atlas
c10cc0e018
swarm-nats: take the callout issuer and user keys from the store ...
`swarm-bao-nats-callout-xkey` runs `ensure-callout-keys`, importing
/var/lib/swarm-nats-callout/{issuer,callout-user}.seed when present so the
keys keep their public halves, then fetches all three public halves from
the store. The verb removes each seed file once a read of the store returns
a seed; when the store's seed differs, it is kept and a warning names the
file. No tmpfiles rule touches those files, since one could run before the
import with the store sealed and leave the next run to mint a new key.
The server renders the issuer and user public halves from the fetched files,
checked for shape as the xkey's is, and does not start without them. The
responder reads both seeds from the store, so the copies into the container
and their LoadCredential entries are gone, and a tmpfiles rule removes the
copies a container still holds. `swarm-nats-callout-keys` is removed.
On the store's host the fetch unit is also ordered after
`swarm-bao-secret-publisher-policy`, so the publisher's denial of the seed
paths is written before the unit creates or keeps a seed there.
`deploy.nats.autoGenerateCallout`, `calloutUserPublicKey`,
`calloutIssuerPublicKey`, `calloutUserSeedFile` and `calloutIssuerSeedFile`
are removed with `mkRemovedOptionModule`, under `swarm.nats` too, each
message saying the keys live in the store.
2026-10-06 14:53:33 +02:00
swarm CA: describe the store's pki root as the only anchor in docs and comments
2026-10-05 21:17:10 +02:00
swarm CA: describe the store's pki root as the only anchor in docs and comments
2026-10-05 21:17:10 +02:00
swarm CA: describe the store's pki root as the only anchor in docs and comments
2026-10-05 21:17:10 +02:00
swarm-nats: the auth responder's store identity path is its own, not the hive's
2026-10-06 10:04:30 +02:00
swarm-grafana /dashboards
hive-agent: export ACP-reported cost and context fill over OTLP
2026-09-30 22:24:06 +02:00
bao: disable the unused approle auth method, declaratively
2026-09-28 22:58:36 +02:00
swarm-nats: take the callout issuer and user keys from the store
2026-10-06 14:53:33 +02:00
swarm-nats: take the callout issuer and user keys from the store
2026-10-06 14:53:33 +02:00
swarm-nats: take the callout issuer and user keys from the store
2026-10-06 14:53:33 +02:00
swarm-nats: the auth responder's store identity path is its own, not the hive's
2026-10-06 10:04:30 +02:00
bao: OIDC login to the browser UI via authelia, as a metadata-only viewer
2026-09-28 19:56:38 +02:00
nix: gate hive-c0re on deploy.hive-controller.enable, drop hyperhive.enable
2026-09-26 01:19:49 +02:00
swarm: OIDC clients registered wherever authelia runs; nats + matrix secrets from bao
2026-10-05 09:58:02 +02:00
nix: gate hive-c0re on deploy.hive-controller.enable, drop hyperhive.enable
2026-09-26 01:19:49 +02:00
nix: gate hive-c0re on deploy.hive-controller.enable, drop hyperhive.enable
2026-09-26 01:19:49 +02:00
hive-tls: a store-only host without a hive starts its gateway with the store sealed
2026-10-04 19:45:14 +02:00
swarm-nats, matrix: the queue's and matrix-ctl's store identity paths are their own, not the hive's
2026-10-06 12:04:48 +02:00
swarm: OIDC clients registered wherever authelia runs; nats + matrix secrets from bao
2026-10-05 09:58:02 +02:00
swarm-nats: the auth responder's store identity path is its own, not the hive's
2026-10-06 10:04:30 +02:00
swarm-nats, matrix: the queue's and matrix-ctl's store identity paths are their own, not the hive's
2026-10-06 12:04:48 +02:00
swarm: OIDC clients registered wherever authelia runs; nats + matrix secrets from bao
2026-10-05 09:58:02 +02:00
