vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

hive-matrix: keep tuwunel's OIDC secret on the host's /run, not in the container's root

Browse source 
swarm-bao-matrix-oidc still reads the secret from bao under matrix-ctl's
leaf, but now writes it to /run/hive-matrix-oidc on the host (tmpfs), which
the container bind-mounts read-only for tuwunel's LoadCredential. Before, it
wrote it to
/var/lib/nixos-containers/hive-matrix/var/lib/tuwunel-oidc/<id>.secret on
persistent disk, where a superseded secret stayed after rotation and went
into backups of the container root. Host tmpfiles now removes that old file.

clientSecretFile must now lie under /run/hive-matrix-oidc/, the one directory
the container shares; any other value fails at evaluation.

Rotation is unchanged: the ten-minute timer rewrites the file when the value
differs and refresh_consumer restarts tuwunel. After a reboot the secret is
fetched again; until the store answers, tuwunel does not start.

Part of #4998 (slice 4: tuwunel).
This commit is contained in:
atlas 2026-10-15 21:33:19 +02:00 • committed by mara
commit 25d282427f
4 changed files with 74 additions and 24 deletions
Download patch file Download diff file Expand all files Collapse all files

23
nix/module-eval/matrix-core.nix
View file

@ -74,22 +74,35 @@ let
}
{
# The homeserver's OIDC secret has one route, the store, under
# matrix-ctl's leaf, landing where `clientSecretFile` points inside the
# container. No unit copies it out of authelia's tree, even on a host
# that runs authelia.
# matrix-ctl's leaf, landing where `clientSecretFile` points: the host's
# /run (tmpfs), which the container sees read-only. No unit copies it out
# of authelia's tree, even on a host that runs authelia, and nothing
# writes it to persistent disk.
name = "the homeserver reads its OIDC secret from the store under matrix-ctl's leaf";
ok =
let
s = matrixBodyCap.systemd.services;
u = s.swarm-bao-matrix-oidc;
m = matrixBodyCap.services.hyperhive.deploy.matrix;
bind = matrixBodyCap.containers.hive-matrix.bindMounts."/run/hive-matrix-oidc";
tmpfiles = matrixBodyCap.systemd.tmpfiles.rules;
in
matrixBodyCap.services.hyperhive.deploy.authelia.enable
&& u.environment.BAO_CLIENT_CERT == m.ctlBaoClientCertFile
&& u.environment.BAO_CLIENT_KEY == m.ctlBaoClientKeyFile
&& m.sso.clientSecretFile == "/var/lib/tuwunel-oidc/tuwunel.secret"
&& m.sso.clientSecretFile == "/run/hive-matrix-oidc/tuwunel.secret"
&& lib.hasInfix "bao kv get -field=value secret/swarm/services/tuwunel/oidc/client" u.script
&& lib.hasInfix "/var/lib/nixos-containers/hive-matrix/var/lib/tuwunel-oidc/tuwunel.secret" u.script
&& lib.hasInfix "atomic_write_secret 0400 \"\" /run/hive-matrix-oidc/tuwunel.secret" u.script
&& !(lib.hasInfix "/var/lib" u.script)
&& !(lib.hasInfix "nixos-containers" u.script)
# The container sees the directory the unit writes, and cannot write it.
&& bind.hostPath == "/run/hive-matrix-oidc"
&& bind.isReadOnly
# tmpfiles keeps the bind source and the credential source in place and
# removes the copy an earlier version left on persistent disk.
&& lib.elem "d /run/hive-matrix-oidc 0700 root root -" tmpfiles
&& lib.elem "f /run/hive-matrix-oidc/tuwunel.secret 0400 root root -" tmpfiles
&& lib.elem "r /var/lib/nixos-containers/hive-matrix/var/lib/tuwunel-oidc/tuwunel.secret" tmpfiles
&& lib.hasInfix "refresh_consumer hive-matrix tuwunel.service" u.script
# An unpublished or empty secret fails the unit, so `storeRetry` retries it.
&& !(lib.hasInfix "exit 0" u.script)