vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 1

docs/secrets: the collector's secret copy has one condition, not two

Browse source 
secrets.md said the swarm collector's OIDC secret is copied "when authelia is
enabled on this host and something published is being scraped; otherwise no
secret is needed and none is placed". The second condition left the tree in
5478e0bf (#3554): `swarm-otel-oidc-secret` and the client registration it
delivers for are both `lib.mkIf deployCfg.authelia.enable`, and
`publishedScrapeTargets` appears in neither guard. swarm-otel.nix:589 says why
in as many words — authelia refuses a bearer-authz client with no audience,
which is what the old guard was for, and the push audiences are unconditional,
so there is now always one.

The sentence survived because I rewrote the paragraph around it a day later
(8cba57e0) for the collector-elsewhere case and carried the clause through.

What a reader loses: with authelia on and nothing published, the page promises
the delivery is inert. It is not — the unit runs, waits a bounded 120s for
authelia's mint, and fails the collector's container start if the secret never
appears. So the case documented as quiet is one that can fail a boot, and the
operator debugging it has a page saying this path was not taken. The
replacement states the single real condition and that failure mode.

Closes #4210.
This commit is contained in:
atlas 2026-09-11 13:17:26 +02:00 • committed by mara
commit 78699ebd5a
1 changed files with 7 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

9
docs/swarm/secrets.md
View file

@ -77,8 +77,13 @@ The **swarm's** collector does need one. It runs in a container, so
homeserver rows below, and for the same reason: the container that mints the
secret isn't the container that reads it.
The copy is only made when authelia is enabled **on this host** and something
published is being scraped; otherwise no secret is needed and none is placed.
The copy is made whenever authelia is enabled **on this host**, whatever this
collector scrapes. The client it delivers for is registered unconditionally:
authelia refuses a bearer-authz client with no audience, and the push audiences
supply one even for a collector with nothing published to scrape. Like the
hive-level delivery units below, this one waits a bounded 120s for authelia's
mint and then fails rather than skipping, so a secret that never arrives takes
the collector's container start with it instead of surfacing later as a 401.
⚠️ **Don't read that delivery unit as the only way this collector is fed.**
Whether it authenticates follows the _credential_, never another service's