vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

nix: follow-ups from the service/deploy split

Browse source 
- swarm.victoriametrics.port: the description states why the listener is
  loopback-only instead of pointing "below" at text in another file.
- authelia: the deploy half derives its unit and instance names from
  swarm.authelia.unit, so the instance is spelled once, in
  swarm-authelia-service.nix.
- authelia: the tokenEndpointAuthMethod and bearerAuthz descriptions name
  the obligations the authelia host asserts instead of "below"; the
  swarm-authelia.nix header describes that file only.
- module-eval-swarm-otel-core: swarm.otel.audience must contain both store
  push URLs the collector's exporters use and request tokens for.

Refs #3742
This commit is contained in:
atlas 2026-10-05 19:12:46 +02:00
commit dc5c2d8d83
4 changed files with 50 additions and 28 deletions
Download patch file Download diff file Expand all files Collapse all files

25
nix/host-modules/swarm-authelia.nix
View file

@ -1,13 +1,8 @@
# The swarm's SSO provider: one authelia for the whole swarm, in a
# `swarm-authelia` nixos-container.
#
# Two halves, and only one of them is conditional:
#
# - the CLIENT pointer (`url`) exists on every hive, because a hive
# that doesn't run authelia still has to know where to send people.
# - the CONTAINER only exists where the swarm's shared services live.
# `deploy.allSwarmServices` asserts this module's `enable`
# (see ./swarm-required-services.nix); a hive is a client by default.
# `swarm-authelia` nixos-container on the host with `deploy.authelia.enable`
# (`deploy.allSwarmServices` defaults it on, see
# ./swarm-required-services.nix). What every hive sees of it, `url` and the
# OIDC client register included, is in ./swarm-authelia-service.nix.
#
# The file backend is the right shape, not a placeholder for LDAP: what
# makes a directory necessary is the size of the subject set, and this
@ -91,12 +86,10 @@ let
# Upstream's `services.authelia.instances.<name>` derives the unit,
# user, group and StateDirectory from the instance name
# (`authelia` + `-<name>`). Naming them here rather than repeating the
# literal keeps the generator unit below and the module in step.
# ./swarm-authelia-service.nix binds the same two names for `unit`;
# the two must agree.
instance = "swarm";
unitName = "authelia-${instance}";
# (`authelia` + `-<name>`). Both are read back from `swarm.authelia.unit`,
# so the instance declared below is the one that option names.
unitName = lib.removeSuffix ".service" cfg.unit;
instance = lib.removePrefix "authelia-" unitName;
stateDir = "/var/lib/${unitName}";
caTrust = import ./lib/hive-ca-trust.nix {
@ -790,7 +783,7 @@ in
../container-modules/swarm-container.nix
(import ../container-modules/swarm-container-resolver.nix {
inherit (networkCfg) bridgeIp;
dnsConsumers = [ "authelia-${instance}.service" ];
dnsConsumers = [ cfg.unit ];
})
caBundleModule
];