atlas
aa719da571
nix: ship the journals of the units an apply can leave failed ...
The units on the path a deploy takes to TLS, the store's grants and the
swarm collector itself were not on the host collector's journald
allowlist, so an ingest outage one of them caused showed in the store
only as every source going quiet at once.
Each module names its own units, per the option's rule:
- hive-tls.nix: hive-tls-ca, swarm-services-cert
- hive-gateway: hive-gateway-self-signed-cert (self-signed mode only)
- swarm-bao.nix: the seven grant units beside
swarm-bao-services-issuer-policy
- swarm-otel.nix: container@<machine>, and
nixos-rebuild-switch-to-configuration, the transient unit nixos-rebuild
runs the activation in and whose syslog lines carry its status
The module-eval arm pins each unit as both listed and defined, since a
listed name that matches nothing is silent.
2026-09-24 15:14:44 +02:00
nix: split module-eval into per-subsystem checks
2026-09-20 04:25:54 +02:00
nix: split module-eval into per-subsystem checks
2026-09-20 04:25:54 +02:00
nix: split module-eval into per-subsystem checks
2026-09-20 04:25:54 +02:00
module-eval: assert the severity table once, not once per tier
2026-09-20 14:23:56 +02:00
nix: split module-eval into per-subsystem checks
2026-09-20 04:25:54 +02:00
agent: fetch this agent's own swarm-queue credential from the store
2026-09-21 20:44:52 +02:00
nix: split module-eval into per-subsystem checks
2026-09-20 04:25:54 +02:00
nix: split module-eval into per-subsystem checks
2026-09-20 04:25:54 +02:00
swarm-bao: grant the controller read on the agent credential prefix
2026-09-23 18:55:02 +02:00
module-eval: name the grafana helper the refusal readers are shaped after
2026-09-23 10:11:42 +02:00
swarm-bao: let the journald receiver read the host-linked journal
2026-09-23 23:19:31 +02:00
nix: split module-eval into per-subsystem checks
2026-09-20 04:25:54 +02:00
swarm-bao: give each hive-cert consumer its own bao identity
2026-09-23 10:11:42 +02:00
swarm-bao: give the store's collector an explicit self-telemetry port
2026-09-23 18:04:33 +02:00
module-eval: assert the severity table once, not once per tier
2026-09-20 14:23:56 +02:00
module-eval: assert the severity table once, not once per tier
2026-09-20 14:23:56 +02:00
nix: split module-eval into per-subsystem checks
2026-09-20 04:25:54 +02:00
swarm-bao: give each hive-cert consumer its own bao identity
2026-09-23 10:11:42 +02:00
nix: address the swarm IdP by its domain, not by who runs it
2026-09-21 18:14:28 +02:00
nix: the store's own collector scrapes its metrics listener
2026-09-21 17:19:52 +02:00
nix: ship the journals of the units an apply can leave failed
2026-09-24 15:14:44 +02:00
swarm-bao: refuse a remote reader that named seven of the eight leaves
2026-09-23 10:11:42 +02:00
nix: split module-eval into per-subsystem checks
2026-09-20 04:25:54 +02:00
aa719da571