atlas
fbb20a56e8
fix: SetCredential with an empty value is dropped by systemd ...
`swarm-controller.service` carried `SetCredential=queue-client.secret:` — an
empty value, which systemd's parser refuses:
/etc/systemd/system/swarm-controller.service:38:
Invalid syntax, ignoring: queue-client.secret:
So the line was dropped on every daemon-reload, and `LoadCredential=` was
fatal again — precisely the failure that default was added to prevent. On a
hive where authelia has not yet minted the secret, the controller refuses to
start rather than coming up with the queue unconfigured.
It looked correct for days because the credential file happened to exist, so
the fail-soft was never exercised.
Measured with `systemd-analyze verify`: an empty value is rejected, any
non-empty one is accepted. The placeholder is a real word rather than filler —
it reaches the token request as the client secret, so authelia refuses it and
the journal names something an operator can act on.
Gate: state/eval-setcredential.sh, with the parent commit as its mutation.
2026-08-16 22:53:50 +02:00
feat(swarm): wire a hive's queue coordinates for status publishing
2026-08-16 13:14:03 +02:00
fix: let the secret-delivery oneshots outlive their own bounded wait
2026-08-16 21:45:33 +02:00
docs+nix: fix stale certFingerprint/HYPERHIVE_PEERS references (hyperhive#3294)
2026-08-15 19:56:11 +02:00
feat(nix): issue each hive's CA under a swarm root CA
2026-08-05 15:57:50 +02:00
feat( #3265 ): swarm metrics UI as a Grafana container
2026-08-16 22:27:05 +02:00
feat(nix): move the forge host options under services.hyperhive.swarm
2026-08-05 03:44:53 +02:00
fix: let the secret-delivery oneshots outlive their own bounded wait
2026-08-16 21:45:33 +02:00
docs(3191): the gateway's comments describe a host service, not a container
2026-08-12 12:20:28 +02:00
fix( #2573 ): also add /etc/tmpfiles.d to hive-priv ReadWritePaths (same EROFS class)
2026-07-18 16:39:20 +02:00
fix( #3349 ): do not define a controller env key on hives with no controller
2026-08-16 20:55:39 +02:00
refactor(nix): a hive's domain comes out of the swarm directory
2026-08-05 22:43:17 +02:00
fix( #3343 ): move the all-local queue derivations into the deployment mode
2026-08-16 19:37:49 +02:00
docs( #3265 ): observability.md still said the endpoint was required
2026-08-16 22:27:05 +02:00
wire swarm-authelia-bridge: systemd unit, oidc client, controller auth env
2026-08-16 22:38:40 +02:00
fix(nix): a missing swarm-services leaf must not kill the whole gateway
2026-08-06 00:30:22 +02:00
fix: SetCredential with an empty value is dropped by systemd
2026-08-16 22:53:50 +02:00
fix( #3370 ): give Grafana a secret_key, generated in-container on first boot
2026-08-16 22:46:21 +02:00
fix( #3349 ): wait for authelia's minted secret instead of failing the boot race
2026-08-16 20:51:22 +02:00
docs+nix: fix stale certFingerprint/HYPERHIVE_PEERS references (hyperhive#3294)
2026-08-15 19:56:11 +02:00
feat( #3265 ): feed the store from the collector, and derive the pair
2026-08-16 22:27:05 +02:00
refactor( #2862 ): keep the option at services.hyperhive.snapshotStore
2026-07-31 19:03:24 +02:00
swarm-controller: serve swarm-wide service quick links (hyperhive#3289)
2026-08-15 14:24:52 +02:00
feat( #3265 ): swarm metrics store as a VictoriaMetrics container
2026-08-16 22:27:05 +02:00
docs+nix: fix stale certFingerprint/HYPERHIVE_PEERS references (hyperhive#3294)
2026-08-15 19:56:11 +02:00
feat(swarm): wire a hive's queue coordinates for status publishing
2026-08-16 13:14:03 +02:00
fbb20a56e8