atlas
92559af8e7
gateway: serve the hive dashboard on <hive>.hives.<swarm> behind authelia, drop htpasswd ...
The dashboard, its API, the swagger UI and the agent routes move to their
own vhost, `swarm.dashboardDomain` = `<hive>.hives.<swarm.domain>`, under
the swarm domain so authelia's session cookie reaches it. `/`, `/api/` and
`/api/docs/` ask authelia through `auth_request`, and authelia's
`operatorsOnly` rule for each hive's dashboard name lets only the admins
group in. The hive domain keeps matrix discovery and redirects every other
path to the new name.
The name rides as a SAN on the hive's own gateway leaf: the per-hive bao
role allows it, and hive-tls asks for it and checks coverage.
HTTP Basic auth is gone: the htpasswd writer and its test, the
`hivectl gateway` verbs and host-socket requests, the `gateway.auth`
options (now a removed-option error), the unauthorized page and the bcrypt
dependency. tmpfiles deletes a leftover gateway.htpasswd, which held
bcrypt hashes at 0644.
c0re hands out dashboard and agent URLs on the new name
(HYPERHIVE_DASHBOARD_DOMAIN), and the swarm controller's hive roster
carries each hive's dashboard name for the swarm UI's hive list.
Closes #3469
2026-10-15 21:44:27 +02:00
gateway: serve the hive dashboard on <hive>.hives.<swarm> behind authelia, drop htpasswd
2026-10-15 21:44:27 +02:00
forge: hand the OIDC client secret to forgejo from /run, not from the container's disk
2026-10-15 21:21:50 +02:00
gateway: serve the hive dashboard on <hive>.hives.<swarm> behind authelia, drop htpasswd
2026-10-15 21:44:27 +02:00
swarm-bao-agent-pki: decide openbao's restart on the shared locale-independent compare
2026-10-13 17:00:56 +02:00
swarm-grafana /dashboards
swarm-grafana: drop stale windows from the subscription usage line, match sibling panel interval
2026-10-07 23:54:53 +02:00
bao: disable the unused approle auth method, declaratively
2026-09-28 22:58:36 +02:00
swarm UI: log an agent into claude from its card; the credentials go to bao and the agent picks them up
2026-10-15 13:26:29 +02:00
forge: hand the OIDC client secret to forgejo from /run, not from the container's disk
2026-10-15 21:21:50 +02:00
swarm UI: an alerts page, read by the controller with a Viewer Grafana token from bao
2026-10-15 15:16:21 +02:00
swarm UI: an alerts page, read by the controller with a Viewer Grafana token from bao
2026-10-15 15:16:21 +02:00
swarm UI: log an agent into claude from its card; the credentials go to bao and the agent picks them up
2026-10-15 13:26:29 +02:00
bao: OIDC login to the browser UI via authelia, as a metadata-only viewer
2026-09-28 19:56:38 +02:00
swarm-builder: build each agent config PR head and post a commit status
2026-10-14 03:30:46 +02:00
swarm UI: log an agent into claude from its card; the credentials go to bao and the agent picks them up
2026-10-15 13:26:29 +02:00
nix: gate hive-c0re on deploy.hive-controller.enable, drop hyperhive.enable
2026-09-26 01:19:49 +02:00
glue: the controller's authelia and otel environment moves out of the controller module
2026-10-14 10:15:29 +02:00
glue: the controller's authelia and otel environment moves out of the controller module
2026-10-14 10:15:29 +02:00
glue: forge's controller-dependent settings move out of the forge module
2026-10-13 22:14:28 +02:00
nix: gate hive-c0re on deploy.hive-controller.enable, drop hyperhive.enable
2026-09-26 01:19:49 +02:00
nix: gate hive-c0re on deploy.hive-controller.enable, drop hyperhive.enable
2026-09-26 01:19:49 +02:00
glue: hive-otel's ordering after authelia moves out of the otel module
2026-10-13 22:04:52 +02:00
hive-tls: the gateway leaf uses the services-issuer identity, not a hive's
2026-10-06 14:54:07 +02:00
swarm-logs-auth: check agent tokens on the log store's query route
2026-10-13 08:38:05 +02:00
swarm-nats, matrix: the queue's and matrix-ctl's store identity paths are their own, not the hive's
2026-10-06 12:04:48 +02:00
swarm: OIDC clients registered wherever authelia runs; nats + matrix secrets from bao
2026-10-05 09:58:02 +02:00
swarm metrics store: the read API needs Grafana's bearer or an operator session
2026-10-15 10:48:20 +02:00
swarm-nats: the auth responder's store identity path is its own, not the hive's
2026-10-06 10:04:30 +02:00
swarm-nats, matrix: the queue's and matrix-ctl's store identity paths are their own, not the hive's
2026-10-06 12:04:48 +02:00
swarm: OIDC clients registered wherever authelia runs; nats + matrix secrets from bao
2026-10-05 09:58:02 +02:00
glue: nats firewall on the wireguard interface moves out of the nats module
