Repository files (latest commit first)

Filename	Latest commit message	Latest commit date
atlas e3c595857e swarm-bao: keep the bootstrap policy in one file, checked against the units using it (#4698) ... setup.md's copy of the swarm-bootstrap policy still granted only the controller's first six paths, while eight units now act with the bootstrap token. The policy moves to nix/host-modules/swarm-bao-bootstrap-policy.hcl, now covering every path those units call. module-eval-bao-grants reads that file and fails when a unit whose script uses the token calls a path the file does not grant.		2026-09-24 15:55:38 +02:00
..
agent-icon.nix	nix: split module-eval into per-subsystem checks	2026-09-20 04:25:54 +02:00
agent-matrix.nix	nix: split module-eval into per-subsystem checks	2026-09-20 04:25:54 +02:00
agent-memory.nix	nix: split module-eval into per-subsystem checks	2026-09-20 04:25:54 +02:00
agent-otel.nix	module-eval: assert the severity table once, not once per tier	2026-09-20 14:23:56 +02:00
agent-plugins.nix	nix: split module-eval into per-subsystem checks	2026-09-20 04:25:54 +02:00
agent-queue-bao.nix	agent: fetch this agent's own swarm-queue credential from the store	2026-09-21 20:44:52 +02:00
bao-basics.nix	nix: split module-eval into per-subsystem checks	2026-09-20 04:25:54 +02:00
bao-controller.nix	nix: split module-eval into per-subsystem checks	2026-09-20 04:25:54 +02:00
bao-grants.nix	swarm-bao: keep the bootstrap policy in one file, checked against the units using it (#4698)	2026-09-24 15:55:38 +02:00
bao-matrix-reader.nix	module-eval: name the grafana helper the refusal readers are shaped after	2026-09-23 10:11:42 +02:00
bao-otel-collector.nix	swarm-bao: let the journald receiver read the host-linked journal	2026-09-23 23:19:31 +02:00
core-toggle.nix	nix: split module-eval into per-subsystem checks	2026-09-20 04:25:54 +02:00
grafana.nix	swarm-bao: give each hive-cert consumer its own bao identity	2026-09-23 10:11:42 +02:00
hive-otel.nix	swarm-bao: give the store's collector an explicit self-telemetry port	2026-09-23 18:04:33 +02:00
journald-severity.nix	module-eval: assert the severity table once, not once per tier	2026-09-20 14:23:56 +02:00
lib.nix	module-eval: assert the severity table once, not once per tier	2026-09-20 14:23:56 +02:00
matrix-core.nix	nix: split module-eval into per-subsystem checks	2026-09-20 04:25:54 +02:00
name-guards.nix	swarm-bao: give each hive-cert consumer its own bao identity	2026-09-23 10:11:42 +02:00
nats-authelia.nix	nix: address the swarm IdP by its domain, not by who runs it	2026-09-21 18:14:28 +02:00
secret-publisher.nix	nix: the store's own collector scrapes its metrics listener	2026-09-21 17:19:52 +02:00
swarm-otel-core.nix	nix: ship the journals of the units an apply can leave failed	2026-09-24 15:14:44 +02:00
swarm-otel-identity.nix	swarm-bao: refuse a remote reader that named seven of the eight leaves	2026-09-23 10:11:42 +02:00
swarm-services-switch.nix	nix: split module-eval into per-subsystem checks	2026-09-20 04:25:54 +02:00