vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

keep each hive's otel oidc secret on /run, not /var/lib

Browse source
This commit is contained in:
atlas 2026-10-25 11:05:47 +01:00 • committed by mara
commit 96405621d7
1 changed files with 106 additions and 18 deletions
Download patch file Download diff file Expand all files Collapse all files

9
nix/host-modules/glue-bao-readers-store-order.nix
View file

@ -30,6 +30,11 @@ let
baoCfg = hyperhiveCfg.swarm.bao;
otel = hyperhiveCfg.otel;
hiveOtelSecret = import ./lib/hive-otel-secret.nix {
inherit (hyperhiveCfg.swarm.authelia) hiveClientPrefix;
inherit (hyperhiveCfg) hiveName;
};
havePair = cert: key: cert != null && key != null;
# Reader unit → the gate its own module defines it under.
@ -44,9 +49,7 @@ let
otel.collector.enable
&& hyperhiveCfg.hiveName != null
&& havePair baoDeploy.clientCertFile baoDeploy.clientKeyFile
&&
otel.clientSecretFile
== "/var/lib/hive-otel-oidc/${hyperhiveCfg.swarm.authelia.hiveClientPrefix}${toString hyperhiveCfg.hiveName}.secret";
&& otel.clientSecretFile == hiveOtelSecret.path;
# ./swarm-grafana.nix
swarm-bao-grafana-oidc = deployCfg.grafana.enable;
swarm-bao-grafana-admin = deployCfg.grafana.enable;