2026-10-14 10:15:19 +02:00
swarm-bao-pki: sign every other hive's three store leaves
2026-10-12 21:41:28 +02:00
nix: run the review classifier in a container of its own when a host enables it
2026-10-12 13:11:21 +02:00
glue: the secret publisher's authelia-dependent settings move out of the publisher module
2026-10-14 01:52:53 +02:00
nix: gate hive-c0re on deploy.hive-controller.enable, drop hyperhive.enable
2026-09-26 01:19:49 +02:00
ops: update option pointers after grafana/bao split
2026-10-01 09:53:04 +02:00
ops: update option pointers after otel split
2026-10-01 13:00:40 +02:00
hive-matrix: run the homeserver in its own netns, behind a unix socket
2026-10-15 09:52:06 +02:00
hive-matrix: run the homeserver in its own netns, behind a unix socket
2026-10-15 09:52:06 +02:00
nix: run swarm-ui wherever swarm-controller runs
2026-10-13 20:05:19 +02:00
swarm-ci-runner: run the forge CI runner as a swarm service
2026-10-05 13:55:37 +02:00
gateway: serve the hive dashboard on <hive>.hives.<swarm> behind authelia, drop htpasswd
2026-10-15 21:44:27 +02:00
hive CA: catch a deleted CA file however its path is spelled
2026-10-05 21:17:10 +02:00
nix: finish the current-behaviour comment sweep in touched files
2026-10-05 09:58:57 +02:00
swarm-nats: take the callout issuer and user keys from the store
2026-10-06 14:53:33 +02:00
nats-callout-removed: remove the container's OIDC secret copy here, ungated
2026-10-06 15:25:29 +02:00
hive otel: keep file_storage defined when the collector authenticates upstream
2026-10-14 10:13:58 +02:00
swarm-ui: apply the operator's stylix theme, same as the dashboard already does
2026-08-24 14:28:25 +02:00
hive-matrix: run the homeserver in its own netns, behind a unix socket
2026-10-15 09:52:06 +02:00
gateway: serve the hive dashboard on <hive>.hives.<swarm> behind authelia, drop htpasswd
2026-10-15 21:44:27 +02:00
nix: split swarm-bao into service and deploy-mode files
2026-10-01 09:37:36 +02:00
gateway: serve the hive dashboard on <hive>.hives.<swarm> behind authelia, drop htpasswd
2026-10-15 21:44:27 +02:00
swarm-bao-pki: enabling a service mints its client leaf on the same switch
2026-10-15 08:31:33 +02:00
glue: consumers' start-after-bao ordering moves into one glue module
2026-10-13 22:05:16 +02:00
swarm UI: log an agent into claude from its card; the credentials go to bao and the agent picks them up
2026-10-15 13:26:29 +02:00
gateway: serve the hive dashboard on <hive>.hives.<swarm> behind authelia, drop htpasswd
2026-10-15 21:44:27 +02:00
swarm-otel: scrape grafana through its published name
2026-10-14 23:45:04 +02:00
swarm UI: an alerts page, read by the controller with a Viewer Grafana token from bao
2026-10-15 15:16:21 +02:00
hive-matrix: run the homeserver in its own netns, behind a unix socket
2026-10-15 09:52:06 +02:00
agent permissions: one set, tool groups included, set at agent creation
2026-10-15 18:01:40 +02:00
swarm-otel: scrape nats through its published name
2026-10-15 08:03:46 +02:00
swarm-victoriametrics: own network namespace, gateway over a unix socket
2026-10-14 18:15:20 +02:00
swarm CA: retire the host-held root CA, the store holds the only anchor
2026-10-05 21:17:10 +02:00
swarm UI: log an agent into claude from its card; the credentials go to bao and the agent picks them up
2026-10-15 13:26:29 +02:00
swarm-bao-pki: enabling a service mints its client leaf on the same switch
2026-10-15 08:31:33 +02:00
swarm UI: log an agent into claude from its card; the credentials go to bao and the agent picks them up
2026-10-15 13:26:29 +02:00
swarm snapshot store: the receiver socket binds the mesh address even when wg-hive comes up after sockets.target
2026-10-15 08:27:54 +02:00
gateway: serve the hive dashboard on <hive>.hives.<swarm> behind authelia, drop htpasswd
2026-10-15 21:44:27 +02:00
CI and devshell comments say what the config does: jobTimeout bounds jobs, coverage runs nightly, dead timeout keys removed
2026-10-15 08:27:32 +02:00
swarm-victoriametrics: own network namespace, gateway over a unix socket
2026-10-14 18:15:20 +02:00
swarm-victoriametrics: own network namespace, gateway over a unix socket
2026-10-14 18:15:20 +02:00
swarm metrics store: the read API needs Grafana's bearer or an operator session
2026-10-15 10:48:20 +02:00
swarm options: no swarm.* value depends on a deploy option or this host's hive
2026-10-04 18:13:47 +02:00
gateway: serve the hive dashboard on <hive>.hives.<swarm> behind authelia, drop htpasswd
2026-10-15 21:44:27 +02:00
92559af8e7