vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

keep authelia's oidc client secrets in the store, not on disk

Browse source 
The mint creates each client's secret in the swarm secret store and writes only the digest to disk. It mints only when the store answers and holds none. A new unit moves the plaintext files an earlier release left into the store and removes each once the store holds the same value. The bridge reads its secret from the store into /run before each start. The secret publisher unit and its path unit are gone.
This commit is contained in:
atlas 2026-10-30 03:25:57 +01:00 • committed by mara
commit d30cb7d122
1 changed files with 1086 additions and 486 deletions
Download patch file Download diff file Expand all files Collapse all files

27
nix/host-modules/swarm-secret-publisher.nix
View file

@ -1,8 +1,7 @@
# What a host decides about the swarm's secret publisher: whether it runs, and
# the store identity it presents, plus the list of secrets it copies. The unit
# itself is ../container-modules/swarm-secret-publisher.nix, inside authelia's
# container beside the mint whose secrets it copies; ./swarm-authelia.nix
# imports it there and hands the identity in as system credentials.
# What a host decides about authelia's store identity: whether authelia's
# container holds one, and the list of secrets it creates in the store with it.
# The mint is `authelia-swarm-secrets` in ./swarm-authelia.nix, inside
# authelia's container, which hands the identity in as system credentials.
{
lib,
config,
@ -106,11 +105,12 @@ in
type = lib.types.bool;
default = false;
description = ''
Publish the OIDC client secrets this host mints into the swarm's
secret store, so a hive that does not run authelia, a swarm service
or the controller can read its own — from wherever it runs, this host
included. The unit, `swarm-secret-publish`, runs inside authelia's
container, so it exists only where authelia runs.
Keep the OIDC client secrets this host mints in the swarm's secret
store, so a hive that does not run authelia, a swarm service or the
controller can read its own — from wherever it runs, this host
included. Authelia's mint, `authelia-swarm-secrets` inside its
container, creates each secret in the store and writes only its
digest to disk, so the unit exists only where authelia runs.
Defaults to whether this host mints the OIDC secrets (set by
`glue-secret-publisher-authelia.nix`), which is the only half of the
@ -170,9 +170,10 @@ in
internal = true;
default = secrets;
description = ''
Every secret the publisher copies: the minted client's id and the store
path its reader fetches. Derived from `swarm.*` alone, so it is the same list on every
host; ./swarm-authelia.nix hands it to the unit in its container.
Where the mint creates each client's secret: the minted client's id and
the store path its reader fetches. Derived from `swarm.*` alone, so it
is the same list on every host. A client missing here gets
`secret/swarm/services/<id>/oidc/client`, as the bridge's does.
'';
};
};