vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

glue: hive-otel's ordering after authelia moves out of the otel module

Browse source 
The hive collector's secret-wait unit read deploy.authelia.enable to
order itself after authelia's container. That ordering is now set by
glue-hive-otel-authelia.nix, which restates the unit's own gate (otel's
`waits`). The rendered unit is unchanged.

The hive-otel module-eval fixture `hiveOtel` gains authelia, and a case
pins the edge with authelia here and its absence without.

Part of #3742.
This commit is contained in:
atlas 2026-10-13 10:35:25 +02:00 • committed by mara
commit 40ebd45c66
4 changed files with 64 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

40
nix/host-modules/glue-hive-otel-authelia.nix Normal file
View file

@ -0,0 +1,40 @@
# Glue: where authelia runs on this host, the hive collector's wait for its
# client secret file is ordered after authelia's container, because the
# named file may be one authelia mints.
#
# ONE PAIRING PER FILE — the hive collector's secret-wait unit ← authelia's
# container, and nothing else. Deleting this leaves a wait that polls for the
# file without ordering against anything, which is what a host without
# authelia already gets.
#
# ⚠️ Gated on the unit existing, not only on authelia being here: setting
# `systemd.services.hive-otel-client-secret.after` on a host without the unit
# would define one with no ExecStart. The gate restates ./otel.nix's `waits`
# (a sender identity, and a secret file that is not the one the store fetch
# writes); a change to `waits` must change it here too.
{
lib,
config,
...
}:
let
hyperhiveCfg = config.services.hyperhive;
otel = hyperhiveCfg.otel;
autheliaMachine = hyperhiveCfg.swarm.authelia.machine;
# ./otel.nix: `senderAuth`, `hiveLeaf`, `fetches`, `fetchedSecretPath`.
senderAuth = otel.clientSecretFile != null && hyperhiveCfg.hiveName != null;
hiveLeaf =
hyperhiveCfg.deploy.bao.clientCertFile != null && hyperhiveCfg.deploy.bao.clientKeyFile != null;
fetchedSecretPath = "/var/lib/hive-otel-oidc/${hyperhiveCfg.swarm.authelia.hiveClientPrefix}${toString hyperhiveCfg.hiveName}.secret";
fetches = senderAuth && hiveLeaf && otel.clientSecretFile == fetchedSecretPath;
waits = senderAuth && !fetches;
in
{
config = lib.mkIf (hyperhiveCfg.deploy.authelia.enable && otel.enable && waits) {
systemd.services.hive-otel-client-secret = {
after = [ "container@${autheliaMachine}.service" ];
requires = [ "container@${autheliaMachine}.service" ];
};
};
}