atlas
d3e4951cc8
swarm-bao: refuse a remote reader that named seven of the eight leaves ...
The four-way client-cert split gives each store reader its own leaf, and
three of the four readers render only where their own leaf exists. On a
host that mints its own PKI glue-bao-tls.nix defaults all eight, so there
is nothing to do; on a hand-configured remote-store hive, omitting one
pair used to mean that unit silently did not render — a privilege-
narrowing unit absent from a green build, with the missing unit as the
only evidence.
Each of the three now asserts its own pair, shaped after
swarm-grafana.nix's haveClientIdentity assertion and named to the pair it
needs. What differs from Grafana's is the gate: these fire only where the
host demonstrably reads the store (it holds deploy.bao.clientCertFile and
clientKeyFile) and the consumer is on. A host with no store identity is
the supported no-store deployment and still evaluates; the collector's
no-secret degrade is untouched, because that host holds no clientCertFile
either.
Also rewords three passive-voice sentences in docs/swarm/secrets.md that
vale flagged, and documents what the refusal costs and where it stays
silent.
2026-09-23 10:11:42 +02:00
nix: give the gateway, resolver and bridge their own enable
2026-09-19 13:53:10 +02:00
nix: make swarm.authelia.url non-nullable, trim its docs
2026-09-21 18:14:28 +02:00
docs(gateway): describe nginx as per-host, not a deployment-wide singleton
2026-09-19 13:58:10 +02:00
swarm: extract the name guards, so the module just says what is forbidden
2026-08-31 18:50:15 +02:00
swarm-grafana /dashboards
swarm-grafana: replace busiest-agents bargauges with an actual table
2026-09-20 23:40:21 +02:00
nix: the store's own collector scrapes its metrics listener
2026-09-21 17:19:52 +02:00
swarm-controller: make socketPath readOnly instead of asserting it
2026-09-17 19:27:30 +02:00
swarm-bao: give each hive-cert consumer its own bao identity
2026-09-23 10:11:42 +02:00
swarm-controller: hand the daemon the authority hives are issued from
2026-09-10 00:25:07 +02:00
swarm-grafana: deliver the OIDC client secret through the secret store
2026-09-13 19:57:28 +02:00
swarm-bao: refuse a remote reader that named seven of the eight leaves
2026-09-23 10:11:42 +02:00
swarm-matrix-ctl: one control binary for the matrix container, not one per job
2026-09-20 22:07:16 +02:00
swarm-bao: refuse a remote reader that named seven of the eight leaves
2026-09-23 10:11:42 +02:00
swarm: publish minted OIDC client secrets into the swarm store
2026-09-12 11:22:33 +02:00
nix: the store's own collector scrapes its metrics listener
2026-09-21 17:19:52 +02:00
swarm-otel: deliver the OIDC client secret through the secret store
2026-09-14 00:58:58 +02:00
nix: give the gateway, resolver and bridge their own enable
2026-09-19 13:53:10 +02:00
nix: make swarm.authelia.url non-nullable, trim its docs
2026-09-21 18:14:28 +02:00
nix: give the gateway, resolver and bridge their own enable
2026-09-19 13:53:10 +02:00
docs: restructure into topic subdirectories, collapse duplicated index
2026-09-02 01:55:37 +02:00
docs: restructure into topic subdirectories, collapse duplicated index
2026-09-02 01:55:37 +02:00
docs: restructure into topic subdirectories, collapse duplicated index
2026-09-02 01:55:37 +02:00
bao: write the swarm controller's policy from inside the store
2026-09-07 18:43:09 +02:00
nix: give the gateway, resolver and bridge their own enable
2026-09-19 13:53:10 +02:00
swarm-ui: apply the operator's stylix theme, same as the dashboard already does
2026-08-24 14:28:25 +02:00
nix: make swarm.authelia.url non-nullable, trim its docs
2026-09-21 18:14:28 +02:00
swarm-bao: give each hive-cert consumer its own bao identity
2026-09-23 10:11:42 +02:00
swarm-ca: state the store-is-world-readable rule once, not three times
2026-09-02 09:03:35 +02:00
fix( #3363 ): swarm containers write their own resolver file
2026-08-17 17:30:15 +02:00
nix: make swarm.authelia.url non-nullable, trim its docs
2026-09-21 18:14:28 +02:00
swarm-bao: give each hive-cert consumer its own bao identity
2026-09-23 10:11:42 +02:00
nix: make swarm.authelia.url non-nullable, trim its docs
2026-09-21 18:14:28 +02:00
swarm-bao: refuse a remote reader that named seven of the eight leaves
2026-09-23 10:11:42 +02:00
docs+nix: fix stale certFingerprint/HYPERHIVE_PEERS references (hyperhive#3294)
2026-08-15 19:56:11 +02:00
nix: give the gateway, resolver and bridge their own enable
2026-09-19 13:53:10 +02:00
nix: the store's own collector scrapes its metrics listener
2026-09-21 17:19:52 +02:00
deploy: move the wireguard mesh out of the namespace hives read
2026-09-07 14:24:52 +02:00
nix: give the gateway, resolver and bridge their own enable
2026-09-19 13:53:10 +02:00
nix: give the gateway, resolver and bridge their own enable
2026-09-19 13:53:10 +02:00
nix: give the gateway, resolver and bridge their own enable
2026-09-19 13:53:10 +02:00
deploy: move the wireguard mesh out of the namespace hives read
2026-09-07 14:24:52 +02:00
swarm-bao: give each hive-cert consumer its own bao identity
2026-09-23 10:11:42 +02:00
d3e4951cc8