From 1665436347ce76070385ab61aefc2ace9e9ad434 Mon Sep 17 00:00:00 2001
From: atlas <atlas@hyperhive.local>
Date: Wed, 4 Nov 2026 18:51:53 +0100
Subject: [PATCH] authelia's store-login units wait for the container's network

---
 nix/host-modules/swarm-authelia.nix  | 12 ++++++++++--
 nix/module-eval/secret-publisher.nix | 20 ++++++++++++++++++++
 2 files changed, 30 insertions(+), 2 deletions(-)

diff --git a/nix/host-modules/swarm-authelia.nix b/nix/host-modules/swarm-authelia.nix
index 35fe0316..03fc7c35 100644
--- a/nix/host-modules/swarm-authelia.nix
+++ b/nix/host-modules/swarm-authelia.nix
@@ -1181,6 +1181,12 @@ in
             wantedBy = [ "multi-user.target" ] ++ lib.optional publishes "${unitName}.service";
             before = [ "${unitName}.service" ];
             requiredBy = lib.optional (!publishes) "${unitName}.service";
+            # The store login dials the store by name, which needs the
+            # container's bridge address: it exists once the DHCP lease is in,
+            # which is when `network-online.target` is reached
+            # (../container-modules/swarm-container.nix).
+            after = lib.optional publishes "network-online.target";
+            wants = lib.optional publishes "network-online.target";
             # `deployCfg.authelia.package` is here for its CLI, not its
             # daemon: the client secrets are minted with `authelia crypto
             # hash generate`, which is the only way to produce a digest in
@@ -1294,11 +1300,13 @@ in
             after = [
               "${unitName}-secrets.service"
               "${unitName}.service"
-            ];
+            ]
+            ++ lib.optional publishes "network-online.target";
             wants = [
               "${unitName}-secrets.service"
               "${unitName}.service"
-            ];
+            ]
+            ++ lib.optional publishes "network-online.target";
             path = lib.optionals publishes [
               pkgs.coreutils
               pkgs.gnugrep
diff --git a/nix/module-eval/secret-publisher.nix b/nix/module-eval/secret-publisher.nix
index 863b942e..9a89d707 100644
--- a/nix/module-eval/secret-publisher.nix
+++ b/nix/module-eval/secret-publisher.nix
@@ -379,6 +379,26 @@ let
         && !(holdsTokenFirst "# bao login -method=cert -token-only goes here\nbao kv get secret/x")
         && holdsTokenFirst "BAO_TOKEN=\"$(bao login -method=cert -token-only)\"\nbao kv get secret/x";
     }
+    {
+      # Both units log in to the store by name at boot. The container's
+      # bridge address comes with its DHCP lease, so each waits for
+      # `network-online.target`; the resolver unit is ordered before them
+      # already. Controls: the forwarder's fetch (which has the same ordering)
+      # and the no-identity units (which dial nothing).
+      name = "authelia's store-login units wait for the container's network and resolver";
+      ok =
+        let
+          svc = (inAuthelia secretPublisherHere).systemd.services;
+          waits = u: lib.elem "network-online.target" u.after && lib.elem "network-online.target" u.wants;
+        in
+        waits svc.authelia-swarm-secrets
+        && waits svc.swarm-authelia-bridge
+        && lib.elem "authelia-swarm-secrets.service" svc.swarm-bridge-dns.before
+        && lib.elem "swarm-authelia-bridge.service" svc.swarm-bridge-dns.before
+        && waits svc.swarm-journal-forwarder-oidc
+        && !(waits (inAuthelia secretPublisherNoIdentity).systemd.services.swarm-authelia-bridge)
+        && !(waits (inAuthelia secretPublisherNoIdentity).systemd.services.authelia-swarm-secrets);
+    }
     {
       # The doctrine three glue files state, as a property a rewrite has to
       # keep: a client is defined by holding a certificate the store accepts,