vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

glue: the secret publisher's authelia-dependent settings move out of the publisher module

Browse source 
The publisher's `enable` default read `deploy.authelia.enable` from the
publisher's own module (swarm-secret-publisher.nix). It now defaults to
`false`, and glue-secret-publisher-authelia.nix sets it `mkDefault true`
wherever authelia runs, so the effective value is unchanged. The option
loses its `defaultText`, and its description names the glue.

The `deploy.authelia.enable` read in `active` stays: every file the unit
copies is under authelia's `hostClientSecretDir`, so it is a requirement
of the unit, not a co-location toggle.

Part of #3742.
This commit is contained in:
atlas 2026-10-13 10:15:19 +02:00 • committed by mara
commit 3be6096c26
1 changed files with 34 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

24
nix/host-modules/glue-secret-publisher-authelia.nix Normal file
View file

@ -0,0 +1,24 @@
# Glue: turn the secret publisher on wherever authelia mints the secrets.
#
# ONE PAIRING PER FILE — publisher ← authelia, and nothing else. Deleting this
# leaves the publisher off unless an operator enables it, so every OIDC client
# secret authelia mints stays on this host and no reader gets one, this
# host's included.
#
# ⚠️ Gated on authelia alone, NOT on `deploy.bao.enable`: a publisher beside a
# remote store, holding a leaf issued out of band, is a deployment the
# publisher exists to serve (see that option's description).
{
lib,
config,
...
}:
let
deployCfg = config.services.hyperhive.deploy;
in
{
# `mkDefault`: an operator's explicit value wins.
config = lib.mkIf deployCfg.authelia.enable {
services.hyperhive.deploy.swarm-secret-publisher.enable = lib.mkDefault true;
};
}