vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 2

nix: address the swarm IdP by its domain, not by who runs it

Browse source 
`swarm.authelia.url` defaulted to `https://<domain>` only when this host
ran the container, and to `null` otherwise — so the address a client is
given was a statement about co-location rather than about the swarm. A
swarm has one SSO provider; every hive addresses the same name and
resolution decides which address that reaches, exactly as
`swarm.otel.domain` already works.

The option stays nullable: "this swarm has no IdP" is still expressible,
it is just now something an operator states rather than something not
running the container produces. The Grafana fixture that exercised the
no-IdP refusal says it explicitly.

Closes #4536
This commit is contained in:
atlas 2026-09-19 20:39:19 +02:00 • committed by mara
commit 4b6214305f
4 changed files with 61 additions and 14 deletions
Download patch file Download diff file Expand all files Collapse all files

23
nix/host-modules/swarm-authelia.nix
View file

@ -458,22 +458,25 @@ in
url = lib.mkOption {
type = lib.types.nullOr lib.types.str;
default = if deployCfg.authelia.enable then "https://${cfg.domain}" else null;
defaultText = lib.literalExpression ''if enable then "https://''${domain}" else null'';
default = "https://${cfg.domain}";
defaultText = lib.literalExpression ''"https://''${domain}"'';
example = "https://auth.example.com";
description = ''
Base URL clients are sent to for authentication — the half of
this module that exists on **every** hive, not just the one
running the container.
Defaults to this host's own instance **only when this module is
the thing running it**; in that case the URL is not a guess, it
is where this module just put the container. Otherwise `null`,
and a hive that federates with a swarm sets it explicitly to
wherever the swarm's authelia lives. Null means "no SSO
configured" and consumers say so rather than inventing an
address — an endpoint baked in as a fallback is one that
resolves cleanly and points at the wrong machine.
Names {option}`domain`, and does **not** ask whether this host
runs the container: a swarm has one SSO provider, so every hive
addresses the same name and resolution decides where it is —
dnsmasq locally on the host serving the vhost, the real network
anywhere else. There is no loopback-vs-remote branch to get
wrong, the same way {option}`services.hyperhive.swarm.otel.domain`
has none.
Still nullable, for a deployment that has to say "this swarm has
no IdP" explicitly; consumers refuse rather than invent an
address when it is null.
'';
};