From 3be6096c260f68dc77c5d31aca1c426c4267c301 Mon Sep 17 00:00:00 2001
From: atlas <atlas@hyperhive.local>
Date: Tue, 13 Oct 2026 10:15:19 +0200
Subject: [PATCH] glue: the secret publisher's authelia-dependent settings move
 out of the publisher module

The publisher's `enable` default read `deploy.authelia.enable` from the
publisher's own module (swarm-secret-publisher.nix). It now defaults to
`false`, and glue-secret-publisher-authelia.nix sets it `mkDefault true`
wherever authelia runs, so the effective value is unchanged. The option
loses its `defaultText`, and its description names the glue.

The `deploy.authelia.enable` read in `active` stays: every file the unit
copies is under authelia's `hostClientSecretDir`, so it is a requirement
of the unit, not a co-location toggle.

Part of #3742.
---
 nix/host-modules/default.nix                  |  1 +
 .../glue-secret-publisher-authelia.nix        | 24 +++++++++++++++++++
 nix/host-modules/swarm-secret-publisher.nix   | 12 ++++++----
 nix/module-eval/secret-publisher.nix          |  3 ++-
 4 files changed, 34 insertions(+), 6 deletions(-)
 create mode 100644 nix/host-modules/glue-secret-publisher-authelia.nix

diff --git a/nix/host-modules/default.nix b/nix/host-modules/default.nix
index ff894b82..6e603cf2 100644
--- a/nix/host-modules/default.nix
+++ b/nix/host-modules/default.nix
@@ -45,6 +45,7 @@
     ./glue-otel-scrape-targets.nix
     ./glue-queue-agent-credential.nix
     ./glue-review-classifier-oidc-client.nix
+    ./glue-secret-publisher-authelia.nix
     ./glue-secret-publisher-bao-identity.nix
     ./glue-swarm-bao-otel-oidc-client.nix
     ./glue-swarm-otel-oidc-client.nix
diff --git a/nix/host-modules/glue-secret-publisher-authelia.nix b/nix/host-modules/glue-secret-publisher-authelia.nix
new file mode 100644
index 00000000..059f25a5
--- /dev/null
+++ b/nix/host-modules/glue-secret-publisher-authelia.nix
@@ -0,0 +1,24 @@
+# Glue: turn the secret publisher on wherever authelia mints the secrets.
+#
+# ONE PAIRING PER FILE — publisher ← authelia, and nothing else. Deleting this
+# leaves the publisher off unless an operator enables it, so every OIDC client
+# secret authelia mints stays on this host and no reader gets one, this
+# host's included.
+#
+# ⚠️ Gated on authelia alone, NOT on `deploy.bao.enable`: a publisher beside a
+# remote store, holding a leaf issued out of band, is a deployment the
+# publisher exists to serve (see that option's description).
+{
+  lib,
+  config,
+  ...
+}:
+let
+  deployCfg = config.services.hyperhive.deploy;
+in
+{
+  # `mkDefault`: an operator's explicit value wins.
+  config = lib.mkIf deployCfg.authelia.enable {
+    services.hyperhive.deploy.swarm-secret-publisher.enable = lib.mkDefault true;
+  };
+}
diff --git a/nix/host-modules/swarm-secret-publisher.nix b/nix/host-modules/swarm-secret-publisher.nix
index cf03f2eb..2e2b1387 100644
--- a/nix/host-modules/swarm-secret-publisher.nix
+++ b/nix/host-modules/swarm-secret-publisher.nix
@@ -45,7 +45,9 @@ let
   haveClientIdentity = cfg.baoClientCertFile != null && cfg.baoClientKeyFile != null;
 
   # Both halves have to be here: the mint (authelia, for the plaintext) and an
-  # identity (for the store). Neither implies the other.
+  # identity (for the store). Neither implies the other. Authelia here is a
+  # requirement, not a co-location toggle: every file the unit copies is under
+  # its `hostClientSecretDir`.
   active = cfg.enable && deployCfg.authelia.enable && haveClientIdentity;
 
   hiveNames = lib.attrNames hyperhiveCfg.swarm.hives;
@@ -103,8 +105,7 @@ in
   options.services.hyperhive.deploy.swarm-secret-publisher = {
     enable = lib.mkOption {
       type = lib.types.bool;
-      default = deployCfg.authelia.enable;
-      defaultText = lib.literalExpression "deploy.authelia.enable";
+      default = false;
       description = ''
         Publish the OIDC client secrets this host mints into the swarm's
         secret store, so a hive that does not run authelia can read its
@@ -112,8 +113,9 @@ in
         controller can read its own — from wherever it runs, this host
         included.
 
-        Defaults to whether this host mints the OIDC secrets, which is the
-        only half of the question that is a property of *this* host.
+        Defaults to whether this host mints the OIDC secrets (set by
+        `glue-secret-publisher-authelia.nix`), which is the only half of the
+        question that is a property of *this* host.
 
         ⚠️ Deliberately **not** `deploy.bao.enable`. That asks whether the
         store stands here, and a publisher beside a remote store, holding a
diff --git a/nix/module-eval/secret-publisher.nix b/nix/module-eval/secret-publisher.nix
index fa03067c..3773a97e 100644
--- a/nix/module-eval/secret-publisher.nix
+++ b/nix/module-eval/secret-publisher.nix
@@ -270,7 +270,8 @@ let
     {
       # mara caught this by reading, which means no arm existed for it: the
       # default asked `authelia.enable && bao.enable`, so the split deployment
-      # this unit is FOR defaulted off and published nothing, silently.
+      # this unit is FOR defaulted off and published nothing, silently. The
+      # default is set by ../host-modules/glue-secret-publisher-authelia.nix.
       #
       # The second clause is the control. Without it this passes on a default
       # of plain `true`, which would be a different bug with the same symptom