atlas
b5053d9a80
swarm-bao-pki: enabling a service mints its client leaf on the same switch ...
`swarm-bao-pki` was a `RemainAfterExit` oneshot. Once active, nothing
re-ran it: a switch restarts it only when its definition changes, and a
`Requires=`/`Wants=` on an active unit is satisfied without running it.
On muede-lpt2 the 10:57Z switch that added the builder line did change
the unit, so switch-to-configuration stopped it in its stop phase. A
start of `container@swarm-bao` 4 s later (before the daemon-reload at
10:57:35Z) pulled it back in through `swarm-bao-certs` with the OLD
definition, which had no builder line: 48 ms, nothing missing. The start
phase then found it active and did nothing. The 20:14Z switch that
enabled the builder left the unit unchanged, so it was never re-run, and
`container@swarm-builder` crash-looped on the absent `builder.pem`.
The unit now goes inactive after each run. Every switch starts
`multi-user.target`, which runs it again post-reload with the current
definition, and every unit that wants or requires it runs it on its own
start. Each line is idempotent on presence, so an existing leaf is never
re-signed.
The three consumers started from `machines.target` rather than
`multi-user.target` also want it, since `After=` alone does not order
against a job in another transaction: the builder's and the review
classifier's containers (nspawn `--load-credential`) and
`swarm-nats-auth-secrets` (pulled in by the queue's container).
Fixes #5284
2026-10-15 08:31:33 +02:00
swarm-logs: authenticate as the agent with its own queue secret
2026-10-13 08:38:05 +02:00
CI and devshell comments say what the config does: jobTimeout bounds jobs, coverage runs nightly, dead timeout keys removed
2026-10-15 08:27:32 +02:00
swarm CA: describe the store's pki root as the only anchor in docs and comments
2026-10-05 21:17:10 +02:00
swarm-bao-agent-pki: decide openbao's restart on the shared locale-independent compare
2026-10-13 17:00:56 +02:00
swarm-grafana /dashboards
swarm-grafana: drop stale windows from the subscription usage line, match sibling panel interval
2026-10-07 23:54:53 +02:00
bao: disable the unused approle auth method, declaratively
2026-09-28 22:58:36 +02:00
swarm-otel: scrape nats through its published name
2026-10-15 08:03:46 +02:00
swarm builder: the all-swarm-services switch turns it on, like every other swarm service
2026-10-15 05:44:37 +02:00
grafana: mint the admin password into the store and apply it on every start
2026-10-12 15:16:53 +02:00
glue: consumers' start-after-bao ordering moves into one glue module
2026-10-13 22:05:16 +02:00
swarm-bao-pki: enabling a service mints its client leaf on the same switch
2026-10-15 08:31:33 +02:00
bao: OIDC login to the browser UI via authelia, as a metadata-only viewer
2026-09-28 19:56:38 +02:00
swarm-builder: build each agent config PR head and post a commit status
2026-10-14 03:30:46 +02:00
nix: gate hive-c0re on deploy.hive-controller.enable, drop hyperhive.enable
2026-09-26 01:19:49 +02:00
glue: the controller's authelia and otel environment moves out of the controller module
2026-10-14 10:15:29 +02:00
glue: the controller's authelia and otel environment moves out of the controller module
2026-10-14 10:15:29 +02:00
glue: forge's controller-dependent settings move out of the forge module
2026-10-13 22:14:28 +02:00
nix: gate hive-c0re on deploy.hive-controller.enable, drop hyperhive.enable
2026-09-26 01:19:49 +02:00
nix: gate hive-c0re on deploy.hive-controller.enable, drop hyperhive.enable
2026-09-26 01:19:49 +02:00
glue: hive-otel's ordering after authelia moves out of the otel module
2026-10-13 22:04:52 +02:00
hive-tls: the gateway leaf uses the services-issuer identity, not a hive's
2026-10-06 14:54:07 +02:00
swarm-logs-auth: check agent tokens on the log store's query route
2026-10-13 08:38:05 +02:00
swarm-nats, matrix: the queue's and matrix-ctl's store identity paths are their own, not the hive's
2026-10-06 12:04:48 +02:00
swarm: OIDC clients registered wherever authelia runs; nats + matrix secrets from bao
2026-10-05 09:58:02 +02:00
swarm-nats: the auth responder's store identity path is its own, not the hive's
2026-10-06 10:04:30 +02:00
swarm-nats, matrix: the queue's and matrix-ctl's store identity paths are their own, not the hive's
2026-10-06 12:04:48 +02:00
