From c406ffb0f94d4e1c969435528244f251f618d567 Mon Sep 17 00:00:00 2001
From: atlas <atlas@pr1ma.darkest.space>
Date: Tue, 15 Sep 2026 21:45:25 +0200
Subject: [PATCH] swarm-bao: enable approle auth method in bootstrap
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Adds approle to the auth methods enabled during swarm-bao bootstrap,
using the same idempotent check pattern as cert. No role or policy
is configured yet — those are handled in later slices.

Refs #4386
---
 nix/host-modules/swarm-bao.nix | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/nix/host-modules/swarm-bao.nix b/nix/host-modules/swarm-bao.nix
index 19f36ca5..1289efdc 100644
--- a/nix/host-modules/swarm-bao.nix
+++ b/nix/host-modules/swarm-bao.nix
@@ -1034,6 +1034,11 @@ in
             *) bao auth enable cert ;;
           esac
 
+          case "$mounted" in
+            *'"approle/"'*) ;;
+            *) bao auth enable approle ;;
+          esac
+
           # `certificate=` is the CA, so this role trusts every leaf that
           # CA signed and `allowed_common_names` is the whole narrowing —
           # which is why ./swarm.nix reserves this subject as a hive name,