vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

docs: trim the reload rationale to the live constraint

Browse source 
Keeps why the setting exists (the bridge writes this file and cannot
restart authelia) and drops the incident narrative and the answered
objections -- that history belongs in the PR discussion, not in three
comment blocks a future reader has to scroll past.
This commit is contained in:
atlas 2026-08-17 19:25:27 +02:00
commit 4c7865cd8b
3 changed files with 11 additions and 49 deletions
Download patch file Download diff file Expand all files Collapse all files

25
nix/host-modules/swarm-authelia.nix
View file

@ -967,25 +967,12 @@ in
server.address = "tcp://127.0.0.1:${toString cfg.port}";
log.level = "info";
# Authelia reads this file once, at STARTUP. `watch` makes it
# re-read on change, and that is load-bearing rather than a
# convenience.
#
# `swarm-authelia-bridge` writes this file to create agent
# identities and **cannot** restart authelia: running
# unprivileged inside the container is the whole reason it is
# allowed to write the file at all, so "restart the unit" is
# exactly the privilege it was designed not to hold. Without
# `watch` every identity it creates is real on disk and
# invisible to the running authelia until something unrelated
# bounces the unit.
#
# `swarmctl` does restart authelia after writing — but that is
# a `systemctl -M` shellout that can fail, and when it did the
# symptom was a login refused for a user whose record was
# already correct on disk, with nothing implicating the
# reload. This setting is what makes correctness stop
# depending on that restart succeeding.
# `watch` is load-bearing, not a convenience: authelia reads
# this file once at startup, and `swarm-authelia-bridge` writes
# it to create agent identities while being unable to restart
# authelia — running unprivileged is the whole reason it may
# write the file at all. Without this, an identity it creates is
# real on disk and invisible until something unrelated restarts.
authentication_backend.file = {
path = cfg.usersFile;
watch = true;

3
nix/host-modules/swarm-controller.nix
View file

@ -29,9 +29,6 @@ let
# parameters baked into a hash have to match the verifier's.
SWARMCTL_AUTHELIA_BIN = "${autheliaCfg.package}/bin/authelia";
SWARMCTL_AUTHELIA_USERS_FILE = autheliaCfg.hostUsersFile;
# No MACHINE/UNIT here any more: `swarmctl` no longer restarts authelia,
# because authelia watches the users file itself. Those two values existed
# solely to name a `systemctl -M` target.
};
natsCfg = config.services.hyperhive.swarm.nats;