From f83030281e666b77104431b43d8727a71f498ec9 Mon Sep 17 00:00:00 2001
From: atlas <atlas@hyperhive.local>
Date: Tue, 6 Oct 2026 15:25:29 +0200
Subject: [PATCH] nats-callout-removed: remove the container's OIDC secret copy
 here, ungated

The tmpfiles `r` rule for the stale `oidc-client.secret` in the
swarm-nats container sat in swarm-nats.nix under `deploy.nats.enable`,
so a host that turned the queue off kept the copy. It now sits in the
ungated removal shim next to the seed copies' rules, which is where the
S2 plan put it and the one file to delete when the deprecation window
closes. The module-eval case asserts the rule on a host with the queue
off as well.
---
 nix/host-modules/nats-callout-removed.nix | 11 +++++++----
 nix/host-modules/swarm-nats.nix           |  8 +-------
 nix/module-eval/nats-authelia.nix         | 13 ++++++++-----
 3 files changed, 16 insertions(+), 16 deletions(-)

diff --git a/nix/host-modules/nats-callout-removed.nix b/nix/host-modules/nats-callout-removed.nix
index 24a6d426..0efb5f6a 100644
--- a/nix/host-modules/nats-callout-removed.nix
+++ b/nix/host-modules/nats-callout-removed.nix
@@ -1,5 +1,6 @@
 # Removal shim for the queue's callout nkey options, and for the copies of
-# their seeds inside the `swarm-nats` container.
+# their seeds and of the responder's OIDC client secret inside the
+# `swarm-nats` container.
 #
 # The callout issuer and user keys live in the swarm secret store beside the
 # callout xkey: `swarm-bao-nats-callout-xkey` in ./swarm-nats.nix creates
@@ -33,7 +34,7 @@ let
     (lib.mkRemovedOptionModule [ "services" "hyperhive" "swarm" "nats" name ] message)
   ];
 
-  containerSeedDir = "/var/lib/nixos-containers/swarm-nats/var/lib/swarm-nats-auth";
+  containerSecretDir = "/var/lib/nixos-containers/swarm-nats/var/lib/swarm-nats-auth";
 in
 {
   imports = lib.concatLists [
@@ -44,9 +45,11 @@ in
     (removed "calloutIssuerSeedFile" (seedFile "issuer.seed"))
   ];
 
-  # The responder reads both seeds from the store and names neither file.
-  systemd.tmpfiles.rules = map (f: "r ${containerSeedDir}/${f}") [
+  # The responder reads both seeds and its OIDC client secret from the store
+  # and names none of these files.
+  systemd.tmpfiles.rules = map (f: "r ${containerSecretDir}/${f}") [
     "callout-user.seed"
     "issuer.seed"
+    "oidc-client.secret"
   ];
 }
diff --git a/nix/host-modules/swarm-nats.nix b/nix/host-modules/swarm-nats.nix
index 8fa80cd7..0c56e96b 100644
--- a/nix/host-modules/swarm-nats.nix
+++ b/nix/host-modules/swarm-nats.nix
@@ -513,13 +513,7 @@ in
     # The bind source has to exist before the container starts, leaf or not:
     # nixos-container refuses to start over a missing one, which would take
     # the whole queue down rather than only its TLS.
-    #
-    # The `r` removes a copy of the responder's OIDC client secret a container
-    # may still hold: the responder reads it from the store and names no file.
-    systemd.tmpfiles.rules = [
-      "d ${tlsDir} 0755 root root -"
-      "r ${hostPath "oidc-client.secret"}"
-    ];
+    systemd.tmpfiles.rules = [ "d ${tlsDir} 0755 root root -" ];
 
     containers.swarm-nats = {
       autoStart = true;
diff --git a/nix/module-eval/nats-authelia.nix b/nix/module-eval/nats-authelia.nix
index 69cb2a37..1d009b75 100644
--- a/nix/module-eval/nats-authelia.nix
+++ b/nix/module-eval/nats-authelia.nix
@@ -406,9 +406,10 @@ let
     {
       # The responder reads its OIDC secret from the store itself, so no host
       # unit fetches it, no credential or flag carries it, and a copy a
-      # container still holds is removed. On or off the store's host alike;
-      # the callout key fetch beside it is the control that the unit set is
-      # read at all, and the store cert role the control on the flags.
+      # container still holds is removed, also on a host with the queue off.
+      # On or off the store's host alike; the callout key fetch beside it is
+      # the control that the unit set is read at all, and the store cert role
+      # the control on the flags.
       name = "the responder's OIDC secret is fetched by no unit and carried by no credential or flag, and the container's copy is removed";
       ok =
         let
@@ -418,14 +419,16 @@ let
             && h.systemd.services ? swarm-bao-nats-callout-xkey;
           u = responderOf natsWithStoreIdentity;
           copy = natsWithStoreIdentity.systemd.services.swarm-nats-auth-secrets.script;
-          rules = natsWithStoreIdentity.systemd.tmpfiles.rules;
+          removesCopy = h: lib.elem "r ${dir}/oidc-client.secret" h.systemd.tmpfiles.rules;
+          dir = "/var/lib/nixos-containers/swarm-nats/var/lib/swarm-nats-auth";
         in
         fetchedNowhere natsWithStoreIdentity
         && fetchedNowhere natsOnStoreHost
         && !(lib.any (lib.hasInfix "oidc-client") u.serviceConfig.LoadCredential)
         && !(lib.hasInfix "client-secret" u.serviceConfig.ExecStart)
         && lib.hasInfix "--store-cert-role swarm-nats-auth" u.serviceConfig.ExecStart
-        && lib.elem "r /var/lib/nixos-containers/swarm-nats/var/lib/swarm-nats-auth/oidc-client.secret" rules
+        && removesCopy natsWithStoreIdentity
+        && removesCopy autheliaNotColocated
         && !(lib.hasInfix "oidc-client" copy)
         && !(lib.hasInfix "authelia" copy);
     }