39 lines
1.4 KiB
Nix
39 lines
1.4 KiB
Nix
# Glue: register the speech-to-text service as an OIDC client wherever authelia
|
|
# runs.
|
|
#
|
|
# ONE PAIRING PER FILE — swarm-stt ← authelia, and nothing else.
|
|
# Deleting this leaves a router whose token requests authelia answers with a
|
|
# 401, and no minted secret for authelia's mint to put in the store.
|
|
#
|
|
# ⚠️ Gated on authelia being HERE, and NOT on this host running the router,
|
|
# for ./glue-controller-oidc-client.nix's reason: a client is a row in THIS
|
|
# host's provider config. Registered whether or not any host enables the
|
|
# router: nothing in `swarm.*` records that, so a swarm without one carries
|
|
# one unused client and one unused minted secret.
|
|
{
|
|
lib,
|
|
config,
|
|
...
|
|
}:
|
|
let
|
|
hyperhiveCfg = config.services.hyperhive;
|
|
deployCfg = hyperhiveCfg.deploy;
|
|
clientId = hyperhiveCfg.swarm.stt.clientId;
|
|
in
|
|
{
|
|
config = lib.mkIf deployCfg.authelia.enable {
|
|
services.hyperhive.swarm.authelia.oidc.clients = [
|
|
{
|
|
id = clientId;
|
|
description = "HyperHive speech-to-text service";
|
|
# `client_credentials`: a daemon authenticating as itself.
|
|
kind = "machine";
|
|
audience = [ clientId ];
|
|
# The container's journal forwarder mints its token as this client, for
|
|
# the swarm collector's receiver, which verifies it offline against
|
|
# `/jwks.json`; authelia's default opaque handle fails there.
|
|
accessTokenSignedResponseAlg = "RS256";
|
|
}
|
|
];
|
|
};
|
|
}
|