vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

keep authelia's keys in bao, seeded from the existing key files

Browse source
This commit is contained in:
atlas 2026-10-27 12:23:41 +01:00 • committed by mara
commit 99fab06348
1 changed files with 557 additions and 89 deletions
Download patch file Download diff file Expand all files Collapse all files

56
nix/module-eval/bao-grants.nix
View file

@ -409,13 +409,14 @@ let
# The whole point of a second principal. The two prefixes and one leaf it
# publishes to and not `swarm/`, so it cannot touch an agent's
# credentials or the appservice token beside the controller's client;
# and `read` on one leaf alone, the client secret of the journal forwarder
# that shares its identity in authelia's container, so a unit whose job
# is copying a file cannot recover what is already there. Pinned as the
# full capability list per path, because an added capability is exactly
# what a presence check misses. The one `read` is found at that leaf and
# counted once, so a read on any other path fails the count.
name = "the publisher's grant writes the hive and service prefixes and the controller's client, and reads its forwarder's client alone";
# and `read` on six exact leaves alone: the client secret of the journal forwarder
# that shares its identity in authelia's container, and authelia's five keys
# (the next case), so a unit whose job is copying a file cannot recover
# what is already there. Pinned as the full capability list per path,
# because an added capability is exactly what a presence check misses.
# The forwarder's `read` is found at its leaf, and the six together are
# counted, so a read on any other path fails the count.
name = "the publisher's grant writes the hive and service prefixes and the controller's client, and reads its forwarder's client and authelia's keys alone";
ok =
let
s = baoGrantHere.systemd.services.swarm-bao-secret-publisher-policy.script;
@ -429,9 +430,48 @@ let
&& !(lib.hasInfix "secret/data/swarm/*" s)
&& !(lib.hasInfix "sys/policies/acl" s)
&& lib.hasInfix "path \"secret/data/swarm/services/swarm-authelia-collector/oidc/client\" {\n capabilities = [\"create\", \"update\", \"read\"]\n}" s
&& lib.length (lib.splitString "\"read\"" s) == 2
&& lib.length (lib.splitString "\"read\"" s) == 7
&& !(lib.hasInfix "\"list\"" s);
}
{
# authelia's keys are created once and read at every start, never
# replaced: the storage-encryption key encrypts authelia's database and
# the issuer key signs every id token. Each is an exact leaf, which
# outranks the publisher's `services/*` write and drops its `update`.
# The controls are the OIDC leaf beside them, still the prefix's, and a
# sixth name under the same directory, which is the prefix's too.
name = "the publisher creates and reads authelia's five keys and may not replace one";
ok =
let
grants = grantsIn baoGrantHere.systemd.services.swarm-bao-secret-publisher-policy.script;
key = name: grantFor grants "secret/data/swarm/services/swarm-authelia/keys/${name}";
in
lib.all
(
name:
(key name).caps == [
"create"
"read"
]
)
[
"jwt"
"session"
"storage-encryption"
"oidc-hmac"
"oidc-issuer"
]
&&
(key "other").caps == [
"create"
"update"
]
&&
(grantFor grants "secret/data/swarm/services/swarm-nats/oidc/client").caps == [
"create"
"update"
];
}
{
# The publisher's `services/*` write covers the callout xkey's seed, and
# only the exact-path denial, which outranks the prefix, keeps it from