vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

keep authelia's oidc client secrets in the store, not on disk

Browse source 
The mint creates each client's secret in the swarm secret store and writes only the digest to disk. It mints only when the store answers and holds none. A new unit moves the plaintext files an earlier release left into the store and removes each once the store holds the same value. The bridge reads its secret from the store into /run before each start. The secret publisher unit and its path unit are gone.
This commit is contained in:
atlas 2026-10-30 03:25:57 +01:00 • committed by mara
commit d30cb7d122
1 changed files with 1086 additions and 486 deletions
Download patch file Download diff file Expand all files Collapse all files

20
nix/host-modules/swarm-bao.nix
View file

@ -546,7 +546,7 @@ let
secretPublisherPolicyName = "swarm-secret-publisher";
secretPublisherCn = baoDeploy.secretPublisherCommonName;
# Four grants and six denials, and every narrowing in each is load-bearing.
# Five grants and six denials, and every narrowing in each is load-bearing.
#
# `secret/data/` is KV v2's ACL prefix, inserted by the engine rather than
# written by the caller — same trap as the controller's grant above.
@ -559,9 +559,9 @@ let
# here too — a grant widens when a path gains a WRITER, not when a kind is
# declared.
#
# Write-only but for its forwarder's client secret and authelia's keys, read at
# exact leaves: a read on a prefix would let a file-copier recover every
# hive's credentials. The forwarder's stanza repeats `create`/`update`.
# Reads only the `oidc/client` leaves it mints, the controller's client and
# authelia's keys: a read on a prefix would recover every hive's credentials.
# Those stanzas repeat `create`/`update`: a narrower path replaces the prefix's.
#
# The queue callout's three seeds sit under `swarm/services/` and are no
# secret this principal copies, so their exact paths, which outrank the
@ -618,10 +618,14 @@ let
}
path "${credentialMountPath}/data/${controllerClientLeaf}" {
capabilities = ["create", "update"]
capabilities = ["create", "update", "read"]
}
path "${credentialMountPath}/data/swarm/services/${hyperhiveCfg.swarm.authelia.otel.clientId}/oidc/client" {
path "${credentialMountPath}/data/swarm/hives/+/oidc/client" {
capabilities = ["create", "update", "read"]
}
path "${credentialMountPath}/data/swarm/services/+/oidc/client" {
capabilities = ["create", "update", "read"]
}
''
@ -1184,7 +1188,7 @@ let
grafanaSecretKeyLeaf = "swarm/services/${hyperhiveCfg.swarm.grafana.oidc.clientId}/secret-key";
# authelia's jwt, session, storage-encryption, OIDC HMAC and OIDC issuer keys,
# which only the secret publisher in authelia's container creates and reads.
# which only `authelia-swarm-secrets` in authelia's container creates and reads.
# The nix half of `keyLeaf` in ./swarm-authelia.nix. `create` without
# `update`, so a stored key is never replaced: the storage-encryption key
# encrypts authelia's database and the issuer key signs every id token.
@ -4090,7 +4094,7 @@ in
;;
esac
# Published by the secret publisher in authelia's container, which
# Stored by authelia's mint, in its container, which
# this boot does not wait on, so absence is retried.
if ! secret="$(bao kv get -field=value ${lib.escapeShellArg "${credentialMountPath}/${baoUiClientLeaf}"} 2>"$err")"; then
echo ${lib.escapeShellArg "the store did not return ${credentialMountPath}/${baoUiClientLeaf}: the UI's OIDC client secret is not published yet."} >&2