vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

retry the authelia mint and the appservice render until the store answers, and let tuwunel retry

Browse source
This commit is contained in:
atlas 2026-11-01 10:47:50 +01:00
commit c4924d227b
1 changed files with 85 additions and 30 deletions
Download patch file Download diff file Expand all files Collapse all files

31
nix/host-modules/swarm-authelia.nix
View file

@ -522,11 +522,15 @@ let
# to disk. A digest on disk is enough for authelia to start while the store is
# down; a client with no digest cannot be rendered, so that run fails and
# retries (./lib/store-retry.nix). A client whose digest is missing gets it
# from the secret that exists, so nothing is minted again.
# from the secret that exists, so nothing is minted again. A store that
# cannot be read fails the run too, after the files are rendered from the
# digests (`STORE_UNREADABLE`, checked at the end of the unit's script), so
# the unit retries until the store answers and authelia has started from the
# digests meanwhile.
storeMintScript = ''
${oidcClientSecrets}
${lib.concatMapStrings (c: ''
mint_client_secret ${lib.escapeShellArg c.id} ${lib.escapeShellArg (clientLeaf c.id)} || exit $?
mint_client_secret ${lib.escapeShellArg c.id} ${lib.escapeShellArg (clientLeaf c.id)} || { rc=$?; [ "$rc" = 2 ] || exit "$rc"; STORE_UNREADABLE=1; }
'') secretClients}
'';
@ -1147,9 +1151,14 @@ in
# itself, as its own user, under `PrivateUsers=true`.
systemd.services."${unitName}-secrets" = {
description = "Generate authelia's secrets on first boot";
wantedBy = [ "multi-user.target" ];
# With a store identity authelia `wants` this unit, not `requires`
# it: a run that fails because the store cannot be read must not
# stop authelia from starting on the digests and keys already on
# disk. Authelia still cannot start without a key file, which
# fails its credential load.
wantedBy = [ "multi-user.target" ] ++ lib.optional publishes "${unitName}.service";
before = [ "${unitName}.service" ];
requiredBy = [ "${unitName}.service" ];
requiredBy = lib.optional (!publishes) "${unitName}.service";
# `deployCfg.authelia.package` is here for its CLI, not its
# daemon: the client secrets are minted with `authelia crypto
# hash generate`, which is the only way to produce a digest in
@ -1167,10 +1176,9 @@ in
pkgs.systemd
pkgs.util-linux
];
# A store that cannot answer, with a key missing on disk, is a
# failed run that retries (./lib/store-retry.nix).
startLimitBurst = lib.mkIf publishes storeRetry.startLimitBurst;
startLimitIntervalSec = lib.mkIf publishes storeRetry.startLimitIntervalSec;
# A store that cannot answer is a failed run that retries, with no
# start limit, until it does (./lib/store-retry.nix).
startLimitIntervalSec = lib.mkIf publishes 0;
serviceConfig = {
Type = "oneshot";
RemainAfterExit = true;
@ -1184,6 +1192,7 @@ in
// lib.optionalAttrs publishes (
storeRetry.serviceConfig
// {
RestartSec = 15;
LoadCredential = lib.attrNames storeFiles;
TimeoutStartSec = 120;
}
@ -1217,6 +1226,12 @@ in
echo "seeded $users with the disabled placeholder ${placeholderUser}"
fi
chmod 0600 "$users"
${lib.optionalString (publishes && oidcEnabled) ''
if [ -n "''${STORE_UNREADABLE-}" ]; then
echo "the store could not be read; authelia runs on its digests and this unit retries" >&2
exit 1
fi
''}
'';
};