vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

authelia: render the swarm apex's operator rules wherever authelia runs

Browse source 
The apex's `operatorsOnly` pair was guarded on
`deploy.swarm-controller.enable`, which is true only on the host that
runs the controller and with it the swarm UI's vhost. When authelia runs
on another host, that vhost still asks it, but the authelia host
rendered no rule for the apex at all, so every session reached the
swarm UI and its `/api/` through `default_policy = one_factor`.

The pair now renders whenever the swarm domain is set, like the bao UI's
pair. No vhost on a host that doesn't serve the apex asks about it, so
the extra rules there are inert. authelia 4.39.20's `validate-config`
accepts them on an authelia-only host's rendered access_control.

module-eval-swarm-otel-identity gains a case on the existing
`autheliaOnly` fixture (authelia without the controller): the apex has
exactly the allow+deny pair, the rule list is closed, and an account in
no group is refused `/api/agents` while `group:admins` passes.

Fixes #5120
This commit is contained in:
atlas 2026-10-14 21:47:15 +02:00 • committed by mara
commit 2a25ec3dff
2 changed files with 34 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

8
nix/host-modules/swarm-authelia.nix
View file

@ -1174,9 +1174,11 @@ in
# reasoning for both halves lives.
metricsRules
++ metricsStoreRules
# Also guarded on the domain being set: without it a null
# apex would render a rule matching the string "null".
++ lib.optionals (deployCfg.swarm-controller.enable && swarmDomain != null) (operatorsOnly {
# The swarm UI on the apex. Not keyed to a deploy flag: its
# vhost is on the swarm controller's host, which need not
# be this one. Guarded on the domain being set: without it
# a null apex would render a rule matching the string "null".
++ lib.optionals (swarmDomain != null) (operatorsOnly {
domain = swarmDomain;
})
# The store's browser UI. Not keyed to a deploy flag: its