forward the attic container's journal to the swarm collector

nix/host-modules/glue-attic-otel-oidc-client.nix

@@ -0,0 +1,37 @@
+# Glue: register the cache container's journal forwarder as an OIDC client
+# wherever authelia runs.
+#
+# ONE PAIRING PER FILE: that forwarder ← authelia, and nothing else.
+# Without it authelia mints no secret, the publisher has nothing to copy into
+# the store, and the forwarder's export is a 401.
+#
+# Gated on authelia being HERE, not on this host running the cache: a client is
+# a row in THIS host's provider config, the split
+# ./glue-victorialogs-otel-oidc-client.nix makes for the same reason.
+{
+  lib,
+  config,
+  ...
+}:
+let
+  hyperhiveCfg = config.services.hyperhive;
+  clientId = hyperhiveCfg.swarm.attic.otel.clientId;
+in
+{
+  config = lib.mkIf hyperhiveCfg.deploy.authelia.enable {
+    services.hyperhive.swarm.authelia.oidc.clients = [
+      {
+        id = clientId;
+        description = "HyperHive cache journal forwarder";
+        kind = "machine";
+        redirectUris = [ ];
+        # Its own id as its own permitted audience, the one the swarm
+        # collector's receiver for this container checks.
+        audience = [ clientId ];
+        # The receiver verifies the token offline against `/jwks.json`;
+        # authelia's default opaque handle fails there.
+        accessTokenSignedResponseAlg = "RS256";
+      }
+    ];
+  };
+}