atlas
8d554477ca
swarm-bao-agent-pki: decide openbao's restart on the shared locale-independent compare ...
`swarm-bao-agent-pki` carried its own copy of the mtime-vs-start compare,
with the same `stat -c %.6Y | tr -d .` read: on a comma-locale host the
`-le` errored and, under `seal = "pkcs11"`, openbao was restarted on
every run of the unit.
The compare moves out of `refresh_unit` into `written_after_start`
(0 newer, 1 not newer, 2 unreadable and logged at `err`), and both
`refresh_unit` and the agent-pki unit call it. The agent-pki unit cannot
call `refresh_unit` itself: it restarts with `restart`, not
`try-restart`, runs a fail-closed check of the bundle between the
compare and the restart, and under shamir prints the step instead of
restarting. It acts only on 0, so an unreadable time skips the restart
as `refresh_unit` does.
`script-test-refresh-consumer` covers the three return codes in the
agent-pki call shape; `module-eval-bao-basics` asserts both seal arms
decide on that call and that no `%.6Y` read is left in the unit.
Refs #5230
2026-10-13 17:00:56 +02:00
swarm-logs: authenticate as the agent with its own queue secret
2026-10-13 08:38:05 +02:00
nix: re-run the host's store fetches on a ten-minute timer
2026-10-13 00:03:20 +02:00
swarm CA: describe the store's pki root as the only anchor in docs and comments
2026-10-05 21:17:10 +02:00
swarm-bao-agent-pki: decide openbao's restart on the shared locale-independent compare
2026-10-13 17:00:56 +02:00
swarm-grafana /dashboards
swarm-grafana: drop stale windows from the subscription usage line, match sibling panel interval
2026-10-07 23:54:53 +02:00
bao: disable the unused approle auth method, declaratively
2026-09-28 22:58:36 +02:00
swarm-logs-auth: check agent tokens on the log store's query route
2026-10-13 08:38:05 +02:00
nix: allSwarmServices turns on the review classifier
2026-10-12 13:11:21 +02:00
grafana: mint the admin password into the store and apply it on every start
2026-10-12 15:16:53 +02:00
swarm-logs-auth: check agent tokens on the log store's query route
2026-10-13 08:38:05 +02:00
bao: OIDC login to the browser UI via authelia, as a metadata-only viewer
2026-09-28 19:56:38 +02:00
nix: gate hive-c0re on deploy.hive-controller.enable, drop hyperhive.enable
2026-09-26 01:19:49 +02:00
swarm: OIDC clients registered wherever authelia runs; nats + matrix secrets from bao
2026-10-05 09:58:02 +02:00
nix: gate hive-c0re on deploy.hive-controller.enable, drop hyperhive.enable
2026-09-26 01:19:49 +02:00
nix: gate hive-c0re on deploy.hive-controller.enable, drop hyperhive.enable
2026-09-26 01:19:49 +02:00
hive-tls: the gateway leaf uses the services-issuer identity, not a hive's
2026-10-06 14:54:07 +02:00
swarm-logs-auth: check agent tokens on the log store's query route
2026-10-13 08:38:05 +02:00
swarm-nats, matrix: the queue's and matrix-ctl's store identity paths are their own, not the hive's
2026-10-06 12:04:48 +02:00
swarm: OIDC clients registered wherever authelia runs; nats + matrix secrets from bao
2026-10-05 09:58:02 +02:00
swarm-nats: the auth responder's store identity path is its own, not the hive's
2026-10-06 10:04:30 +02:00
swarm-nats, matrix: the queue's and matrix-ctl's store identity paths are their own, not the hive's
2026-10-06 12:04:48 +02:00
swarm: OIDC clients registered wherever authelia runs; nats + matrix secrets from bao
2026-10-05 09:58:02 +02:00
swarm-bao-pki: sign every other hive's three store leaves
2026-10-12 21:41:28 +02:00
nix: run the review classifier in a container of its own when a host enables it
