vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

swarm: drop the -agent client suffix refusal from authelia and the queue responder

Browse source 
authelia.agentClientSuffix is removed (tombstoned) and the responder
takes no --agent-client-suffix: hive-<name>-agent is parsed as hive
<name>-agent like any other id. The reserved word agent still keeps a
hive from being named *-agent.
This commit is contained in:
atlas 2026-10-24 14:42:55 +02:00 • committed by mara
commit e01770c056
1 changed files with 33 additions and 233 deletions
Download patch file Download diff file Expand all files Collapse all files

16
nix/host-modules/swarm-authelia-service.nix
View file

@ -341,22 +341,6 @@ in
'';
};
agentClientSuffix = lib.mkOption {
type = lib.types.str;
readOnly = true;
default = "-agent";
description = ''
Suffix the queue's auth-callout responder refuses on a hive's client
id: `${config.services.hyperhive.swarm.authelia.hiveClientPrefix}alpha${config.services.hyperhive.swarm.authelia.agentClientSuffix}`
is denied, never read as hive `alpha-agent`. No client is minted with
it; an agent authenticates to the queue with its own secret.
Read-only for the same reason as `hiveClientPrefix`. A hive named with
this suffix is refused at evaluation, since the queue would refuse its
own client id.
'';
};
machine = lib.mkOption {
type = lib.types.str;
readOnly = true;