atlas
694abf4439
swarm-bao: make the reader's identity declarable, not just the store's ...
`swarm-bao.nix` declared the store's half of the mTLS pair as options —
`serverCertFile`, `serverKeyFile`, `clientCaFile` — and left the reader's
half as a literal inside `glue-bao-tls.nix`, which only runs where
`deploy.bao.enable` is set. A hive that did not host the store therefore
could not read from it and could not be pointed at a certificate even
when one had been placed by hand.
Adds `clientCertFile`, `clientKeyFile` and `serverCaFile` beside their
three server siblings, `mkDefault`ed by the glue to the leaf it already
mints, and moves `glue-matrix-bao-token.nix` onto them. Its gate becomes
"this host holds an identity" rather than "the store is a neighbour",
and the unit ordering that names store-local units is now conditional --
`Requires=` on an absent unit fails the job.
`serverCaFile` is separate from `clientCaFile` on purpose: one is the
store choosing which readers to trust, the other a reader choosing which
store to trust. Self-signing collapses them to one file, which is a
property of that deployment and not of the pairing.
Closes #3855 .
2026-08-31 19:54:56 +02:00
otel: ship the journals the dashboard can already show
2026-08-31 12:51:51 +02:00
swarm: remove swarm.ui.domain, serve the UI on the swarm domain
2026-08-31 19:00:52 +02:00
deploy: move the hive CA's knobs to deploy.hive-controller.tls
2026-08-30 20:52:00 +02:00
swarm: extract the name guards, so the module just says what is forbidden
2026-08-31 18:50:15 +02:00
swarm-grafana /dashboards
grafana: rank the by-label panel as bars, and stop calling it open issues
2026-08-28 13:23:25 +02:00
glue-matrix-bao-token: the store's first reader
2026-08-30 19:01:10 +02:00
deploy: move the hive CA's knobs to deploy.hive-controller.tls
2026-08-30 20:52:00 +02:00
swarm-bao: make the reader's identity declarable, not just the store's
2026-08-31 19:54:56 +02:00
swarm-bao: make the reader's identity declarable, not just the store's
2026-08-31 19:54:56 +02:00
otel: ship the journals the dashboard can already show
2026-08-31 12:51:51 +02:00
docs: M4TR1X page is reached via swarm-ui's LinksMenu, not opened directly
2026-08-31 12:55:40 +02:00
require network isolation, deleting the residual non-isolated branch
2026-08-30 03:32:08 +02:00
fix( #2573 ): also add /etc/tmpfiles.d to hive-priv ReadWritePaths (same EROFS class)
2026-07-18 16:39:20 +02:00
deploy: move the hive CA's knobs to deploy.hive-controller.tls
2026-08-30 20:52:00 +02:00
deploy: rename enableAllLocalDefaults to deploy.singleHostSwarm
2026-08-30 20:12:16 +02:00
deploy: rename enableAllLocalDefaults to deploy.singleHostSwarm
2026-08-30 20:12:16 +02:00
deploy: move the hive CA's knobs to deploy.hive-controller.tls
2026-08-30 20:52:00 +02:00
swarm-ui: apply the operator's stylix theme, same as the dashboard already does
2026-08-24 14:28:25 +02:00
swarm: remove swarm.ui.domain, serve the UI on the swarm domain
2026-08-31 19:00:52 +02:00
swarm-bao: make the reader's identity declarable, not just the store's
2026-08-31 19:54:56 +02:00
deploy: move the hive CA's knobs to deploy.hive-controller.tls
2026-08-30 20:52:00 +02:00
fix( #3363 ): swarm containers write their own resolver file
2026-08-17 17:30:15 +02:00
swarm: remove swarm.ui.domain, serve the UI on the swarm domain
2026-08-31 19:00:52 +02:00
deploy: name the swarm collector swarm-otel, not otel
2026-08-30 04:23:22 +02:00
deploy: move the hive CA's knobs to deploy.hive-controller.tls
2026-08-30 20:52:00 +02:00
swarm: extract the name guards, so the module just says what is forbidden
2026-08-31 18:50:15 +02:00
docs+nix: fix stale certFingerprint/HYPERHIVE_PEERS references (hyperhive#3294)
2026-08-15 19:56:11 +02:00
deploy: rename enableAllLocalDefaults to deploy.singleHostSwarm
2026-08-30 20:12:16 +02:00
refactor( #2862 ): keep the option at services.hyperhive.snapshotStore
2026-07-31 19:03:24 +02:00
swarm: remove swarm.ui.domain, serve the UI on the swarm domain
2026-08-31 19:00:52 +02:00
deploy: retention is the store host's decision, not the swarm's
2026-08-30 16:23:48 +02:00
deploy: retention is the store host's decision, not the swarm's
2026-08-30 16:23:48 +02:00
docs+nix: fix stale certFingerprint/HYPERHIVE_PEERS references (hyperhive#3294)
2026-08-15 19:56:11 +02:00
swarm: remove swarm.ui.domain, serve the UI on the swarm domain
2026-08-31 19:00:52 +02:00
694abf4439