atlas
859833b186
fix( #3370 ): give Grafana a secret_key, generated in-container on first boot ...
nixpkgs dropped the default for `services.grafana.settings.security.secret_key`
and asserts on null, so the module I merged an hour ago fails the build on any
host that enables it. That is a broken deploy, not a warning.
Generated in-container like authelia's own keys and for the same reason:
nothing outside the container ever reads it. Generated ONCE and kept — the
key signs Grafana's stored datasource secrets, and rotating it does not
re-encrypt what it already encrypted, so a fresh key per boot would leave
Grafana unable to read its own database. Delivered as `$__file{}`, so it
never enters the store.
The gate missed this because a container is a separate NixOS evaluation with
its own assertions: forcing the host's `config.assertions` never touched the
container's. `state/eval-3265.sh` now forces
`containers.swarm-grafana.config.assertions` and reports any that fail.
2026-08-16 22:46:21 +02:00
feat(swarm): wire a hive's queue coordinates for status publishing
2026-08-16 13:14:03 +02:00
fix: let the secret-delivery oneshots outlive their own bounded wait
2026-08-16 21:45:33 +02:00
docs+nix: fix stale certFingerprint/HYPERHIVE_PEERS references (hyperhive#3294)
2026-08-15 19:56:11 +02:00
feat(nix): issue each hive's CA under a swarm root CA
2026-08-05 15:57:50 +02:00
feat( #3265 ): swarm metrics UI as a Grafana container
2026-08-16 22:27:05 +02:00
feat(nix): move the forge host options under services.hyperhive.swarm
2026-08-05 03:44:53 +02:00
fix: let the secret-delivery oneshots outlive their own bounded wait
2026-08-16 21:45:33 +02:00
docs(3191): the gateway's comments describe a host service, not a container
2026-08-12 12:20:28 +02:00
fix( #2573 ): also add /etc/tmpfiles.d to hive-priv ReadWritePaths (same EROFS class)
2026-07-18 16:39:20 +02:00
fix( #3349 ): do not define a controller env key on hives with no controller
2026-08-16 20:55:39 +02:00
refactor(nix): a hive's domain comes out of the swarm directory
2026-08-05 22:43:17 +02:00
fix( #3343 ): move the all-local queue derivations into the deployment mode
2026-08-16 19:37:49 +02:00
docs( #3265 ): observability.md still said the endpoint was required
2026-08-16 22:27:05 +02:00
wire swarm-authelia-bridge: systemd unit, oidc client, controller auth env
2026-08-16 22:38:40 +02:00
fix(nix): a missing swarm-services leaf must not kill the whole gateway
2026-08-06 00:30:22 +02:00
wire swarm-authelia-bridge: systemd unit, oidc client, controller auth env
2026-08-16 22:38:40 +02:00
fix( #3370 ): give Grafana a secret_key, generated in-container on first boot
2026-08-16 22:46:21 +02:00
fix( #3349 ): wait for authelia's minted secret instead of failing the boot race
2026-08-16 20:51:22 +02:00
docs+nix: fix stale certFingerprint/HYPERHIVE_PEERS references (hyperhive#3294)
2026-08-15 19:56:11 +02:00
feat( #3265 ): feed the store from the collector, and derive the pair
2026-08-16 22:27:05 +02:00
refactor( #2862 ): keep the option at services.hyperhive.snapshotStore
2026-07-31 19:03:24 +02:00
swarm-controller: serve swarm-wide service quick links (hyperhive#3289)
2026-08-15 14:24:52 +02:00
feat( #3265 ): swarm metrics store as a VictoriaMetrics container
2026-08-16 22:27:05 +02:00
docs+nix: fix stale certFingerprint/HYPERHIVE_PEERS references (hyperhive#3294)
2026-08-15 19:56:11 +02:00
feat(swarm): wire a hive's queue coordinates for status publishing
2026-08-16 13:14:03 +02:00
859833b186