vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

nats-callout-removed: remove the container's OIDC secret copy here, ungated

Browse source 
The tmpfiles `r` rule for the stale `oidc-client.secret` in the
swarm-nats container sat in swarm-nats.nix under `deploy.nats.enable`,
so a host that turned the queue off kept the copy. It now sits in the
ungated removal shim next to the seed copies' rules, which is where the
S2 plan put it and the one file to delete when the deprecation window
closes. The module-eval case asserts the rule on a host with the queue
off as well.
This commit is contained in:
atlas 2026-10-06 15:25:29 +02:00
commit f83030281e
3 changed files with 16 additions and 16 deletions
Download patch file Download diff file Expand all files Collapse all files

11
nix/host-modules/nats-callout-removed.nix
View file

@ -1,5 +1,6 @@
# Removal shim for the queue's callout nkey options, and for the copies of
# their seeds inside the `swarm-nats` container.
# their seeds and of the responder's OIDC client secret inside the
# `swarm-nats` container.
#
# The callout issuer and user keys live in the swarm secret store beside the
# callout xkey: `swarm-bao-nats-callout-xkey` in ./swarm-nats.nix creates
@ -33,7 +34,7 @@ let
(lib.mkRemovedOptionModule [ "services" "hyperhive" "swarm" "nats" name ] message)
];
containerSeedDir = "/var/lib/nixos-containers/swarm-nats/var/lib/swarm-nats-auth";
containerSecretDir = "/var/lib/nixos-containers/swarm-nats/var/lib/swarm-nats-auth";
in
{
imports = lib.concatLists [
@ -44,9 +45,11 @@ in
(removed "calloutIssuerSeedFile" (seedFile "issuer.seed"))
];
# The responder reads both seeds from the store and names neither file.
systemd.tmpfiles.rules = map (f: "r ${containerSeedDir}/${f}") [
# The responder reads both seeds and its OIDC client secret from the store
# and names none of these files.
systemd.tmpfiles.rules = map (f: "r ${containerSecretDir}/${f}") [
"callout-user.seed"
"issuer.seed"
"oidc-client.secret"
];
}

8
nix/host-modules/swarm-nats.nix
View file

@ -513,13 +513,7 @@ in
# The bind source has to exist before the container starts, leaf or not:
# nixos-container refuses to start over a missing one, which would take
# the whole queue down rather than only its TLS.
#
# The `r` removes a copy of the responder's OIDC client secret a container
# may still hold: the responder reads it from the store and names no file.
systemd.tmpfiles.rules = [
"d ${tlsDir} 0755 root root -"
"r ${hostPath "oidc-client.secret"}"
];
systemd.tmpfiles.rules = [ "d ${tlsDir} 0755 root root -" ];
containers.swarm-nats = {
autoStart = true;

13
nix/module-eval/nats-authelia.nix
View file

@ -406,9 +406,10 @@ let
{
# The responder reads its OIDC secret from the store itself, so no host
# unit fetches it, no credential or flag carries it, and a copy a
# container still holds is removed. On or off the store's host alike;
# the callout key fetch beside it is the control that the unit set is
# read at all, and the store cert role the control on the flags.
# container still holds is removed, also on a host with the queue off.
# On or off the store's host alike; the callout key fetch beside it is
# the control that the unit set is read at all, and the store cert role
# the control on the flags.
name = "the responder's OIDC secret is fetched by no unit and carried by no credential or flag, and the container's copy is removed";
ok =
let
@ -418,14 +419,16 @@ let
&& h.systemd.services ? swarm-bao-nats-callout-xkey;
u = responderOf natsWithStoreIdentity;
copy = natsWithStoreIdentity.systemd.services.swarm-nats-auth-secrets.script;
rules = natsWithStoreIdentity.systemd.tmpfiles.rules;
removesCopy = h: lib.elem "r ${dir}/oidc-client.secret" h.systemd.tmpfiles.rules;
dir = "/var/lib/nixos-containers/swarm-nats/var/lib/swarm-nats-auth";
in
fetchedNowhere natsWithStoreIdentity
&& fetchedNowhere natsOnStoreHost
&& !(lib.any (lib.hasInfix "oidc-client") u.serviceConfig.LoadCredential)
&& !(lib.hasInfix "client-secret" u.serviceConfig.ExecStart)
&& lib.hasInfix "--store-cert-role swarm-nats-auth" u.serviceConfig.ExecStart
&& lib.elem "r /var/lib/nixos-containers/swarm-nats/var/lib/swarm-nats-auth/oidc-client.secret" rules
&& removesCopy natsWithStoreIdentity
&& removesCopy autheliaNotColocated
&& !(lib.hasInfix "oidc-client" copy)
&& !(lib.hasInfix "authelia" copy);
}