2026-10-12 13:11:21 +02:00
nix: gate hive-c0re on deploy.hive-controller.enable, drop hyperhive.enable
2026-09-26 01:19:49 +02:00
ops: update option pointers after grafana/bao split
2026-10-01 09:53:04 +02:00
ops: update option pointers after otel split
2026-10-01 13:00:40 +02:00
swarm-controller: revoke matrix admin from former operators
2026-10-05 12:39:02 +02:00
nix: re-run the host's store fetches on a ten-minute timer
2026-10-13 00:03:20 +02:00
swarm-ci-runner: run the forge CI runner as a swarm service
2026-10-05 13:55:37 +02:00
swarm-ci-runner: run the forge CI runner as a swarm service
2026-10-05 13:55:37 +02:00
hive-tls: the root fetch presents the hive identity, as on main
2026-10-06 14:54:07 +02:00
hive CA: catch a deleted CA file however its path is spelled
2026-10-05 21:17:10 +02:00
nix: finish the current-behaviour comment sweep in touched files
2026-10-05 09:58:57 +02:00
swarm-nats: take the callout issuer and user keys from the store
2026-10-06 14:53:33 +02:00
nats-callout-removed: remove the container's OIDC secret copy here, ungated
2026-10-06 15:25:29 +02:00
nix: re-run the host's store fetches on a ten-minute timer
2026-10-13 00:03:20 +02:00
swarm-ui: apply the operator's stylix theme, same as the dashboard already does
2026-08-24 14:28:25 +02:00
swarmctl: log in with the operator's own SSO account and reach the controller through the swarm domain
2026-10-12 01:25:58 +02:00
swarmctl: log in with the operator's own SSO account and reach the controller through the swarm domain
2026-10-12 01:25:58 +02:00
nix: split swarm-bao into service and deploy-mode files
2026-10-01 09:37:36 +02:00
swarm-bao-agent-pki: decide openbao's restart on the shared locale-independent compare
2026-10-13 17:00:56 +02:00
nix: re-run the host's store fetches on a ten-minute timer
2026-10-13 00:03:20 +02:00
swarm-bao-forge-publisher starts on the deploy that adds it
2026-10-08 13:59:26 +02:00
nix: finish the "moved to" comment sweep
2026-10-05 09:59:02 +02:00
grafana: query VictoriaMetrics by its swarm domain
2026-10-13 08:08:17 +02:00
nix: finish the "moved to" comment sweep
2026-10-05 09:59:02 +02:00
nix: run the review classifier in a container of its own when a host enables it
2026-10-12 13:11:21 +02:00
swarm-otel: name the port-collision assertion instead of pointing below
2026-10-05 19:22:55 +02:00
nix: re-run the host's store fetches on a ten-minute timer
2026-10-13 00:03:20 +02:00
swarm CA: retire the host-held root CA, the store holds the only anchor
2026-10-05 21:17:10 +02:00
nix: allSwarmServices turns on the review classifier
2026-10-12 13:11:21 +02:00
nix: allSwarmServices turns on the review classifier
2026-10-12 13:11:21 +02:00
nix: run the review classifier in a container of its own when a host enables it
2026-10-12 13:11:21 +02:00
deploy: move the wireguard mesh out of the namespace hives read
2026-09-07 14:24:52 +02:00
swarmctl: log in with the operator's own SSO account and reach the controller through the swarm domain
2026-10-12 01:25:58 +02:00
nix: split swarm-victorialogs into service and deploy-mode files
2026-10-01 10:03:55 +02:00
swarm-logs-auth: check agent tokens on the log store's query route
2026-10-13 08:38:05 +02:00
nix: follow-ups from the service/deploy split
2026-10-05 19:12:46 +02:00
swarm-victoriametrics: forward only the store's read API
2026-10-13 08:13:37 +02:00
swarm options: no swarm.* value depends on a deploy option or this host's hive
2026-10-04 18:13:47 +02:00
swarm-logs-auth: check agent tokens on the log store's query route
2026-10-13 08:38:05 +02:00
8d554477ca