nix: comments state current behaviour, not history
2026-10-05 09:58:50 +02:00
nix: gate hive-c0re on deploy.hive-controller.enable, drop hyperhive.enable
2026-09-26 01:19:49 +02:00
nix: gate hive-c0re on deploy.hive-controller.enable, drop hyperhive.enable
2026-09-26 01:19:49 +02:00
ops: update option pointers after grafana/bao split
2026-10-01 09:53:04 +02:00
ops: update option pointers after otel split
2026-10-01 13:00:40 +02:00
swarm-controller: revoke matrix admin from former operators
2026-10-05 12:39:02 +02:00
swarm-nats, matrix: the queue's and matrix-ctl's store identity paths are their own, not the hive's
2026-10-06 12:04:48 +02:00
swarm-ci-runner: run the forge CI runner as a swarm service
2026-10-05 13:55:37 +02:00
swarm-ci-runner: run the forge CI runner as a swarm service
2026-10-05 13:55:37 +02:00
hive TLS: reload the trust bundle's unit on a switch, name the missing root when it's empty
2026-10-05 21:17:10 +02:00
hive CA: catch a deleted CA file however its path is spelled
2026-10-05 21:17:10 +02:00
nix: finish the current-behaviour comment sweep in touched files
2026-10-05 09:58:57 +02:00
swarm-nats: take the callout issuer and user keys from the store
2026-10-06 14:53:33 +02:00
swarm-nats: take the callout issuer and user keys from the store
2026-10-06 14:53:33 +02:00
swarm CA: describe the store's pki root as the only anchor in docs and comments
2026-10-05 21:17:10 +02:00
swarm-ui: apply the operator's stylix theme, same as the dashboard already does
2026-08-24 14:28:25 +02:00
nix: follow-ups from the service/deploy split
2026-10-05 19:12:46 +02:00
swarm CA: describe the store's pki root as the only anchor in docs and comments
2026-10-05 21:17:10 +02:00
nix: split swarm-bao into service and deploy-mode files
2026-10-01 09:37:36 +02:00
swarm-bao: grant the queue responder the callout issuer and user keys' leaves
2026-10-06 14:53:33 +02:00
deploy: forward swarm.forge.ci to deploy.ci-runner, say what the forwarded enable needs
2026-10-05 21:36:11 +02:00
swarm CA: retire the host-held root CA, the store holds the only anchor
2026-10-05 21:17:10 +02:00
nix: finish the "moved to" comment sweep
2026-10-05 09:59:02 +02:00
swarm CA: describe the store's pki root as the only anchor in docs and comments
2026-10-05 21:17:10 +02:00
nix: finish the "moved to" comment sweep
2026-10-05 09:59:02 +02:00
swarm-nats: take the callout issuer and user keys from the store
2026-10-06 14:53:33 +02:00
swarm-otel: name the port-collision assertion instead of pointing below
2026-10-05 19:22:55 +02:00
swarm CA: describe the store's pki root as the only anchor in docs and comments
2026-10-05 21:17:10 +02:00
swarm CA: retire the host-held root CA, the store holds the only anchor
2026-10-05 21:17:10 +02:00
nix: run the forge on one host per swarm (deploy.forgejo.enable)
2026-09-24 23:56:07 +02:00
swarm: OIDC clients registered wherever authelia runs; nats + matrix secrets from bao
2026-10-05 09:58:02 +02:00
deploy: move the wireguard mesh out of the namespace hives read
2026-09-07 14:24:52 +02:00
nix: finish the current-behaviour comment sweep in touched files
2026-10-05 09:58:57 +02:00
nix: split swarm-victorialogs into service and deploy-mode files
2026-10-01 10:03:55 +02:00
nix: comments state current behaviour, not history
2026-10-05 09:58:50 +02:00
nix: follow-ups from the service/deploy split
2026-10-05 19:12:46 +02:00
swarm-ui: build the forge link from swarm.forge.domain
2026-10-02 20:02:02 +02:00
swarm options: no swarm.* value depends on a deploy option or this host's hive
2026-10-04 18:13:47 +02:00
swarm CA: retire the host-held root CA, the store holds the only anchor
2026-10-05 21:17:10 +02:00
c10cc0e018