vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

name the mint, not the publisher, as the writer of the client secrets

Browse source 
Finishes the sweep of prose that said the publisher unit writes or carries the OIDC client secrets: rust docs, nix comments and option descriptions, test names and docs.
This commit is contained in:
atlas 2026-10-30 04:32:22 +01:00 • committed by mara
commit 2fc63d844b
1 changed files with 52 additions and 52 deletions
Download patch file Download diff file Expand all files Collapse all files

14
nix/host-modules/swarm-bao.nix
View file

@ -539,8 +539,8 @@ let
}
'';
# The identity that copies authelia's minted OIDC client secrets into the
# store. Named outside `hive-*` for the same reason as the controller's: the
# The identity authelia's mint creates its OIDC client secrets in the store
# with. Named outside `hive-*` for the same reason as the controller's: the
# controller may create policies under that prefix, and a policy it can
# rewrite is not a constraint on anything.
secretPublisherPolicyName = "swarm-secret-publisher";
@ -685,7 +685,7 @@ let
swarmAppserviceRegistrationLeaf = "swarm/controller/swarm-controller/matrix/appservice-registration";
# The controller's own OIDC client secret, the nix half of
# `swarm_secret_client::queue::controller_client_path`. The publisher writes
# `swarm_secret_client::queue::controller_client_path`. Authelia's mint writes
# it; the controller reads it and holds no other copy.
controllerClientLeaf = "swarm/controller/swarm-controller/oidc/client";
@ -771,7 +771,7 @@ let
# and read like the API key above.
classifierAcpKeyLeaf = "swarm/services/review-classifier/acp-provider";
# The UI's OIDC client secret. The publisher writes it; the granter reads it
# The UI's OIDC client secret. Authelia's mint writes it; the granter reads it
# into the `oidc` auth method's config, which is the only copy bao uses.
baoUiClientLeaf = "swarm/services/${cfg.ui.oidc.clientId}/oidc/client";
@ -1672,7 +1672,7 @@ let
# own and lands it in a collector's container — because that route is
# proven and there is no second one worth inventing.
#
# Where the publisher in authelia's container leaves it. A swarm service's
# Where authelia's mint, in its container, stores it. A swarm service's
# client is registered once for the whole swarm, so its secret is one value.
# The `swarm-forwarder-oidc` role's grant is this one path, so any other
# answers 403 however correct it looks.
@ -1983,8 +1983,8 @@ in
example = "swarm-secret-publisher.svc";
description = ''
Subject the store's secret-publisher cert-auth role accepts — the
identity that copies authelia's minted OIDC client secrets into the
store so a hive that does not host authelia can read its own.
identity authelia's mint creates its OIDC client secrets in the
store with, so a hive that does not host authelia can read its own.
A **second** identity rather than reuse of
{option}`services.hyperhive.deploy.bao.controllerCommonName`: the