vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

forge, matrix: SSO is not optional

Browse source 
Both services carried an `sso.enable` defaulting to false, so a swarm's
own forge and homeserver shipped with their identity provider switched
off unless an operator remembered two lines. Grafana never had the
toggle and is the shape the other two now match.

Behaves as if the setting were true: `ssoLocal` loses one conjunct, the
three assertions become unconditional, and the login source and
identity_provider render always.

The option is removed rather than defaulted, so a config that turned SSO
OFF fails where that line is instead of silently gaining a login
provider on the next rebuild.
This commit is contained in:
atlas 2026-08-24 22:12:43 +02:00 • committed by mara
commit 792d7f503f
4 changed files with 94 additions and 84 deletions
Download patch file Download diff file Expand all files Collapse all files

20
docs/matrix.md
View file

@ -220,14 +220,18 @@ surprising behaviour:
`server_name` (treated as wildcard catch-all, surprising) and
`/etc/hosts` (invalid entry). `null` is the right opt-out shape;
empty string is rejected explicitly.
- **`sso.enable` requires `sso.clientSecretFile`** — fails at eval,
not at boot: tuwunel reads its identity providers from the config
file, so a half-configured one can stop the homeserver from
starting outright rather than merely hiding a login button.
- **`sso.enable` requires `swarm.authelia.url`** — without a
provider URL there is nothing to discover against.
- **`sso.enable` requires `gatewayHost != null`** — the SSO callback
URL is format-locked to `<homeserver>/_matrix/client/unstable/login/sso/callback/<client_id>`,
SSO is unconditional, so the three below are requirements of running a
homeserver at all rather than of a setting:
- **`sso.clientSecretFile` is required** — fails at eval, not at boot:
tuwunel reads its identity providers from the config file, so a
half-configured one can stop the homeserver from starting outright
rather than merely hiding a login button. On a host that also runs
the swarm's authelia it is wired up for you.
- **`swarm.authelia.url` is required** — without a provider URL there
is nothing to discover against.
- **`gatewayHost != null` is required** — the SSO callback URL is
format-locked to `<homeserver>/_matrix/client/unstable/login/sso/callback/<client_id>`,
and the identity provider needs a public name to redirect the
browser to.

3
docs/swarm/sso.md
View file

@ -110,8 +110,7 @@ mechanism with flags.
### 1. All-local — one host runs both
Nothing to configure beyond `swarm.forge.sso.enable = true` or
`swarm.matrix.sso.enable = true`. Per service, a host-side unit waits for
Nothing to configure at all. Per service, a host-side unit waits for
authelia's first boot to mint that client's secret and copies it into the
service's container, and the service's own module contributes its client
entry — callback URL included — to authelia's client list.