vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

derive a missing client digest from the secret that exists

Browse source 
A client with a secret in the store or in a leftover file but no digest gets the digest of that secret instead of stopping the unit. The password reaches authelia's prompt through a pty, not argv. A lost mint race takes the winner's secret. Also name the mint, not the publisher, in the remaining rust docs.
This commit is contained in:
atlas 2026-10-30 04:17:29 +01:00 • committed by mara
commit 05665c05f3
1 changed files with 127 additions and 57 deletions
Download patch file Download diff file Expand all files Collapse all files

12
docs/swarm/credentials.md
View file

@ -89,10 +89,11 @@ The same unit mints the client secrets, straight into the store. It reads
only when the store answers and holds none does it run `authelia crypto hash generate`,
create the leaf and write the digest. Authelia keeps only the digest on disk, in
`oidc-clients/<id>.digest`, and starts from it while the store is down. A store that
can't answer a read never mints, because a second secret would rotate the first. A client with
a secret in the store but no digest, or a plaintext file but no digest, stops the unit
with exit status 3 and an `err` line naming the client; restore the digest, or delete the
leaf to mint again. `swarm-authelia-bridge` fetches its own secret from
can't answer a read never mints, because a second secret would rotate the first. A client with a
secret but no digest, in the store or in a leftover plaintext file, gets the digest of
that secret and keeps the secret; `authelia crypto hash generate` computes the digest,
with the password typed into its prompt through a pty, never in a command line.
`swarm-authelia-bridge` fetches its own secret from
`swarm/services/swarm-authelia-bridge/oidc/client` into
`/run/swarm-authelia-bridge/client-secret` before each start, and a store that doesn't
answer keeps the bridge down while it retries. A container without the publisher's
@ -102,7 +103,8 @@ identity keeps the plaintext in `oidc-clients/<id>.secret`, as before.
release left. For each, it stores the file's value when the store holds none, reads it
back, and removes the file only when the store holds the same value; it logs one line per
client containing `removed the file`. A store that holds a different value keeps both and
logs an `err` line, and a store that doesn't answer keeps the file and retries. Once no
logs an `err` line, and the unit stays failed without retrying, because only an operator can
say which value is right; a store that doesn't answer keeps the file and retries. Once no
file remains the unit does nothing. A file for a client that's no longer registered stays
in place, with a log line.