vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

glue: the secret publisher's authelia-dependent settings move out of the publisher module

Browse source 
The publisher's `enable` default read `deploy.authelia.enable` from the
publisher's own module (swarm-secret-publisher.nix). It now defaults to
`false`, and glue-secret-publisher-authelia.nix sets it `mkDefault true`
wherever authelia runs, so the effective value is unchanged. The option
loses its `defaultText`, and its description names the glue.

The `deploy.authelia.enable` read in `active` stays: every file the unit
copies is under authelia's `hostClientSecretDir`, so it is a requirement
of the unit, not a co-location toggle.

Part of #3742.
This commit is contained in:
atlas 2026-10-13 10:15:19 +02:00 • committed by mara
commit 3be6096c26
4 changed files with 34 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

1
nix/host-modules/default.nix
View file

@ -45,6 +45,7 @@
./glue-otel-scrape-targets.nix
./glue-queue-agent-credential.nix
./glue-review-classifier-oidc-client.nix
./glue-secret-publisher-authelia.nix
./glue-secret-publisher-bao-identity.nix
./glue-swarm-bao-otel-oidc-client.nix
./glue-swarm-otel-oidc-client.nix

24
nix/host-modules/glue-secret-publisher-authelia.nix Normal file
View file

@ -0,0 +1,24 @@
# Glue: turn the secret publisher on wherever authelia mints the secrets.
#
# ONE PAIRING PER FILE — publisher ← authelia, and nothing else. Deleting this
# leaves the publisher off unless an operator enables it, so every OIDC client
# secret authelia mints stays on this host and no reader gets one, this
# host's included.
#
# ⚠️ Gated on authelia alone, NOT on `deploy.bao.enable`: a publisher beside a
# remote store, holding a leaf issued out of band, is a deployment the
# publisher exists to serve (see that option's description).
{
lib,
config,
...
}:
let
deployCfg = config.services.hyperhive.deploy;
in
{
# `mkDefault`: an operator's explicit value wins.
config = lib.mkIf deployCfg.authelia.enable {
services.hyperhive.deploy.swarm-secret-publisher.enable = lib.mkDefault true;
};
}

12
nix/host-modules/swarm-secret-publisher.nix
View file

@ -45,7 +45,9 @@ let
haveClientIdentity = cfg.baoClientCertFile != null && cfg.baoClientKeyFile != null;
# Both halves have to be here: the mint (authelia, for the plaintext) and an
# identity (for the store). Neither implies the other.
# identity (for the store). Neither implies the other. Authelia here is a
# requirement, not a co-location toggle: every file the unit copies is under
# its `hostClientSecretDir`.
active = cfg.enable && deployCfg.authelia.enable && haveClientIdentity;
hiveNames = lib.attrNames hyperhiveCfg.swarm.hives;
@ -103,8 +105,7 @@ in
options.services.hyperhive.deploy.swarm-secret-publisher = {
enable = lib.mkOption {
type = lib.types.bool;
default = deployCfg.authelia.enable;
defaultText = lib.literalExpression "deploy.authelia.enable";
default = false;
description = ''
Publish the OIDC client secrets this host mints into the swarm's
secret store, so a hive that does not run authelia can read its
@ -112,8 +113,9 @@ in
controller can read its own — from wherever it runs, this host
included.
Defaults to whether this host mints the OIDC secrets, which is the
only half of the question that is a property of *this* host.
Defaults to whether this host mints the OIDC secrets (set by
`glue-secret-publisher-authelia.nix`), which is the only half of the
question that is a property of *this* host.
⚠️ Deliberately **not** `deploy.bao.enable`. That asks whether the
store stands here, and a publisher beside a remote store, holding a

3
nix/module-eval/secret-publisher.nix
View file

@ -270,7 +270,8 @@ let
{
# mara caught this by reading, which means no arm existed for it: the
# default asked `authelia.enable && bao.enable`, so the split deployment
# this unit is FOR defaulted off and published nothing, silently.
# this unit is FOR defaulted off and published nothing, silently. The
# default is set by ../host-modules/glue-secret-publisher-authelia.nix.
#
# The second clause is the control. Without it this passes on a default
# of plain `true`, which would be a different bug with the same symptom