vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

docs: trim the reload rationale to the live constraint

Browse source 
Keeps why the setting exists (the bridge writes this file and cannot
restart authelia) and drops the incident narrative and the answered
objections -- that history belongs in the PR discussion, not in three
comment blocks a future reader has to scroll past.
This commit is contained in:
atlas 2026-08-17 19:25:27 +02:00
commit 4c7865cd8b
3 changed files with 11 additions and 49 deletions
Download patch file Download diff file Expand all files Collapse all files

32
swarmctl/src/main.rs
View file

@ -343,33 +343,11 @@ fn publish(paths: &Paths, store: &UserStore) -> Result<()> {
write_atomic(&paths.store, &format!("{store_json}\n"))?;
write_atomic(&paths.users_file, &rendered)?;
// No restart. Authelia is configured with
// `authentication_backend.file.watch`, so it re-reads this file itself.
//
// This used to shell out to `systemctl -M <machine> restart <unit>`. That
// was the wrong shape twice over: it could fail (it did — a login refused
// for a user whose record was already correct on disk, with nothing in
// either log implicating the reload), and it only ever worked for THIS
// writer. `swarm-authelia-bridge` writes the same file to create agent
// identities and cannot restart anything: running unprivileged inside the
// container is the whole reason it may write the file at all. A reload
// that depends on which process did the writing is not a reload.
//
// The three objections that previously kept `watch` out of this path are
// all now answered, and they were good objections — recorded here so the
// next reader does not have to re-earn them:
//
// - "could not be verified against the pinned build" — it is now:
// authelia v4.39.20's own `validate-config` accepts `watch` and
// *rejects* a deliberate misspelling of it, so the key is recognised
// rather than silently swallowed.
// - "does the watch survive the rename(2) used above" — yes: authelia
// watches the containing *directory*, so a rename into it is observed.
// A watch on the old inode alone would indeed have missed it.
// - "can it observe a partially written file" — it cannot, and that is
// structural rather than a debounce we are trusting: every writer of
// this file goes through `write_atomic` below, so no partial content is
// ever visible under the final name. (Authelia debounces as well.)
// No restart: authelia watches this file
// (`authentication_backend.file.watch`). Deliberately not `swarmctl`'s job
// — `swarm-authelia-bridge` writes the same file and *cannot* restart
// anything, since running unprivileged is the whole reason it may write
// it. A reload that depends on which process wrote is not a reload.
Ok(())
}