vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

swarm: nats and matrix OIDC fetch units fail until the secret is published

Browse source 
An unpublished or empty secret in swarm-bao-nats-auth-oidc and
swarm-bao-matrix-oidc now exits 1 instead of 0, the shape
swarm-bao-forwarder-oidc already uses. storeRetry then re-fetches every 30s
until swarm-secret-publish has written the secret, and refresh_consumer
starts the responder / tuwunel once the file lands. Before, a fresh swarm's
first fetch found nothing, exited 0, and neither consumer started until the
unit was restarted by hand.
This commit is contained in:
atlas 2026-10-05 03:22:23 +02:00 • committed by mara
commit db6648dfe6
4 changed files with 17 additions and 12 deletions
Download patch file Download diff file Expand all files Collapse all files

2
nix/module-eval/matrix-core.nix
View file

@ -90,6 +90,8 @@ let
&& lib.hasInfix "bao kv get -field=value secret/swarm/services/tuwunel/oidc/client" u.script
&& lib.hasInfix "/var/lib/nixos-containers/hive-matrix/var/lib/tuwunel-oidc/tuwunel.secret" u.script
&& lib.hasInfix "refresh_consumer hive-matrix tuwunel.service" u.script
# An unpublished or empty secret fails the unit, so `storeRetry` retries it.
&& !(lib.hasInfix "exit 0" u.script)
&& lib.elem "container@hive-matrix.service" u.before
&& !(s ? hive-matrix-oidc-secret);
}