mara/hyperhive
mara/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

authelia's store-login units wait for the container's network

Browse source
This commit is contained in:
atlas 2026-11-04 18:51:53 +01:00
commit 1665436347
2 changed files with 30 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

12
nix/host-modules/swarm-authelia.nix
View file

@ -1181,6 +1181,12 @@ in
wantedBy = [ "multi-user.target" ] ++ lib.optional publishes "${unitName}.service";
before = [ "${unitName}.service" ];
requiredBy = lib.optional (!publishes) "${unitName}.service";
# The store login dials the store by name, which needs the
# container's bridge address: it exists once the DHCP lease is in,
# which is when `network-online.target` is reached
# (../container-modules/swarm-container.nix).
after = lib.optional publishes "network-online.target";
wants = lib.optional publishes "network-online.target";
# `deployCfg.authelia.package` is here for its CLI, not its
# daemon: the client secrets are minted with `authelia crypto
# hash generate`, which is the only way to produce a digest in
@ -1294,11 +1300,13 @@ in
after = [
"${unitName}-secrets.service"
"${unitName}.service"
];
]
++ lib.optional publishes "network-online.target";
wants = [
"${unitName}-secrets.service"
"${unitName}.service"
];
]
++ lib.optional publishes "network-online.target";
path = lib.optionals publishes [
pkgs.coreutils
pkgs.gnugrep

20
nix/module-eval/secret-publisher.nix
View file

@ -379,6 +379,26 @@ let
&& !(holdsTokenFirst "# bao login -method=cert -token-only goes here\nbao kv get secret/x")
&& holdsTokenFirst "BAO_TOKEN=\"$(bao login -method=cert -token-only)\"\nbao kv get secret/x";
}
{
# Both units log in to the store by name at boot. The container's
# bridge address comes with its DHCP lease, so each waits for
# `network-online.target`; the resolver unit is ordered before them
# already. Controls: the forwarder's fetch (which has the same ordering)
# and the no-identity units (which dial nothing).
name = "authelia's store-login units wait for the container's network and resolver";
ok =
let
svc = (inAuthelia secretPublisherHere).systemd.services;
waits = u: lib.elem "network-online.target" u.after && lib.elem "network-online.target" u.wants;
in
waits svc.authelia-swarm-secrets
&& waits svc.swarm-authelia-bridge
&& lib.elem "authelia-swarm-secrets.service" svc.swarm-bridge-dns.before
&& lib.elem "swarm-authelia-bridge.service" svc.swarm-bridge-dns.before
&& waits svc.swarm-journal-forwarder-oidc
&& !(waits (inAuthelia secretPublisherNoIdentity).systemd.services.swarm-authelia-bridge)
&& !(waits (inAuthelia secretPublisherNoIdentity).systemd.services.authelia-swarm-secrets);
}
{
# The doctrine three glue files state, as a property a rewrite has to
# keep: a client is defined by holding a certificate the store accepts,