atlas
ef2dfbfb31
swarm-bao: reach the store through a TLS passthrough, not a vhost ...
An agent container cannot dial the store's loopback listener: the bridge
to-loopback DROP rule is there precisely to stop that, and the store
authenticates every reader by client certificate, so the usual answer —
a gateway vhost — is the one shape that cannot work. A terminating proxy
strips the certificate and bao sees nginx as the client for every hive.
nginx's stream module does not terminate. `ssl_preread` reads the SNI off
the ClientHello and splices the rest of the connection through byte for
byte, so bao completes the handshake itself and authenticates the client
it actually has. That is the no-vhost rule kept, not bent.
The listener binds the bridge IP rather than every address, because bao
already holds `127.0.0.1:<port>` in the same netns and a wildcard bind
there is EADDRINUSE — nginx would fail to start, taking the gateway with
it. Nothing moves as a result: the name already resolves two ways, so a
host-side reader still goes straight to loopback and an agent goes
through the passthrough, both on one `BAO_ADDR`.
Renders only inside the store's own `deploy.bao.enable` region; a host
that runs no store grows no listener and opens no port.
Per-agent certificates and per-agent policy are separate work.
Refs #4386
2026-09-13 23:08:38 +02:00
swarm: wire the agents' queue coordinates and credential through the modules
2026-09-13 11:13:17 +02:00
forge: move the forgejo package to deploy — slice 10 complete
2026-09-07 20:46:38 +02:00
docs: matrix gateway vhost defaults to chat.<swarm-domain>, not matrix.<domain>
2026-09-07 16:53:22 +02:00
swarm: extract the name guards, so the module just says what is forbidden
2026-08-31 18:50:15 +02:00
swarm-grafana /dashboards
swarm-grafana: surface subagent cost/turns on the agents dashboard
2026-09-13 16:40:20 +02:00
swarm-grafana: deliver the OIDC client secret through the secret store
2026-09-13 19:57:28 +02:00
forge: move the forgejo package to deploy — slice 10 complete
2026-09-07 20:46:38 +02:00
swarm: publish minted OIDC client secrets into the swarm store
2026-09-12 11:22:33 +02:00
swarm-controller: hand the daemon the authority hives are issued from
2026-09-10 00:25:07 +02:00
swarm-grafana: deliver the OIDC client secret through the secret store
2026-09-13 19:57:28 +02:00
swarm: put the matrix registration token where the reader is granted
2026-09-12 19:46:04 +02:00
swarm: run the agent queue credential reader before hive-c0re
2026-09-13 11:10:00 +02:00
swarm: publish minted OIDC client secrets into the swarm store
2026-09-12 11:22:33 +02:00
deploy: split the forge's host decisions out of swarm.forge
2026-09-07 14:24:52 +02:00
swarm: move the matrix packages to deploy, where their enable already lives
2026-09-07 20:46:37 +02:00
docs: restructure into topic subdirectories, collapse duplicated index
2026-09-02 01:55:37 +02:00
docs: restructure into topic subdirectories, collapse duplicated index
2026-09-02 01:55:37 +02:00
docs: restructure into topic subdirectories, collapse duplicated index
2026-09-02 01:55:37 +02:00
docs: restructure into topic subdirectories, collapse duplicated index
2026-09-02 01:55:37 +02:00
bao: write the swarm controller's policy from inside the store
2026-09-07 18:43:09 +02:00
otel: scrape each collector's own loss counters
2026-09-12 10:34:06 +02:00
swarm-ui: apply the operator's stylix theme, same as the dashboard already does
2026-08-24 14:28:25 +02:00
nix: inline the swarm sub-path aliases at their use sites
2026-09-13 20:02:20 +02:00
swarm-bao: reach the store through a TLS passthrough, not a vhost
2026-09-13 23:08:38 +02:00
swarm-ca: state the store-is-world-readable rule once, not three times
2026-09-02 09:03:35 +02:00
fix( #3363 ): swarm containers write their own resolver file
2026-08-17 17:30:15 +02:00
swarm-controller: hand the daemon the authority hives are issued from
2026-09-10 00:25:07 +02:00
nix: inline the swarm sub-path aliases at their use sites
2026-09-13 20:02:20 +02:00
swarm: present tense + no-queue-coordinates wording
2026-09-13 12:01:58 +02:00
nix: inline the swarm sub-path aliases at their use sites
2026-09-13 20:02:20 +02:00
docs+nix: fix stale certFingerprint/HYPERHIVE_PEERS references (hyperhive#3294)
2026-08-15 19:56:11 +02:00
deploy: rename enableAllLocalDefaults to deploy.singleHostSwarm
2026-08-30 20:12:16 +02:00
nix: inline the swarm sub-path aliases at their use sites
2026-09-13 20:02:20 +02:00
deploy: move the wireguard mesh out of the namespace hives read
2026-09-07 14:24:52 +02:00
swarm: move the controller's two packages to deploy
2026-09-07 20:46:38 +02:00
nix: inline the swarm sub-path aliases at their use sites
2026-09-13 20:02:20 +02:00
nix: inline the swarm sub-path aliases at their use sites
2026-09-13 20:02:20 +02:00
deploy: move the wireguard mesh out of the namespace hives read
2026-09-07 14:24:52 +02:00
swarm: say "no queue coordinates", never "a hive with no queue"
2026-09-13 11:13:17 +02:00
ef2dfbfb31