vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

swarm-controller: make authelia's operators matrix homeserver admins

Browse source 
swarm-authelia-bridge gains ListOperators, the usernames in authelia's
operator group (`operatorGroup = "admins"`, passed in from
swarm-authelia.nix). Unlike the two agent verbs, which admit any active
token, it answers only the client named by
SWARM_AUTHELIA_BRIDGE_OPERATOR_READER_CLIENT_ID (swarm-controller's
queueClientId) and returns 403 to every other active token: authelia
issues machine tokens to every hive and its agents as well. The bridge's
introspection now models `client_id` to make that check, the same way
swarm-nats-auth's does.

swarm-controller runs a grant-only pass at start and every five minutes:
read the group, map each username to the account an SSO login lands on
(tuwunel lowercases `preferred_username`), skip anyone already joined to
`#admins:<server>` (tuwunel's definition of admin) or without a matrix
account, and send `!admin users make-user-admin <user>` there as @swarm
with the swarm appservice token. Nothing is ever revoked: tuwunel has no
command for it (#4799).

The admin-room calls (alias, joined members, profile, send) go into
swarm-matrix-client next to whoami, keeping its no-body-in-errors rule.

Closes #4585
This commit is contained in:
atlas 2026-10-04 15:21:41 +02:00 • committed by mara
commit 9e7fdb55ae
15 changed files with 787 additions and 33 deletions
Download patch file Download diff file Expand all files Collapse all files

11
swarm-authelia-bridge/README.md
View file

@ -20,11 +20,16 @@ simply owns the file it writes. No elevated privilege anywhere.
- One endpoint, `POST /requests`, body = `swarm-authelia-bridge-sock`'s
`BridgeRequest` verbatim — `EnsureAgentIdentity` (idempotently ensure an
agent exists as an authelia subject) and `ListAgentIdentities` (the
roster: the subjects carrying the agent marker group, names only).
agent exists as an authelia subject), `ListAgentIdentities` (the
roster: the subjects carrying the agent marker group, names only) and
`ListOperators` (the operator group's usernames).
- Bearer-authenticated via authelia's own OIDC token introspection (RFC
7662), against `swarm-controller`'s **existing** machine-client identity
(already minted for the queue connection) — no new credential.
(already minted for the queue connection) — no new credential. The two
agent verbs admit any active token. ⚠️ `ListOperators` admits only the
client named by `SWARM_AUTHELIA_BRIDGE_OPERATOR_READER_CLIENT_ID`
(`swarm-controller`'s) and answers every other active token `403`:
authelia issues machine tokens to every hive and its agents too.
- No restart of authelia after a write — relies on
`authentication_backend.file.watch`, confirmed working against the
pinned 4.39.20 build during this design work.