vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

forge: fetch the OIDC client secret from bao instead of a host-side copy

Browse source 
The forge's login source read its OIDC client secret from a file that
`hive-forge-oidc-secret` copied out of authelia's container tree. That
unit only existed where authelia ran on the forge's host (`ssoLocal`),
so a forge anywhere else needed the file placed by hand.

The publisher on authelia's host now carries the forge's client secret
to `secret/swarm/services/<forge client id>/oidc/client`, like every
other swarm service's. On the forge's host `swarm-bao-forge-oidc`, a copy
of `swarm-bao-matrix-oidc`, reads it under the forge publisher's leaf
(the forge host's one store identity, whose policy gains read on that
one path) and writes the file `forgejo-sso-source` reads, re-running the
login source when the value changes. It retries on the shared
store-retry shape while the store is down or the secret is not yet
published.

`hive-forge-oidc-secret` is removed, `clientSecretFile` defaults to the
in-container path wherever the forge runs, and the `ssoLocal` gate on
the login source's resolver ordering goes with it: the login source
fetches the issuer's discovery document on every forge host.

Refs #5015
This commit is contained in:
atlas 2026-10-09 23:30:17 +02:00 • committed by mara
commit f6ca5f1433
1 changed files with 332 additions and 159 deletions
Download patch file Download diff file Expand all files Collapse all files

13
nix/module-eval/secret-publisher.nix
View file

@ -189,10 +189,10 @@ let
]);
}
{
# The other half of the queue's and the homeserver's one route: the
# publisher on an IdP host that runs neither carries both secrets to the
# paths their readers fetch.
name = "the publisher on an authelia host carries the queue's and homeserver's secrets";
# The other half of the queue's, the homeserver's and the forge's one
# route: the publisher on an IdP host that runs none of them carries each
# secret to the path its reader fetches.
name = "the publisher on an authelia host carries the queue's, homeserver's and forge's secrets";
ok =
let
s = secretPublisherRemote.systemd.services.swarm-secret-publish.script;
@ -200,7 +200,10 @@ let
lib.hasInfix "secret/swarm/services/swarm-nats/oidc/client" s
&& lib.hasInfix "/swarm-nats.secret" s
&& lib.hasInfix "secret/swarm/services/tuwunel/oidc/client" s
&& lib.hasInfix "/tuwunel.secret" s;
&& lib.hasInfix "/tuwunel.secret" s
&& !secretPublisherRemote.services.hyperhive.deploy.forgejo.enable
&& lib.hasInfix "secret/swarm/services/forgejo/oidc/client" s
&& lib.hasInfix "/forgejo.secret" s;
}
{
# Both ends of a wire nothing at eval time carries end to end: the