00
glue-notify-router-oidc-client.nix	agents get a todo when assigned to an issue or PR, rewritten when unassigned and cleared on close	2026-10-22 07:28:53 +02:00
glue-review-classifier-oidc-client.nix	swarm-builder, swarm-claude-login, swarm-review-classifier: forward each container's journal to the swarm collector	2026-10-16 09:10:04 +02:00
glue-secret-publisher-authelia.nix	swarm-authelia: run the secret publisher and a journal forwarder inside the container	2026-10-17 00:28:16 +02:00
glue-secret-publisher-bao-identity.nix	move hiveName to deploy.hive-controller; only a hive host needs a name	2026-10-26 18:47:49 +01:00
glue-swarm-bao-otel-oidc-client.nix	ops: update option pointers after grafana/bao split	2026-10-01 09:53:04 +02:00
glue-swarm-otel-oidc-client.nix	ops: update option pointers after otel split	2026-10-01 13:00:40 +02:00
glue-victorialogs-otel-oidc-client.nix	swarm-ci-runner, swarm-grafana, swarm-victorialogs: forward each container's journal to the swarm collector	2026-10-16 11:22:51 +02:00
glue-victoriametrics-otel-oidc-client.nix	swarm-victoriametrics: forward the container's journal to the swarm collector	2026-10-16 14:47:31 +02:00
hive-matrix-service.nix	test the invite room check and the no-homeserver sweep, drop the last space wording	2026-10-28 21:07:32 +01:00
hive-matrix.nix	also stop provisioning the hive space and make hivectl matrix invite take a room	2026-10-28 20:57:41 +01:00
hive-network.nix	deploy squid on every hive host, with exporter, journal forwarding and self-check	2026-10-27 20:59:06 +01:00
hive-options-removed.nix	publish operators' forge-profile pronouns to kv and list them in the agent prompt	2026-10-17 13:10:05 +02:00
hive-priv-cache.nix	keep the cache's key and pull token for hive-priv in a root-only directory	2026-10-28 10:23:01 +01:00
hive-priv.nix	harden the ephemeral-root salvage: clone, check space, lock	2026-10-28 23:01:04 +01:00
hive-squid-credential.nix	fetch the self-check's password as a systemd credential	2026-10-28 13:50:35 +01:00
hive-squid.nix	squid: base allow list for every authed user, and no start limit on the list reload	2026-10-28 19:44:26 +01:00
hive-tls.nix	keep the cache's key and pull token for hive-priv in a root-only directory	2026-10-28 10:23:01 +01:00
host-ca-removed.nix	drop option renames and removals older than two weeks	2026-10-16 22:04:57 +02:00
hyperhive.nix	move hiveName to deploy.hive-controller; only a hive host needs a name	2026-10-26 18:47:49 +01:00
local-defaults.nix	swarm-nats: take the callout issuer and user keys from the store	2026-10-06 14:53:33 +02:00
nats-callout-removed.nix	docs: put the credentials prose on the overview and the tables on the reference	2026-10-26 18:10:01 +01:00
otel.nix	warn when a hive host without a leaf names the otel oidc secret file	2026-10-28 00:46:19 +01:00
stylix-theme.nix	swarm-ui: apply the operator's stylix theme, same as the dashboard already does	2026-08-24 14:28:25 +02:00
swarm-attic-options.nix	default swarm.attic domain and cache to the swarm's own cache on every host	2026-10-27 22:16:26 +01:00
swarm-attic.nix	rebuild an agent's closure when the binary cache lost it	2026-10-28 13:51:01 +01:00
swarm-authelia-service.nix	swarm: drop the -agent client suffix refusal from authelia and the queue responder	2026-10-24 15:02:32 +02:00
swarm-authelia.nix	keep authelia's keys in bao, seeded from the existing key files	2026-10-27 16:01:57 +01:00
swarm-bao-service.nix	drop port-collision checks against swarm.otel.telemetryPort	2026-10-24 23:02:37 +02:00
swarm-bao.nix	raise the cert role token ttl to 1h	2026-10-28 20:35:11 +01:00
swarm-builder.nix	require both attic options, follow attic's cache-name rule, read the token from a file	2026-10-27 13:02:43 +01:00
swarm-ci-metrics.nix	service urls carry no gateway port, httpsPort is listen-only	2026-10-25 10:45:54 +01:00
swarm-ci-runner.nix	service urls carry no gateway port, httpsPort is listen-only	2026-10-25 10:45:54 +01:00
swarm-claude-login.nix	service urls carry no gateway port, httpsPort is listen-only	2026-10-25 10:45:54 +01:00
swarm-controller.nix	pin internal/meta's hyperhive on the controller's rev and rebuild agents when it moves	2026-10-24 21:13:24 +02:00
swarm-grafana-service.nix	swarm-ci-runner, swarm-grafana, swarm-victorialogs: forward each container's journal to the swarm collector	2026-10-16 11:22:51 +02:00
swarm-grafana.nix	store the forge webhook secret and grafana's secret key in bao, seeded from the existing files	2026-10-27 13:00:13 +01:00
swarm-nats-service.nix	drop port-collision checks against swarm.otel.telemetryPort	2026-10-24 23:02:37 +02:00
swarm-nats.nix	docs: put the credentials prose on the overview and the tables on the reference	2026-10-26 18:10:01 +01:00
swarm-notify-router.nix	service urls carry no gateway port, httpsPort is listen-only	2026-10-25 10:45:54 +01:00
swarm-otel-service.nix	forward the attic container's journal to the swarm collector	2026-10-27 16:03:23 +01:00
swarm-otel.nix	forward the attic container's journal to the swarm collector	2026-10-27 16:03:23 +01:00
swarm-required-services.nix	default swarm.attic domain and cache to the swarm's own cache on every host	2026-10-27 22:16:26 +01:00
swarm-review-classifier.nix	hive collector runs only on hive hosts; review classifier pushes metrics through its forwarder	2026-10-26 15:58:44 +01:00
swarm-secret-publisher.nix	forward the attic container's journal to the swarm collector	2026-10-27 16:03:23 +01:00
swarm-snapshot-store.nix	snapshot store: bound the transfer on both ends	2026-10-16 11:45:58 +02:00
swarm-ui.nix	swarm-ui vhost: cache by name, 404 a missing file, carry a content security policy	2026-10-28 19:56:55 +01:00
swarm-victorialogs-service.nix	swarm-ci-runner, swarm-grafana, swarm-victorialogs: forward each container's journal to the swarm collector	2026-10-16 11:22:51 +02:00
swarm-victorialogs.nix	service urls carry no gateway port, httpsPort is listen-only	2026-10-25 10:45:54 +01:00
swarm-victoriametrics-service.nix	swarm-victoriametrics: forward the container's journal to the swarm collector	2026-10-16 14:47:31 +02:00
swarm-victoriametrics.nix	service urls carry no gateway port, httpsPort is listen-only	2026-10-25 10:45:54 +01:00
swarm-wireguard.nix	move hiveName to deploy.hive-controller; only a hive host needs a name	2026-10-26 18:47:49 +01:00
swarm.nix	run attic as a swarm service with deploy.attic.enable	2026-10-27 13:04:17 +01:00