vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

retry the authelia mint and the appservice render until the store answers, and let tuwunel retry

Browse source
This commit is contained in:
atlas 2026-11-01 10:47:50 +01:00
commit c4924d227b
1 changed files with 85 additions and 30 deletions
Download patch file Download diff file Expand all files Collapse all files

23
nix/module-eval/secret-publisher.nix
View file

@ -424,6 +424,29 @@ let
)
&& lib.any (lib.hasPrefix "--load-credential=") secretPublisherHere.containers.swarm-authelia.extraFlags;
}
{
# A mint that cannot read the store fails after rendering from the
# digests, and retries without a limit; authelia `wants` it, so a failed
# run does not stop authelia starting from them. The control is the
# no-identity shape, where the generator still gates authelia.
name = "a mint that cannot read the store retries without a limit and does not hold authelia back";
ok =
let
here = inAuthelia secretPublisherHere;
u = here.systemd.services.authelia-swarm-secrets;
files = (inAuthelia secretPublisherNoIdentity).systemd.services.authelia-swarm-secrets;
in
lib.elem "authelia-swarm.service" u.wantedBy
&& !(lib.elem "authelia-swarm.service" (u.requiredBy or [ ]))
&& lib.elem "authelia-swarm.service" u.before
&& u.serviceConfig.Restart == "on-failure"
&& u.serviceConfig.RestartSec == 15
&& u.startLimitIntervalSec == 0
&& lib.hasInfix "STORE_UNREADABLE=1" u.script
&& lib.hasInfix "chmod 0600 \"$users\"\nif [ -n \"\${STORE_UNREADABLE-}\" ]; then" u.script
&& lib.elem "authelia-swarm.service" files.requiredBy
&& !(lib.hasInfix "STORE_UNREADABLE" files.script);
}
{
# With a store identity no unit writes a plaintext client secret under
# /var/lib: the mint keeps no `$sec` file, no redirect in the container