vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

swarm: nats and matrix OIDC fetch units fail until the secret is published

Browse source 
An unpublished or empty secret in swarm-bao-nats-auth-oidc and
swarm-bao-matrix-oidc now exits 1 instead of 0, the shape
swarm-bao-forwarder-oidc already uses. storeRetry then re-fetches every 30s
until swarm-secret-publish has written the secret, and refresh_consumer
starts the responder / tuwunel once the file lands. Before, a fresh swarm's
first fetch found nothing, exited 0, and neither consumer started until the
unit was restarted by hand.
This commit is contained in:
atlas 2026-10-05 03:22:23 +02:00 • committed by mara
commit db6648dfe6
4 changed files with 17 additions and 12 deletions
Download patch file Download diff file Expand all files Collapse all files

12
nix/host-modules/hive-matrix.nix
View file

@ -585,9 +585,9 @@ in
# The homeserver's OIDC client secret, out of the swarm secret store under
# matrix-ctl's leaf — the one route, wherever authelia runs. Same shape as
# ./swarm-grafana.nix's `swarm-bao-grafana-oidc`: a login that fails
# loudly, since a retry fixes every state it fails on, then a read that
# degrades quietly, since an absent value is "not published yet".
# ./swarm-bao.nix's `swarm-bao-forwarder-oidc`: the login and the read both
# fail loudly, and `storeRetry` retries until the publisher on authelia's
# host has written the secret, because tuwunel does not start without it.
#
# ⚠️ tuwunel requires the file to exist and be non-empty, and its
# `LoadCredential` source must exist for the unit to start, so a host with
@ -669,12 +669,12 @@ in
else
echo "bao failed without writing a diagnostic." >&2
fi
exit 0
exit 1
fi
if [ -z "$secret" ]; then
echo "swarm-bao returned an empty ${storeSecretPath}; leaving the file as it is." >&2
exit 0
echo "swarm-bao returned an empty ${storeSecretPath}; the homeserver has no OIDC client secret yet." >&2
exit 1
fi
# Root-owned 0400: tuwunel runs under `DynamicUser`, so there is no

13
nix/host-modules/swarm-nats.nix
View file

@ -921,9 +921,10 @@ in
# The responder's OIDC client secret, out of the swarm secret store under
# the responder's own leaf — the one route, wherever authelia runs. Same
# shape as ./swarm-grafana.nix's `swarm-bao-grafana-oidc`: a login that
# fails loudly, since a retry fixes every state it fails on, then a read
# that degrades quietly, since an absent value is "not published yet".
# shape as ./swarm-bao.nix's `swarm-bao-forwarder-oidc`: the login and the
# read both fail loudly, and `storeRetry` retries until the publisher on
# authelia's host has written the secret, because the responder has no
# mode that runs without it.
#
# ⚠️ Without the secret the responder does not start (its `LoadCredential`
# source is missing), and `auth_callout` with no responder refuses every
@ -1008,12 +1009,12 @@ in
else
echo "bao failed without writing a diagnostic." >&2
fi
exit 0
exit 1
fi
if [ -z "$secret" ]; then
echo "swarm-bao returned an empty ${storeSecretPath}; leaving the file as it is." >&2
exit 0
echo "swarm-bao returned an empty ${storeSecretPath}; the queue responder has no OIDC client secret yet." >&2
exit 1
fi
# Root-owned 0400: `LoadCredential` reads it as root before the