From 78699ebd5ad783e89c65daa533e5ef5beb318ba0 Mon Sep 17 00:00:00 2001 From: atlas Date: Fri, 11 Sep 2026 13:17:26 +0200 Subject: [PATCH] docs/secrets: the collector's secret copy has one condition, not two MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit secrets.md said the swarm collector's OIDC secret is copied "when authelia is enabled on this host and something published is being scraped; otherwise no secret is needed and none is placed". The second condition left the tree in 5478e0bf (#3554): `swarm-otel-oidc-secret` and the client registration it delivers for are both `lib.mkIf deployCfg.authelia.enable`, and `publishedScrapeTargets` appears in neither guard. swarm-otel.nix:589 says why in as many words — authelia refuses a bearer-authz client with no audience, which is what the old guard was for, and the push audiences are unconditional, so there is now always one. The sentence survived because I rewrote the paragraph around it a day later (8cba57e0) for the collector-elsewhere case and carried the clause through. What a reader loses: with authelia on and nothing published, the page promises the delivery is inert. It is not — the unit runs, waits a bounded 120s for authelia's mint, and fails the collector's container start if the secret never appears. So the case documented as quiet is one that can fail a boot, and the operator debugging it has a page saying this path was not taken. The replacement states the single real condition and that failure mode. Closes #4210. --- docs/swarm/secrets.md | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/docs/swarm/secrets.md b/docs/swarm/secrets.md index a631ac3f..39c635a5 100644 --- a/docs/swarm/secrets.md +++ b/docs/swarm/secrets.md @@ -77,8 +77,13 @@ The **swarm's** collector does need one. It runs in a container, so homeserver rows below, and for the same reason: the container that mints the secret isn't the container that reads it. -The copy is only made when authelia is enabled **on this host** and something -published is being scraped; otherwise no secret is needed and none is placed. +The copy is made whenever authelia is enabled **on this host**, whatever this +collector scrapes. The client it delivers for is registered unconditionally: +authelia refuses a bearer-authz client with no audience, and the push audiences +supply one even for a collector with nothing published to scrape. Like the +hive-level delivery units below, this one waits a bounded 120s for authelia's +mint and then fails rather than skipping, so a secret that never arrives takes +the collector's container start with it instead of surfacing later as a 401. ⚠️ **Don't read that delivery unit as the only way this collector is fed.** Whether it authenticates follows the _credential_, never another service's