vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

swarmctl: log in with the operator's own SSO account and reach the controller through the swarm domain

Browse source 
`swarmctl --swarm https://<swarm> login` runs the OAuth 2.0
authorization-code flow with PKCE against the swarm's authelia as a new
public `swarmctl` client: a pushed authorization request, the browser login
and explicit consent, and the code delivered by form_post to a loopback
port. The access and refresh tokens are cached at mode 0600 under
$XDG_STATE_HOME/swarmctl/ and refreshed under a file lock, since authelia
rotates the refresh token and revokes the login when a used one is
presented again. With --swarm (or SWARMCTL_SWARM), the agent, schedule and
forge verbs send their requests to https://<swarm>/api/ with the bearer
token instead of over the controller's unix socket, which stays the default.

authelia registers the client on every authelia host with a swarm domain:
`kind = "native"`, public, no minted secret, scopes offline_access and
authelia.bearer.authz, audience https://<swarm>/api/ (matched as a URL
prefix), redirect http://127.0.0.1/callback (any loopback port). Every
field is one authelia 4.39.20's validator requires for a public client
holding the bearer scope.

The swarm apex's /api/ answers a refused caller that sent an
Authorization header with the 401 itself instead of the login redirect,
so the CLI can tell "log in again" apart from an answer; a browser still
gets the redirect. The bearer token is not forwarded to the controller.

Refs #4409 (mara: c94764, c94782).
This commit is contained in:
atlas 2026-10-11 23:43:29 +02:00 • committed by mara
commit 2df19e4899
17 changed files with 1118 additions and 122 deletions
Download patch file Download diff file Expand all files Collapse all files

12
swarmctl/Cargo.toml
View file

@ -10,6 +10,8 @@ path = "src/main.rs"
[dependencies]
anyhow.workspace = true
# PKCE verifier, state and S256 challenge for `swarmctl login`.
base64.workspace = true
chrono.workspace = true
# `agent create` — bare HTTP/1.1 client over swarm-controller's unix
# socket. No new workspace dependency: `bytes`, `http-body-util`,
@ -18,14 +20,22 @@ bytes = "1"
clap.workspace = true
clap-markdown = "0.1"
clap_complete.workspace = true
getrandom.workspace = true
hive-types.workspace = true
http-body-util.workspace = true
hyper.workspace = true
# `server`: the loopback listener `swarmctl login` receives its code on.
hyper = { workspace = true, features = ["server"] }
hyper-util.workspace = true
# HTTPS to the swarm domain and its SSO provider, for `--swarm`.
reqwest.workspace = true
# `flock` on the login cache, which a refresh must not race.
rustix.workspace = true
serde.workspace = true
serde_json.workspace = true
serde_norway = "0.9.42"
sha2.workspace = true
tokio.workspace = true
url.workspace = true
[lints]
workspace = true