vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 2

nix: run the forge on one host per swarm (deploy.forgejo.enable)

Browse source 
Every hive with hyperhive enabled ran its own hive-forge container, and
its gateway answered forge.<swarm> with its own bridge IP, so on a
multi-host swarm each hive talked to its own forge.

deploy.forgejo.enable defaults to false and allSwarmServices sets it with
mkDefault, like authelia and bao; singleHostSwarm gets it through that.
The forge's OIDC client moves to a glue module gated on authelia, so a
split authelia/forge swarm still registers it. CI now requires the forge
on the same host, and the controller's forgeTokenFile defaults to null
where the forge is not.

Closes #4705
Refs #3782
This commit is contained in:
atlas 2026-09-24 19:44:04 +02:00 • committed by mara
commit 978164dc53
15 changed files with 346 additions and 84 deletions
Download patch file Download diff file Expand all files Collapse all files

40
nix/host-modules/glue-forge-oidc-client.nix Normal file
View file

@ -0,0 +1,40 @@
# Glue: register the swarm's forge as an OIDC client wherever authelia runs.
#
# ONE PAIRING PER FILE — forge ← authelia, and nothing else. Deleting this
# leaves a swarm whose forge is not a client authelia has ever heard of, so
# its "sign in with" button can never complete a login and nothing minted its
# secret either.
#
# ⚠️ Gated on authelia being HERE, and deliberately NOT on this host running
# the forge. A client is a row in THIS host's provider config, so it can only be
# declared where that config is rendered — and ./hive-forge/default.nix's whole
# `config` block hangs off `deploy.forgejo.enable`, so a swarm with the forge
# and authelia on different hosts would register the client nowhere at all.
# Same shape as ./glue-grafana-oidc-client.nix, for the same reason.
#
# Unlike Grafana's, this client is never unused: every swarm runs a forge.
{
lib,
config,
...
}:
let
hyperhiveCfg = config.services.hyperhive;
deployCfg = hyperhiveCfg.deploy;
forgeCfg = hyperhiveCfg.swarm.forge;
in
{
config = lib.mkIf (hyperhiveCfg.enable && deployCfg.authelia.enable) {
# One declaration, two readers. The forge knows its own callback URL;
# making the operator restate it in authelia's client list would be a
# second source of truth for a string whose mismatch is a silent
# rejected login.
services.hyperhive.swarm.authelia.oidc.clients = [
{
id = forgeCfg.sso.clientId;
description = "HyperHive forge";
redirectUris = [ forgeCfg.sso.redirectUri ];
}
];
};
}