atlas
2b21bedaa3
fix(swarm-controller): permit the socket families the daemon opens ...
The unit restricted RestrictAddressFamilies to AF_UNIX, which was correct
while the daemon only served its unix socket. It has since grown three
outbound clients -- authelia token minting and forge calls over HTTPS, and
the queue over NATS -- and every socket(AF_INET, ...) was refused by seccomp.
systemd surfaces that refusal as EAFNOSUPPORT, "Address family not supported
by protocol", so the failure names the protocol and never the sandbox. The
visible symptom was swarm agent creation failing while minting a bearer
token, with a connect error that reads like a network fault.
Permit AF_INET/AF_INET6 for those clients and AF_NETLINK, which glibc's
getaddrinfo needs to enumerate local addresses before returning one. The
rest of the unit's hardening is unchanged.
2026-08-17 16:33:22 +02:00
feat(swarm): wire a hive's queue coordinates for status publishing
2026-08-16 13:14:03 +02:00
fix: let the secret-delivery oneshots outlive their own bounded wait
2026-08-16 21:45:33 +02:00
docs+nix: fix stale certFingerprint/HYPERHIVE_PEERS references (hyperhive#3294)
2026-08-15 19:56:11 +02:00
feat(nix): issue each hive's CA under a swarm root CA
2026-08-05 15:57:50 +02:00
feat( #3265 ): swarm metrics UI as a Grafana container
2026-08-16 22:27:05 +02:00
feat(nix): move the forge host options under services.hyperhive.swarm
2026-08-05 03:44:53 +02:00
fix: let the secret-delivery oneshots outlive their own bounded wait
2026-08-16 21:45:33 +02:00
docs(3191): the gateway's comments describe a host service, not a container
2026-08-12 12:20:28 +02:00
fix( #2573 ): also add /etc/tmpfiles.d to hive-priv ReadWritePaths (same EROFS class)
2026-07-18 16:39:20 +02:00
fix( #3349 ): do not define a controller env key on hives with no controller
2026-08-16 20:55:39 +02:00
refactor(nix): a hive's domain comes out of the swarm directory
2026-08-05 22:43:17 +02:00
fix( #3343 ): move the all-local queue derivations into the deployment mode
2026-08-16 19:37:49 +02:00
docs( #3265 ): observability.md still said the endpoint was required
2026-08-16 22:27:05 +02:00
wire swarm-authelia-bridge: systemd unit, oidc client, controller auth env
2026-08-16 22:38:40 +02:00
fix(nix): a missing swarm-services leaf must not kill the whole gateway
2026-08-06 00:30:22 +02:00
fix(swarm-controller): permit the socket families the daemon opens
2026-08-17 16:33:22 +02:00
fix( #3372 ): grafana serves a unix socket instead of taking a port
2026-08-16 23:21:00 +02:00
fix( #3349 ): wait for authelia's minted secret instead of failing the boot race
2026-08-16 20:51:22 +02:00
docs+nix: fix stale certFingerprint/HYPERHIVE_PEERS references (hyperhive#3294)
2026-08-15 19:56:11 +02:00
feat( #3265 ): feed the store from the collector, and derive the pair
2026-08-16 22:27:05 +02:00
refactor( #2862 ): keep the option at services.hyperhive.snapshotStore
2026-07-31 19:03:24 +02:00
swarm-controller: serve swarm-wide service quick links (hyperhive#3289)
2026-08-15 14:24:52 +02:00
feat( #3265 ): swarm metrics store as a VictoriaMetrics container
2026-08-16 22:27:05 +02:00
docs+nix: fix stale certFingerprint/HYPERHIVE_PEERS references (hyperhive#3294)
2026-08-15 19:56:11 +02:00
feat(swarm): wire a hive's queue coordinates for status publishing
2026-08-16 13:14:03 +02:00
2b21bedaa3