vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

keep authelia's oidc client secrets in the store, not on disk

Browse source 
The mint creates each client's secret in the swarm secret store and writes only the digest to disk. It mints only when the store answers and holds none. A new unit moves the plaintext files an earlier release left into the store and removes each once the store holds the same value. The bridge reads its secret from the store into /run before each start. The secret publisher unit and its path unit are gone.
This commit is contained in:
atlas 2026-10-30 03:25:57 +01:00 • committed by mara
commit d30cb7d122
1 changed files with 1086 additions and 486 deletions
Download patch file Download diff file Expand all files Collapse all files

25
nix/module-eval/bao-grants.nix
View file

@ -418,28 +418,31 @@ let
# The whole point of a second principal. The two prefixes and one leaf it
# publishes to and not `swarm/`, so it cannot touch an agent's
# credentials or the appservice token beside the controller's client;
# and `read` on six exact leaves alone: the client secret of the journal forwarder
# that shares its identity in authelia's container, and authelia's five keys
# (the next case), so a unit whose job is copying a file cannot recover
# what is already there. Pinned as the full capability list per path,
# because an added capability is exactly what a presence check misses.
# The forwarder's `read` is found at its leaf, and the six together are
# counted, so a read on any other path fails the count.
name = "the publisher's grant writes the hive and service prefixes and the controller's client, and reads its forwarder's client and authelia's keys alone";
# and `read` on the `oidc/client` leaves it mints alone (the controller's
# exactly, each hive's and each service's by one `+` segment) and
# authelia's five keys (the next case), so a unit whose job is minting
# cannot recover what is already there beyond its own secrets. Pinned as
# the full capability list per path, because an added capability is
# exactly what a presence check misses. The `oidc/client` stanzas repeat
# `create` and `update`, since the narrower path replaces the prefix's
# capabilities. The eight reads are counted, so a read on any other path
# fails the count.
name = "the publisher's grant writes the hive and service prefixes and the controller's client, and reads the oidc client leaves and authelia's keys alone";
ok =
let
s = baoGrantHere.systemd.services.swarm-bao-secret-publisher-policy.script;
in
lib.hasInfix "path \"secret/data/swarm/hives/*\" {\n capabilities = [\"create\", \"update\"]" s
&& lib.hasInfix "path \"secret/data/swarm/services/*\" {\n capabilities = [\"create\", \"update\"]" s
&& lib.hasInfix "path \"secret/data/swarm/controller/swarm-controller/oidc/client\" {\n capabilities = [\"create\", \"update\"]\n}" s
&& lib.hasInfix "path \"secret/data/swarm/controller/swarm-controller/oidc/client\" {\n capabilities = [\"create\", \"update\", \"read\"]\n}" s
&& lib.hasInfix "path \"secret/data/swarm/hives/+/oidc/client\" {\n capabilities = [\"create\", \"update\", \"read\"]\n}" s
&& lib.hasInfix "path \"secret/data/swarm/services/+/oidc/client\" {\n capabilities = [\"create\", \"update\", \"read\"]\n}" s
&& !(lib.hasInfix "secret/data/swarm/controller/*" s)
&& !(lib.hasInfix "appservice-token" s)
&& !(lib.hasInfix "secret/data/swarm/agents" s)
&& !(lib.hasInfix "secret/data/swarm/*" s)
&& !(lib.hasInfix "sys/policies/acl" s)
&& lib.hasInfix "path \"secret/data/swarm/services/swarm-authelia-collector/oidc/client\" {\n capabilities = [\"create\", \"update\", \"read\"]\n}" s
&& lib.length (lib.splitString "\"read\"" s) == 7
&& lib.length (lib.splitString "\"read\"" s) == 9
&& !(lib.hasInfix "\"list\"" s);
}
{