vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

swarm: drop the -agent client suffix refusal from authelia and the queue responder

Browse source 
authelia.agentClientSuffix is removed (tombstoned) and the responder
takes no --agent-client-suffix: hive-<name>-agent is parsed as hive
<name>-agent like any other id. The reserved word agent still keeps a
hive from being named *-agent.
This commit is contained in:
atlas 2026-10-24 14:42:55 +02:00 • committed by mara
commit e01770c056
12 changed files with 33 additions and 233 deletions
Download patch file Download diff file Expand all files Collapse all files

2
nix/module-eval/name-guards.nix
View file

@ -226,7 +226,7 @@ let
}
{
# The substring guard has to work with the collector off too.
# `h1-agent` would give the hive a client id the responder refuses.
# `h1-agent` contains the reserved word `agent`.
name = "a hive name containing a composed-identifier word is refused, with the collector off";
ok = fragmentGuardFired hiveNameWithComposedWord;
}

10
nix/module-eval/nats-authelia.nix
View file

@ -459,16 +459,16 @@ let
!(lib.any (lib.hasSuffix "-policy.service") (u.after ++ u.wants));
}
{
# The responder refuses the hive's shared agent client and takes no flag
# granting it subjects: an `--agent-publish-subject` fails the unit at
# start.
name = "the responder grants the hive's shared agent client nothing";
# The responder takes no agent-client suffix: no such client is minted.
# `--hive-client-prefix` is the control that the lookup finds a flag the
# unit does pass.
name = "the responder is passed no agent-client suffix";
ok =
let
exec =
natsQueueOnly.containers.swarm-nats.config.systemd.services.swarm-nats-auth.serviceConfig.ExecStart;
in
!(lib.hasInfix "--agent-publish-subject " exec);
lib.hasInfix "--hive-client-prefix " exec && !(lib.hasInfix "--agent-client-suffix" exec);
}
{
# The per-agent grant: the terminal and agent-state streams keyed on the