atlas
978164dc53
nix: run the forge on one host per swarm (deploy.forgejo.enable) ...
Every hive with hyperhive enabled ran its own hive-forge container, and
its gateway answered forge.<swarm> with its own bridge IP, so on a
multi-host swarm each hive talked to its own forge.
deploy.forgejo.enable defaults to false and allSwarmServices sets it with
mkDefault, like authelia and bao; singleHostSwarm gets it through that.
The forge's OIDC client moves to a glue module gated on authelia, so a
split authelia/forge swarm still registers it. CI now requires the forge
on the same host, and the controller's forgeTokenFile defaults to null
where the forge is not.
Closes #4705
Refs #3782
2026-09-24 23:56:07 +02:00
module-eval: pin the agent forge-token fetch and tea-login's removal
2026-09-24 17:48:53 +02:00
nix: split module-eval into per-subsystem checks
2026-09-20 04:25:54 +02:00
nix: split module-eval into per-subsystem checks
2026-09-20 04:25:54 +02:00
nix: split module-eval into per-subsystem checks
2026-09-20 04:25:54 +02:00
module-eval: assert the severity table once, not once per tier
2026-09-20 14:23:56 +02:00
nix: split module-eval into per-subsystem checks
2026-09-20 04:25:54 +02:00
agent: fetch this agent's own swarm-queue credential from the store
2026-09-21 20:44:52 +02:00
nix: split module-eval into per-subsystem checks
2026-09-20 04:25:54 +02:00
nix: split module-eval into per-subsystem checks
2026-09-20 04:25:54 +02:00
swarm-bao: grant the bootstrap token the queue's pki role, policy and login role
2026-09-24 17:26:31 +02:00
module-eval: name the grafana helper the refusal readers are shaped after
2026-09-23 10:11:42 +02:00
swarm-bao: let the journald receiver read the host-linked journal
2026-09-23 23:19:31 +02:00
nix: run the forge on one host per swarm (deploy.forgejo.enable)
2026-09-24 23:56:07 +02:00
nix: run the forge on one host per swarm (deploy.forgejo.enable)
2026-09-24 23:56:07 +02:00
swarm-bao: give each hive-cert consumer its own bao identity
2026-09-23 10:11:42 +02:00
swarm-bao: give the store's collector an explicit self-telemetry port
2026-09-23 18:04:33 +02:00
module-eval: assert the severity table once, not once per tier
2026-09-20 14:23:56 +02:00
module-eval: assert the severity table once, not once per tier
2026-09-20 14:23:56 +02:00
nix: split module-eval into per-subsystem checks
2026-09-20 04:25:54 +02:00
swarm-bao: give each hive-cert consumer its own bao identity
2026-09-23 10:11:42 +02:00
nix: address the swarm IdP by its domain, not by who runs it
2026-09-21 18:14:28 +02:00
swarm: default every queue URL to the queue's name on every hive
2026-09-24 17:26:31 +02:00
nix: the store's own collector scrapes its metrics listener
2026-09-21 17:19:52 +02:00
nix: ship the journals of the units an apply can leave failed
2026-09-24 15:14:44 +02:00
swarm-bao: refuse a remote reader that named seven of the eight leaves
2026-09-23 10:11:42 +02:00
nix: split module-eval into per-subsystem checks
2026-09-20 04:25:54 +02:00
978164dc53