atlas
cc8fb0ee44
swarm-bao: let the controller write agent credentials, and gate that it can ...
Closes #4124 .
The controller's policy granted only the bootstrap paths -- hive cert-auth
roles and hive ACLs. #4113 then made it a secret WRITER, and nothing related
the grants to the paths the code writes, so every matrix token provision
answered 403. The two halves landed on different issues and neither looked
wrong on its own.
`secret/data/` is KV v2's ACL prefix and is absent from the path the code
passes, so matching `swarm-secret-client`'s spelling literally would have
granted nothing. Write-only: the controller mints these and never reads one
back, and a read capability would let it recover every agent's credentials
rather than only replace them.
The gate is the point. Two module-eval arms -- the grant exists and is not
a broader wildcard, and its capability list is pinned whole, because an
ADDED capability is what a presence check misses -- plus a test in path.rs
pinning MOUNT/AGENT_PREFIX and naming the nix file, since renaming either
constant is a silent 403 rather than a compile error.
setup.md carried two warnings this makes false: that nothing in the tree had
ever authenticated to the store, and that no deployment shape mints a leaf
whose CN reads swarm-controller. glue-bao-tls.nix has minted one since #3726
item 1.
2026-09-09 01:19:57 +02:00
hive-c0re: grant hive-admin group a polkit rule for choom
2026-09-07 23:27:15 +02:00
forge: move the forgejo package to deploy — slice 10 complete
2026-09-07 20:46:38 +02:00
docs: matrix gateway vhost defaults to chat.<swarm-domain>, not matrix.<domain>
2026-09-07 16:53:22 +02:00
swarm: extract the name guards, so the module just says what is forbidden
2026-08-31 18:50:15 +02:00
swarm-grafana /dashboards
grafana: show which sources are shipping, not just that the store is up
2026-09-08 00:43:23 +02:00
bao: mint the controller's leaf, and point the controller at it
2026-09-07 22:24:42 +02:00
forge: move the forgejo package to deploy — slice 10 complete
2026-09-07 20:46:38 +02:00
bao: mint the controller's leaf, and point the controller at it
2026-09-07 22:24:42 +02:00
bao: mint the controller's leaf, and point the controller at it
2026-09-07 22:24:42 +02:00
deploy: split the homeserver's host decisions out of swarm.matrix
2026-09-07 14:24:52 +02:00
deploy: split the forge's host decisions out of swarm.forge
2026-09-07 14:24:52 +02:00
swarm: move the matrix packages to deploy, where their enable already lives
2026-09-07 20:46:37 +02:00
docs: restructure into topic subdirectories, collapse duplicated index
2026-09-02 01:55:37 +02:00
docs: restructure into topic subdirectories, collapse duplicated index
2026-09-02 01:55:37 +02:00
docs: restructure into topic subdirectories, collapse duplicated index
2026-09-02 01:55:37 +02:00
docs: restructure into topic subdirectories, collapse duplicated index
2026-09-02 01:55:37 +02:00
bao: write the swarm controller's policy from inside the store
2026-09-07 18:43:09 +02:00
deploy: move authelia's three host paths out of swarm.authelia
2026-09-07 15:44:07 +02:00
swarm-ui: apply the operator's stylix theme, same as the dashboard already does
2026-08-24 14:28:25 +02:00
swarm: move both authelia packages to deploy
2026-09-07 20:46:38 +02:00
swarm-bao: let the controller write agent credentials, and gate that it can
2026-09-09 01:19:57 +02:00
swarm-ca: state the store-is-world-readable rule once, not three times
2026-09-02 09:03:35 +02:00
fix( #3363 ): swarm containers write their own resolver file
2026-08-17 17:30:15 +02:00
swarm-controller: accept an agent's external matrix account and put it in the store
2026-09-08 15:53:50 +02:00
grafana: show which sources are shipping, not just that the store is up
2026-09-08 00:43:23 +02:00
swarm: move the queue's responder package to deploy
2026-09-07 20:46:38 +02:00
nix: split statusPublish and the otel secret into deploy.*
2026-09-07 16:54:23 +02:00
docs+nix: fix stale certFingerprint/HYPERHIVE_PEERS references (hyperhive#3294)
2026-08-15 19:56:11 +02:00
deploy: rename enableAllLocalDefaults to deploy.singleHostSwarm
2026-08-30 20:12:16 +02:00
deploy: move the wireguard mesh out of the namespace hives read
2026-09-07 14:24:52 +02:00
swarm: move the controller's two packages to deploy
2026-09-07 20:46:38 +02:00
swarm: move both metric stores' package to deploy, and cover their shims
2026-09-07 20:46:38 +02:00
swarm: move both metric stores' package to deploy, and cover their shims
2026-09-07 20:46:38 +02:00
deploy: move the wireguard mesh out of the namespace hives read
2026-09-07 14:24:52 +02:00
nix: split statusPublish and the otel secret into deploy.*
2026-09-07 16:54:23 +02:00
cc8fb0ee44