mara/hyperhive
mara/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

authelia's store-login units wait for the container's network

Browse source
This commit is contained in:
atlas 2026-11-04 18:51:53 +01:00
commit 1665436347
1 changed files with 30 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

20
nix/module-eval/secret-publisher.nix
View file

@ -379,6 +379,26 @@ let
&& !(holdsTokenFirst "# bao login -method=cert -token-only goes here\nbao kv get secret/x")
&& holdsTokenFirst "BAO_TOKEN=\"$(bao login -method=cert -token-only)\"\nbao kv get secret/x";
}
{
# Both units log in to the store by name at boot. The container's
# bridge address comes with its DHCP lease, so each waits for
# `network-online.target`; the resolver unit is ordered before them
# already. Controls: the forwarder's fetch (which has the same ordering)
# and the no-identity units (which dial nothing).
name = "authelia's store-login units wait for the container's network and resolver";
ok =
let
svc = (inAuthelia secretPublisherHere).systemd.services;
waits = u: lib.elem "network-online.target" u.after && lib.elem "network-online.target" u.wants;
in
waits svc.authelia-swarm-secrets
&& waits svc.swarm-authelia-bridge
&& lib.elem "authelia-swarm-secrets.service" svc.swarm-bridge-dns.before
&& lib.elem "swarm-authelia-bridge.service" svc.swarm-bridge-dns.before
&& waits svc.swarm-journal-forwarder-oidc
&& !(waits (inAuthelia secretPublisherNoIdentity).systemd.services.swarm-authelia-bridge)
&& !(waits (inAuthelia secretPublisherNoIdentity).systemd.services.authelia-swarm-secrets);
}
{
# The doctrine three glue files state, as a property a rewrite has to
# keep: a client is defined by holding a certificate the store accepts,