mara/hyperhive
mara/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

give the secrets unit a private tmp for its prefetched secrets

Browse source
This commit is contained in:
atlas 2026-11-04 17:17:56 +01:00 • committed by mara
commit 92f79622f9
2 changed files with 6 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

4
nix/host-modules/swarm-authelia.nix
View file

@ -1215,6 +1215,10 @@ in
storeRetry.serviceConfig storeRetry.serviceConfig
// { // {
LoadCredential = lib.attrNames storeFiles; LoadCredential = lib.attrNames storeFiles;
# `store_prefetch` keeps secret values in files under the
# temporary directory. A private one is removed by systemd when
# the unit stops, which a kill at the start timeout is too.
PrivateTmp = true;
# Bounds one run, and so the container's boot when the store # Bounds one run, and so the container's boot when the store
# accepts a connection and never answers: this unit is in the # accepts a connection and never answers: this unit is in the
# boot wait of a container with a one-minute start limit. # boot wait of a container with a one-minute start limit.

2
nix/module-eval/secret-publisher.nix
View file

@ -558,6 +558,8 @@ let
phases = lib.filter (lib.hasPrefix "phase_done ") lines; phases = lib.filter (lib.hasPrefix "phase_done ") lines;
in in
(unit secretPublisherHere).serviceConfig.TimeoutStartSec == 30 (unit secretPublisherHere).serviceConfig.TimeoutStartSec == 30
&& (unit secretPublisherHere).serviceConfig.PrivateTmp or false
&& !((unit secretPublisherNoIdentity).serviceConfig ? PrivateTmp)
&& lib.length calls == 1 && lib.length calls == 1
&& lib.length clientLeaves >= 4 && lib.length clientLeaves >= 4
&& lib.all hasLeaf clientLeaves && lib.all hasLeaf clientLeaves