From 065f93f037c4a9f596431024bfbcf066073a60c3 Mon Sep 17 00:00:00 2001 From: atlas Date: Sun, 13 Sep 2026 22:19:13 +0200 Subject: [PATCH] fixture: give otelNoIdentity a hand-delivered forge SSO secret MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit otelNoIdentity points swarm.authelia.url at a remote authelia while deploy.authelia.enable stays false, so ssoLocal is false and nothing mkDefaults the forge's deploy.forgejo.sso.clientSecretFile. The forge module's config is gated only on services.hyperhive.enable (there is no deploy.forgejo.enable to opt out of), so its SSO assertion fired against every fixture that lacks the secret — entirely orthogonal to what this fixture tests. Supply the by-hand path, mirroring otelRemoteAuthelia's own hand-delivered secret. The swarm.otel.journaldUnits = [ "nginx" ] line added in the previous commit targeted an assertion that was never firing: journaldUnits already defaults non-empty, so the effective list just contained "nginx" twice. Removed as redundant. Refs #4374 --- nix/module-eval.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/nix/module-eval.nix b/nix/module-eval.nix index 43a3483f..e764d29f 100644 --- a/nix/module-eval.nix +++ b/nix/module-eval.nix @@ -533,7 +533,7 @@ let otelNoIdentity = hive { deploy.swarm-otel.enable = true; swarm.authelia.url = "https://auth.example.invalid"; - swarm.otel.journaldUnits = [ "nginx" ]; + deploy.forgejo.sso.clientSecretFile = "/var/lib/forgejo-oidc/by-hand.secret"; }; # authelia somewhere else, the credential delivered by hand. Whether this