vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

nats-callout-removed: remove the container's OIDC secret copy here, ungated

Browse source 
The tmpfiles `r` rule for the stale `oidc-client.secret` in the
swarm-nats container sat in swarm-nats.nix under `deploy.nats.enable`,
so a host that turned the queue off kept the copy. It now sits in the
ungated removal shim next to the seed copies' rules, which is where the
S2 plan put it and the one file to delete when the deprecation window
closes. The module-eval case asserts the rule on a host with the queue
off as well.
This commit is contained in:
atlas 2026-10-06 15:25:29 +02:00
commit f83030281e
3 changed files with 16 additions and 16 deletions
Download patch file Download diff file Expand all files Collapse all files

11
nix/host-modules/nats-callout-removed.nix
View file

@ -1,5 +1,6 @@
# Removal shim for the queue's callout nkey options, and for the copies of
# their seeds inside the `swarm-nats` container.
# their seeds and of the responder's OIDC client secret inside the
# `swarm-nats` container.
#
# The callout issuer and user keys live in the swarm secret store beside the
# callout xkey: `swarm-bao-nats-callout-xkey` in ./swarm-nats.nix creates
@ -33,7 +34,7 @@ let
(lib.mkRemovedOptionModule [ "services" "hyperhive" "swarm" "nats" name ] message)
];
containerSeedDir = "/var/lib/nixos-containers/swarm-nats/var/lib/swarm-nats-auth";
containerSecretDir = "/var/lib/nixos-containers/swarm-nats/var/lib/swarm-nats-auth";
in
{
imports = lib.concatLists [
@ -44,9 +45,11 @@ in
(removed "calloutIssuerSeedFile" (seedFile "issuer.seed"))
];
# The responder reads both seeds from the store and names neither file.
systemd.tmpfiles.rules = map (f: "r ${containerSeedDir}/${f}") [
# The responder reads both seeds and its OIDC client secret from the store
# and names none of these files.
systemd.tmpfiles.rules = map (f: "r ${containerSecretDir}/${f}") [
"callout-user.seed"
"issuer.seed"
"oidc-client.secret"
];
}