keep authelia's oidc client secrets in the store, not on disk

The mint creates each client's secret in the swarm secret store and writes only the digest to disk. It mints only when the store answers and holds none. A new unit moves the plaintext files an earlier release left into the store and removes each once the store holds the same value. The bridge reads its secret from the store into /run before each start. The secret publisher unit and its path unit are gone.

nix/script-tests/oidc-client-secrets.nix

@@ -0,0 +1,89 @@
+# `checks.script-test-oidc-client-secrets` — runs
+# ../host-modules/lib/oidc-client-secrets.nix's `mint_client_secret` and
+# `migrate_client_secret` against a stub `bao` that keeps its leaves in files
+# and a stub `authelia` that prints a fixed password and digest. The cases are
+# in ./oidc-client-secrets.sh.
+#
+# What runs is the rendered helper, sourced as the units' scripts include it,
+# after the two helpers it builds on.
+{
+  pkgs,
+  ...
+}:
+let
+  # `login` answers from `FAKE_BAO_LOGIN_RC`. `kv get` and `kv put -cas=0` act
+  # on a file per leaf under `FAKE_BAO_KV`, and answer as bao does: a missing
+  # leaf is "No value found at <path>" on stderr, status 2. `FAKE_BAO_DENY_READ`
+  # and `FAKE_BAO_DENY_WRITE` answer 403 as a policy that grants neither does.
+  # `FAKE_BAO_RACE` has another run create the leaf between this one's read and
+  # its write. Every call is logged without the value `put` reads from stdin.
+  fakeBao = pkgs.writeShellScriptBin "bao" ''
+    echo "$*" >> "$FAKE_BAO_LOG"
+    case "$1 $2" in
+      "login -method=cert")
+        [ "$FAKE_BAO_LOGIN_RC" = 0 ] || { echo "fake bao: certificate refused" >&2; exit 2; }
+        printf 's.fake'
+        ;;
+      "kv get")
+        [ "''${BAO_TOKEN-}" = s.fake ] || { echo "fake bao: kv without the login's token" >&2; exit 97; }
+        [ "$3" = -field=value ] || { echo "fake bao: get without -field=value" >&2; exit 95; }
+        leaf="$FAKE_BAO_KV/$(printf '%s' "$4" | tr / _)"
+        [ -z "''${FAKE_BAO_DENY_READ-}" ] || { echo "fake bao: permission denied" >&2; exit 2; }
+        if [ -n "''${FAKE_BAO_RACE-}" ] && [ ! -e "$FAKE_BAO_KV/.raced" ]; then
+          touch "$FAKE_BAO_KV/.raced"
+          printf '%s' "$FAKE_BAO_RACE" > "$leaf"
+          echo "No value found at secret/data/x" >&2
+          exit 2
+        fi
+        [ -e "$leaf" ] || { echo "No value found at secret/data/x" >&2; exit 2; }
+        cat "$leaf"
+        echo
+        ;;
+      "kv put")
+        [ "''${BAO_TOKEN-}" = s.fake ] || { echo "fake bao: kv without the login's token" >&2; exit 97; }
+        [ "$3" = -cas=0 ] || { echo "fake bao: put without -cas=0" >&2; exit 96; }
+        [ "$5" = value=- ] || { echo "fake bao: put with the value as an argument" >&2; exit 94; }
+        leaf="$FAKE_BAO_KV/$(printf '%s' "$4" | tr / _)"
+        [ -z "''${FAKE_BAO_DENY_WRITE-}" ] || { echo "fake bao: permission denied" >&2; exit 2; }
+        [ ! -e "$leaf" ] || { echo "fake bao: check-and-set parameter did not match" >&2; exit 2; }
+        cat > "$leaf"
+        ;;
+      *)
+        echo "fake bao: unexpected call: $*" >&2
+        exit 98
+        ;;
+    esac
+  '';
+
+  # Prints what `authelia crypto hash generate pbkdf2 --random` prints, or
+  # nothing when `FAKE_AUTHELIA_EMPTY` is set. Every call is logged.
+  fakeAuthelia = pkgs.writeShellScriptBin "authelia" ''
+    echo "$*" >> "$FAKE_AUTHELIA_LOG"
+    [ -z "''${FAKE_AUTHELIA_EMPTY-}" ] || exit 0
+    printf 'Random Password: minted-secret\n\nDigest: $pbkdf2-sha512$fake\n'
+  '';
+in
+pkgs.runCommand "hyperhive-script-test-oidc-client-secrets"
+  {
+    HELPER = pkgs.writeText "oidc-client-secrets.sh" (
+      import ../host-modules/lib/store-seeded-secret.nix { }
+      + import ../host-modules/lib/atomic-write-secret.nix { }
+      + import ../host-modules/lib/oidc-client-secrets.nix { }
+    );
+    FAKE_BIN = pkgs.symlinkJoin {
+      name = "fake-bao-and-authelia";
+      paths = [
+        fakeBao
+        fakeAuthelia
+      ];
+    };
+    nativeBuildInputs = [
+      pkgs.coreutils
+      pkgs.gnugrep
+      pkgs.gnused
+    ];
+  }
+  ''
+    ${pkgs.bash}/bin/bash ${./oidc-client-secrets.sh}
+    touch "$out"
+  ''