vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

keep authelia's keys in bao, seeded from the existing key files

Browse source
This commit is contained in:
atlas 2026-10-27 12:23:41 +01:00 • committed by mara
commit 99fab06348
1 changed files with 557 additions and 89 deletions
Download patch file Download diff file Expand all files Collapse all files

30
nix/module-eval/secret-publisher.nix
View file

@ -422,6 +422,36 @@ let
&& ((inAuthelia secretPublisherHere).systemd.services ? swarm-secret-publish)
&& lib.any (lib.hasPrefix "--load-credential=") secretPublisherHere.containers.swarm-authelia.extraFlags;
}
{
# Every key authelia signs or encrypts with comes from the store, seeded
# from the file it was generated into, and lands at the path the config
# already names. The storage-encryption key encrypts authelia's database,
# so a value that moved would leave it unreadable. With no identity the
# unit still generates the files, which is the control for each absence:
# the generator and the store sequence are found by the same lookups.
name = "authelia's keys are read from the store with the publisher's identity, and generated on disk without one";
ok =
let
unit = m: (inAuthelia m).systemd.services.authelia-swarm-secrets;
viaStore = unit secretPublisherHere;
onDisk = unit secretPublisherNoIdentity;
in
lib.hasInfix "store_seeded secret/swarm/services/swarm-authelia/keys/\"$name\" \"$p\" \"$@\"" viaStore.script
&& lib.hasInfix "p=/var/lib/authelia-swarm/\"$name\".key" viaStore.script
&& lib.hasInfix "keep_key oidc-issuer mint_issuer" viaStore.script
&& lib.hasInfix "for f in jwt session storage-encryption oidc-hmac; do\n keep_key \"$f\" mint_hex" viaStore.script
&& !(lib.hasInfix "genrsa -out" viaStore.script)
&&
viaStore.environment.BAO_CLIENT_CERT
== "/run/credentials/authelia-swarm-secrets.service/publisher-bao-cert"
&& lib.elem "publisher-bao-cert" viaStore.serviceConfig.LoadCredential
&& viaStore.serviceConfig.Restart == "on-failure"
&& !(lib.hasInfix "store_seeded" onDisk.script)
&& lib.hasInfix "genrsa -out" onDisk.script
&& lib.hasInfix "if [ ! -s \"$p\" ]; then" onDisk.script
&& !(onDisk.environment ? BAO_ADDR)
&& !(onDisk.serviceConfig ? LoadCredential);
}
{
# The path unit's start is a no-op while its target is `active (exited)`,
# so a secret minted after the first run would never be published.