vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

nats-callout-removed: remove the container's OIDC secret copy here, ungated

Browse source 
The tmpfiles `r` rule for the stale `oidc-client.secret` in the
swarm-nats container sat in swarm-nats.nix under `deploy.nats.enable`,
so a host that turned the queue off kept the copy. It now sits in the
ungated removal shim next to the seed copies' rules, which is where the
S2 plan put it and the one file to delete when the deprecation window
closes. The module-eval case asserts the rule on a host with the queue
off as well.
This commit is contained in:
atlas 2026-10-06 15:25:29 +02:00
commit f83030281e
3 changed files with 16 additions and 16 deletions
Download patch file Download diff file Expand all files Collapse all files

8
nix/host-modules/swarm-nats.nix
View file

@ -513,13 +513,7 @@ in
# The bind source has to exist before the container starts, leaf or not:
# nixos-container refuses to start over a missing one, which would take
# the whole queue down rather than only its TLS.
#
# The `r` removes a copy of the responder's OIDC client secret a container
# may still hold: the responder reads it from the store and names no file.
systemd.tmpfiles.rules = [
"d ${tlsDir} 0755 root root -"
"r ${hostPath "oidc-client.secret"}"
];
systemd.tmpfiles.rules = [ "d ${tlsDir} 0755 root root -" ];
containers.swarm-nats = {
autoStart = true;