vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

name the mint, not the publisher, as the writer of the client secrets

Browse source 
Finishes the sweep of prose that said the publisher unit writes or carries the OIDC client secrets: rust docs, nix comments and option descriptions, test names and docs.
This commit is contained in:
atlas 2026-10-30 04:32:22 +01:00 • committed by mara
commit 2fc63d844b
4 changed files with 52 additions and 52 deletions
Download patch file Download diff file Expand all files Collapse all files

2
nix/module-eval/bao-grants.nix
View file

@ -2417,7 +2417,7 @@ let
&& !(lib.hasInfix "appservice-registration" baoGrantHere.systemd.services.swarm-bao-controller-policy.script);
}
{
# The controller's own OIDC client secret, which the publisher writes and
# The controller's own OIDC client secret, which authelia's mint writes and
# the controller reads at start. Pinned as the whole stanza, so an added
# capability fails.
name = "the controller reads its own client secret and cannot write it";

2
nix/module-eval/bao-otel-collector.nix
View file

@ -421,7 +421,7 @@ let
# for: the reader's grant is one path under `services`, so a secret
# filed under the hive that happens to run the store would be refused
# rather than missing, however correct the path reads.
name = "the forwarder's secret is read from the prefix the publisher writes";
name = "the forwarder's secret is read from the prefix the mint writes";
ok =
let
s = baoWithCollector.systemd.services.swarm-bao-forwarder-oidc.script;

2
nix/module-eval/grafana.nix
View file

@ -315,7 +315,7 @@ let
# refused rather than empty, however correct it reads. The negative arm is
# the rename this is exposed to — a secret filed under the hive that runs
# the service instead of under the service itself.
name = "grafana's OIDC secret is read from the prefix the publisher writes";
name = "grafana's OIDC secret is read from the prefix the mint writes";
ok =
let
s = grafanaRemoteAuthelia.systemd.services.swarm-bao-grafana-oidc.script;

2
nix/module-eval/swarm-otel-core.nix
View file

@ -125,7 +125,7 @@ let
# Same 403-not-a-miss reason as grafana's arm above: the reader's grant
# covers the `services` prefix, so a path outside it is refused rather
# than empty, however correct it reads.
name = "the collector's OIDC secret is read from the prefix the publisher writes";
name = "the collector's OIDC secret is read from the prefix the mint writes";
ok =
let
s = otelBaoRemoteAuthelia.systemd.services.swarm-bao-otel-oidc.script;