swarm: OIDC clients registered wherever authelia runs; nats + matrix secrets from bao
2026-10-05 09:58:02 +02:00
glue: nats firewall on the wireguard interface moves out of the nats module
2026-10-14 10:15:19 +02:00
swarm-bao-pki: sign every other hive's three store leaves
2026-10-12 21:41:28 +02:00
nix: run the review classifier in a container of its own when a host enables it
2026-10-12 13:11:21 +02:00
glue: the secret publisher's authelia-dependent settings move out of the publisher module
2026-10-14 01:52:53 +02:00
nix: gate hive-c0re on deploy.hive-controller.enable, drop hyperhive.enable
2026-09-26 01:19:49 +02:00
ops: update option pointers after grafana/bao split
2026-10-01 09:53:04 +02:00
ops: update option pointers after otel split
2026-10-01 13:00:40 +02:00
swarm-controller: revoke matrix admin from former operators
2026-10-05 12:39:02 +02:00
glue: consumers' start-after-bao ordering moves into one glue module
2026-10-13 22:05:16 +02:00
nix: run swarm-ui wherever swarm-controller runs
2026-10-13 20:05:19 +02:00
swarm-ci-runner: run the forge CI runner as a swarm service
2026-10-05 13:55:37 +02:00
CI and devshell comments say what the config does: jobTimeout bounds jobs, coverage runs nightly, dead timeout keys removed
2026-10-15 08:27:32 +02:00
hive CA: catch a deleted CA file however its path is spelled
2026-10-05 21:17:10 +02:00
nix: finish the current-behaviour comment sweep in touched files
2026-10-05 09:58:57 +02:00
swarm-nats: take the callout issuer and user keys from the store
2026-10-06 14:53:33 +02:00
nats-callout-removed: remove the container's OIDC secret copy here, ungated
2026-10-06 15:25:29 +02:00
hive otel: keep file_storage defined when the collector authenticates upstream
2026-10-14 10:13:58 +02:00
swarm-ui: apply the operator's stylix theme, same as the dashboard already does
2026-08-24 14:28:25 +02:00
swarm-otel: scrape authelia through its published name
2026-10-14 10:15:41 +02:00
authelia: render the swarm apex's operator rules wherever authelia runs
2026-10-14 23:41:13 +02:00
nix: split swarm-bao into service and deploy-mode files
2026-10-01 09:37:36 +02:00
glue: the controller's authelia and otel environment moves out of the controller module
2026-10-14 10:15:29 +02:00
swarm-bao-pki: enabling a service mints its client leaf on the same switch
2026-10-15 08:31:33 +02:00
glue: consumers' start-after-bao ordering moves into one glue module
2026-10-13 22:05:16 +02:00
swarmctl: on a controller host, trust the swarm's root without SWARMCTL_CA_FILE
2026-10-14 12:49:16 +02:00
swarm-otel: scrape grafana through its published name
2026-10-14 23:45:04 +02:00
swarm-otel: scrape grafana through its published name
2026-10-14 23:45:04 +02:00
swarm-otel: scrape nats through its published name
2026-10-15 08:03:46 +02:00
swarm-bao-pki: enabling a service mints its client leaf on the same switch
2026-10-15 08:31:33 +02:00
swarm-otel: scrape nats through its published name
2026-10-15 08:03:46 +02:00
swarm-victoriametrics: own network namespace, gateway over a unix socket
2026-10-14 18:15:20 +02:00
swarm CA: retire the host-held root CA, the store holds the only anchor
2026-10-05 21:17:10 +02:00
swarm builder: the all-swarm-services switch turns it on, like every other swarm service
2026-10-15 05:44:37 +02:00
swarm-bao-pki: enabling a service mints its client leaf on the same switch
2026-10-15 08:31:33 +02:00
swarm-builder: build each agent config PR head and post a commit status
2026-10-14 03:30:46 +02:00
swarm snapshot store: the receiver socket binds the mesh address even when wg-hive comes up after sockets.target
2026-10-15 08:27:54 +02:00
swarm-ui: name the group the operator rule actually requires
2026-10-14 23:41:13 +02:00
CI and devshell comments say what the config does: jobTimeout bounds jobs, coverage runs nightly, dead timeout keys removed
2026-10-15 08:27:32 +02:00
swarm-victoriametrics: own network namespace, gateway over a unix socket
2026-10-14 18:15:20 +02:00
swarm-victoriametrics: own network namespace, gateway over a unix socket
2026-10-14 18:15:20 +02:00
swarm-victoriametrics: require 1.153.0, carry the history off the DynamicUser path
2026-10-14 18:15:20 +02:00
swarm options: no swarm.* value depends on a deploy option or this host's hive
2026-10-04 18:13:47 +02:00
swarm-otel: scrape nats through its published name
2026-10-15 08:03:46 +02:00
b5053d9a80