vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

store the forge webhook secret and grafana's secret key in bao, seeded from the existing files

Browse source
This commit is contained in:
atlas 2026-10-27 12:02:44 +01:00 • committed by mara
commit a4e48a7bca
1 changed files with 697 additions and 142 deletions
Download patch file Download diff file Expand all files Collapse all files

31
nix/module-eval/grafana.nix
View file

@ -250,6 +250,37 @@ let
&& lib.hasInfix "admin reset-admin-password --password-from-stdin < /run/swarm-grafana-secrets/admin-password" service.preStart
&& lib.hasInfix "-config ${resetConfig}" service.script;
}
{
# Grafana's datasource-encryption key reaches Grafana from the store,
# seeded from the file an earlier release generated in the container,
# which stays on disk. A different key leaves Grafana unable to read its
# stored datasource secrets, so nothing may mint ahead of that seed, and
# the superseded in-container generator must be gone: left in place it
# would write a second key beside the delivered one. The last two arms
# are the presence controls for the absence arms: the guest's `grafana`
# unit is found by the same lookup, and the admin password's legacy file
# is among the removals.
name = "grafana's datasource key is seeded into the store from the earlier file, delivered from /run, and the earlier file is kept";
ok =
let
m = grafanaRemoteAuthelia;
unit = m.systemd.services.swarm-bao-grafana-secret-key;
guest = m.containers.swarm-grafana.config;
earlier = "/var/lib/nixos-containers/swarm-grafana/var/lib/grafana-secret/secret_key";
in
lib.hasInfix "bao kv put -cas=0 secret/swarm/services/swarm-grafana/secret-key value=-" unit.script
&& lib.hasInfix "tr -d '\\n' < ${earlier}" unit.script
&& lib.hasInfix "atomic_write_secret 0400 196:0 /run/swarm-grafana-secrets/secret-key" unit.script
&& lib.elem "container@swarm-grafana.service" unit.before
&& unit.environment.BAO_CLIENT_CERT == "/etc/pki/bao-grafana-oidc.pem"
&&
guest.services.grafana.settings.security.secret_key
== "$__file{/run/swarm-grafana-secrets/secret-key}"
&& !(guest.systemd.services ? swarm-grafana-secret-key)
&& guest.systemd.services ? grafana
&& !(lib.any (lib.hasInfix "grafana-secret") m.systemd.tmpfiles.rules)
&& lib.elem "r /var/lib/nixos-containers/swarm-grafana/var/lib/grafana-admin/password" m.systemd.tmpfiles.rules;
}
{
# swarm-controller reads alerts with this token, so the account it
# belongs to is created and kept a Viewer, the token lands at the path