atlas
c044a33be9
fix( #3882 ): pin the gid that owns the TPM node, on both sides of the boundary ...
#3880 bound /dev/tpmrm0 into the store's container, which was necessary and
not sufficient: a bind mount preserves the host's ownership, openbao runs as a
DynamicUser with an empty CapabilityBoundingSet (so no CAP_DAC_OVERRIDE), and
the host applies no tpm udev rule at all — measured, 0 hits across all 41 host
closures against 62 rule files as a control. The node therefore keeps the
kernel default and the seal cannot open it.
A name cannot fix this. NixOS allocates system groups at activation, per
machine, so `tss` — or any group declared on both sides — gets two different
ids, and the device node carries the number. mara picked pinning a gid with an
overridable default (deploy.bao.tpmGid).
The default sits above the range NixOS auto-assigns system groups from
(400-999, measured in update-users-groups.pl) and above the normal-user range,
and below systemd's DynamicUser range (61184-65519), so it collides with
nothing any of those allocate.
The module-eval case compares the two sides rather than checking each against
a literal: the property is that they AGREE, not what they agree on. Its
absence arm is a shamir store, which never opens a TPM and must not claim a
device node's group — without it, pinning unconditionally would look identical.
2026-08-31 23:03:19 +02:00
otel: ship the journals the dashboard can already show
2026-08-31 12:51:51 +02:00
swarm: remove swarm.ui.domain, serve the UI on the swarm domain
2026-08-31 19:00:52 +02:00
deploy: move the hive CA's knobs to deploy.hive-controller.tls
2026-08-30 20:52:00 +02:00
swarm: extract the name guards, so the module just says what is forbidden
2026-08-31 18:50:15 +02:00
swarm-grafana /dashboards
grafana: rank the by-label panel as bars, and stop calling it open issues
2026-08-28 13:23:25 +02:00
glue-matrix-bao-token: the store's first reader
2026-08-30 19:01:10 +02:00
deploy: move the hive CA's knobs to deploy.hive-controller.tls
2026-08-30 20:52:00 +02:00
swarm-bao: ship the store's logs and metrics
2026-08-31 21:25:00 +02:00
swarm-bao: ship the store's logs and metrics
2026-08-31 21:25:00 +02:00
otel: ship the journals the dashboard can already show
2026-08-31 12:51:51 +02:00
docs: M4TR1X page is reached via swarm-ui's LinksMenu, not opened directly
2026-08-31 12:55:40 +02:00
require network isolation, deleting the residual non-isolated branch
2026-08-30 03:32:08 +02:00
fix( #2573 ): also add /etc/tmpfiles.d to hive-priv ReadWritePaths (same EROFS class)
2026-07-18 16:39:20 +02:00
deploy: move the hive CA's knobs to deploy.hive-controller.tls
2026-08-30 20:52:00 +02:00
deploy: rename enableAllLocalDefaults to deploy.singleHostSwarm
2026-08-30 20:12:16 +02:00
deploy: rename enableAllLocalDefaults to deploy.singleHostSwarm
2026-08-30 20:12:16 +02:00
deploy: move the hive CA's knobs to deploy.hive-controller.tls
2026-08-30 20:52:00 +02:00
swarm-ui: apply the operator's stylix theme, same as the dashboard already does
2026-08-24 14:28:25 +02:00
swarm: remove swarm.ui.domain, serve the UI on the swarm domain
2026-08-31 19:00:52 +02:00
fix( #3882 ): pin the gid that owns the TPM node, on both sides of the boundary
2026-08-31 23:03:19 +02:00
deploy: move the hive CA's knobs to deploy.hive-controller.tls
2026-08-30 20:52:00 +02:00
fix( #3363 ): swarm containers write their own resolver file
2026-08-17 17:30:15 +02:00
swarm: remove swarm.ui.domain, serve the UI on the swarm domain
2026-08-31 19:00:52 +02:00
deploy: name the swarm collector swarm-otel, not otel
2026-08-30 04:23:22 +02:00
deploy: move the hive CA's knobs to deploy.hive-controller.tls
2026-08-30 20:52:00 +02:00
swarm: extract the name guards, so the module just says what is forbidden
2026-08-31 18:50:15 +02:00
docs+nix: fix stale certFingerprint/HYPERHIVE_PEERS references (hyperhive#3294)
2026-08-15 19:56:11 +02:00
deploy: rename enableAllLocalDefaults to deploy.singleHostSwarm
2026-08-30 20:12:16 +02:00
refactor( #2862 ): keep the option at services.hyperhive.snapshotStore
2026-07-31 19:03:24 +02:00
swarm: remove swarm.ui.domain, serve the UI on the swarm domain
2026-08-31 19:00:52 +02:00
deploy: retention is the store host's decision, not the swarm's
2026-08-30 16:23:48 +02:00
deploy: retention is the store host's decision, not the swarm's
2026-08-30 16:23:48 +02:00
docs+nix: fix stale certFingerprint/HYPERHIVE_PEERS references (hyperhive#3294)
2026-08-15 19:56:11 +02:00
swarm: remove swarm.ui.domain, serve the UI on the swarm domain
2026-08-31 19:00:52 +02:00
c044a33be9