mara/hyperhive
mara/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

fetch the secrets unit's store leaves concurrently and log how long each phase takes

Browse source
This commit is contained in:
atlas 2026-11-04 17:04:35 +01:00
commit 197caa1e52
1 changed files with 268 additions and 9 deletions
Download patch file Download diff file Expand all files Collapse all files

50
nix/module-eval/secret-publisher.nix
View file

@ -529,6 +529,56 @@ let
&& !(onDisk.environment ? BAO_ADDR)
&& !(onDisk.serviceConfig ? LoadCredential);
}
{
# The unit runs inside the container's boot wait, so its start budget is
# the ceiling of that wait and stays at 30 s; what fits the budget is that
# every leaf the run reads is fetched together right after the login, then
# the sequential reads are answered from that. The leaves are those of
# the keys and of every `mint_client_secret` call, found by the same
# lookup, so a leaf added to either and left out of the prefetch fails
# here. The controls: the no-identity unit has no prefetch, and a call
# with its leaf left out would not be found by the lookup.
name = "the secrets unit fetches every leaf it reads in one concurrent pass after the login, inside its 30 s budget";
ok =
let
unit = m: (inAuthelia m).systemd.services.authelia-swarm-secrets;
s = (unit secretPublisherHere).script;
lines = lib.splitString "\n" s;
calls = lib.filter (l: lib.hasPrefix "store_prefetch secret/" l) lines;
prefetch = lib.head calls;
leafOf = l: builtins.match "mint_client_secret [^ ]+ ([^ ]+) .*" l;
clientLeaves = lib.concatMap (
l:
let
m = leafOf l;
in
lib.optional (m != null) (lib.head m)
) lines;
hasLeaf = leaf: lib.elem leaf (lib.splitString " " prefetch);
phases = lib.filter (lib.hasPrefix "phase_done ") lines;
in
(unit secretPublisherHere).serviceConfig.TimeoutStartSec == 30
&& lib.length calls == 1
&& lib.length clientLeaves >= 4
&& lib.all hasLeaf clientLeaves
&& lib.all (k: hasLeaf "secret/swarm/services/swarm-authelia/keys/${k}") [
"jwt"
"session"
"storage-encryption"
"oidc-hmac"
"oidc-issuer"
]
&& lib.length (lib.splitString " " prefetch) == lib.length clientLeaves + 6
&&
phases == [
"phase_done login"
"phase_done reads"
"phase_done keys"
"phase_done clients"
]
&& !(hasLeaf "secret/swarm/services/not-a-leaf")
&& !(lib.hasInfix "\nstore_prefetch secret/" (unit secretPublisherNoIdentity).script);
}
{
# The leaf crosses into the container as nspawn system credentials, and
# the unit loads them and names them in its environment. On the store's