vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

name the mint, not the publisher, as the writer of the client secrets

Browse source 
Finishes the sweep of prose that said the publisher unit writes or carries the OIDC client secrets: rust docs, nix comments and option descriptions, test names and docs.
This commit is contained in:
atlas 2026-10-30 04:32:22 +01:00 • committed by mara
commit 2fc63d844b
1 changed files with 52 additions and 52 deletions
Download patch file Download diff file Expand all files Collapse all files

8
nix/host-modules/swarm-grafana.nix
View file

@ -351,7 +351,7 @@ let
"/var/lib/grafana-metrics/bearer"
];
# Where the publisher in authelia's container leaves this client's secret. A
# Where authelia's mint, in its container, stores this client's secret. A
# swarm service's client is registered once for the whole swarm, so its
# secret is one value and not one per hive. Both ends compose this from the
# same swarm-wide client id, so a rename cannot leave one of them behind.
@ -719,8 +719,8 @@ in
++ map (p: "r ${p}") legacyHostSecretPaths;
# THE delivery unit — one route, in every deployment. The secret authelia
# minted arrives out of the swarm secret store, which the publisher in
# authelia's container wrote it into, and that is true whether authelia is
# minted arrives out of the swarm secret store, which authelia's mint,
# in its container, wrote it into, and that is true whether authelia is
# a network away or in the container next door.
#
# 🩸 No second unit copies the plaintext out of authelia's tree
@ -737,7 +737,7 @@ in
# there" into a value.
#
# ⚠️ An ABSENT secret is "not published yet", not a fault of this host's.
# The publisher runs in authelia's container and authelia mints on its
# The mint runs in authelia's container and authelia mints on its
# first boot, so early in a swarm's life there is legitimately nothing to
# read.
# Nothing here writes a stand-in: there is no such thing as a locally valid