From 3de7a4a1b139b694874de8824d8472caae64af9f Mon Sep 17 00:00:00 2001
From: atlas <atlas@pr1ma.darkest.space>
Date: Tue, 11 Aug 2026 21:56:06 +0200
Subject: [PATCH] style(3149): restore the secrets script's original
 indentation
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Review catch (argus): most of the pre-existing script body picked up ~14
leading spaces it never had, because replacing an inline `optionalString`
with a named binding changed what the formatter treated as the block's
base indent. Functionally invisible — nix strips the minimum common
indentation and bash ignores the rest — but it made the diff read as
"reindented everything, incidentally added a block" instead of "added a
block".

Net diff on this file is now 231 insertions and 2 deletions.
---
 nix/host-modules/swarm-authelia.nix | 46 ++++++++++++++---------------
 1 file changed, 23 insertions(+), 23 deletions(-)

diff --git a/nix/host-modules/swarm-authelia.nix b/nix/host-modules/swarm-authelia.nix
index 81a73f15..8aca2d44 100644
--- a/nix/host-modules/swarm-authelia.nix
+++ b/nix/host-modules/swarm-authelia.nix
@@ -455,32 +455,32 @@ in
               SyslogIdentifier = "${unitName}-secrets";
             };
             script = ''
-                            set -euo pipefail
+              set -euo pipefail
 
-                            # Each is generated once and never rotated here: the
-                            # session and storage keys are load-bearing for data
-                            # already written (sessions, the encrypted store), so
-                            # replacing one is an operator action, not a boot action.
-                            for f in ${lib.concatStringsSep " " randomKeys}; do
-                              p=${lib.escapeShellArg stateDir}/"$f".key
-                              if [ ! -s "$p" ]; then
-                                head -c 64 /dev/urandom | od -An -tx1 | tr -d ' \n' > "$p"
-                                echo "generated $p"
-                              fi
-                              chmod 0600 "$p"
-                            done
+              # Each is generated once and never rotated here: the
+              # session and storage keys are load-bearing for data
+              # already written (sessions, the encrypted store), so
+              # replacing one is an operator action, not a boot action.
+              for f in ${lib.concatStringsSep " " randomKeys}; do
+                p=${lib.escapeShellArg stateDir}/"$f".key
+                if [ ! -s "$p" ]; then
+                  head -c 64 /dev/urandom | od -An -tx1 | tr -d ' \n' > "$p"
+                  echo "generated $p"
+                fi
+                chmod 0600 "$p"
+              done
               ${oidcGenScript}
 
-                            # A users database that exists and parses, with nobody in
-                            # it. authelia refuses to start without one, and the
-                            # alternative to an empty file is a placeholder account —
-                            # which is a credential nobody meant to create.
-                            users=${lib.escapeShellArg cfg.usersFile}
-                            if [ ! -s "$users" ]; then
-                              echo "users: {}" > "$users"
-                              echo "seeded empty users database at $users"
-                            fi
-                            chmod 0600 "$users"
+              # A users database that exists and parses, with nobody in
+              # it. authelia refuses to start without one, and the
+              # alternative to an empty file is a placeholder account —
+              # which is a credential nobody meant to create.
+              users=${lib.escapeShellArg cfg.usersFile}
+              if [ ! -s "$users" ]; then
+                echo "users: {}" > "$users"
+                echo "seeded empty users database at $users"
+              fi
+              chmod 0600 "$users"
             '';
           };