vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

nats-callout-removed: remove the container's OIDC secret copy here, ungated

Browse source 
The tmpfiles `r` rule for the stale `oidc-client.secret` in the
swarm-nats container sat in swarm-nats.nix under `deploy.nats.enable`,
so a host that turned the queue off kept the copy. It now sits in the
ungated removal shim next to the seed copies' rules, which is where the
S2 plan put it and the one file to delete when the deprecation window
closes. The module-eval case asserts the rule on a host with the queue
off as well.
This commit is contained in:
atlas 2026-10-06 15:25:29 +02:00
commit f83030281e
3 changed files with 16 additions and 16 deletions
Download patch file Download diff file Expand all files Collapse all files

13
nix/module-eval/nats-authelia.nix
View file

@ -406,9 +406,10 @@ let
{
# The responder reads its OIDC secret from the store itself, so no host
# unit fetches it, no credential or flag carries it, and a copy a
# container still holds is removed. On or off the store's host alike;
# the callout key fetch beside it is the control that the unit set is
# read at all, and the store cert role the control on the flags.
# container still holds is removed, also on a host with the queue off.
# On or off the store's host alike; the callout key fetch beside it is
# the control that the unit set is read at all, and the store cert role
# the control on the flags.
name = "the responder's OIDC secret is fetched by no unit and carried by no credential or flag, and the container's copy is removed";
ok =
let
@ -418,14 +419,16 @@ let
&& h.systemd.services ? swarm-bao-nats-callout-xkey;
u = responderOf natsWithStoreIdentity;
copy = natsWithStoreIdentity.systemd.services.swarm-nats-auth-secrets.script;
rules = natsWithStoreIdentity.systemd.tmpfiles.rules;
removesCopy = h: lib.elem "r ${dir}/oidc-client.secret" h.systemd.tmpfiles.rules;
dir = "/var/lib/nixos-containers/swarm-nats/var/lib/swarm-nats-auth";
in
fetchedNowhere natsWithStoreIdentity
&& fetchedNowhere natsOnStoreHost
&& !(lib.any (lib.hasInfix "oidc-client") u.serviceConfig.LoadCredential)
&& !(lib.hasInfix "client-secret" u.serviceConfig.ExecStart)
&& lib.hasInfix "--store-cert-role swarm-nats-auth" u.serviceConfig.ExecStart
&& lib.elem "r /var/lib/nixos-containers/swarm-nats/var/lib/swarm-nats-auth/oidc-client.secret" rules
&& removesCopy natsWithStoreIdentity
&& removesCopy autheliaNotColocated
&& !(lib.hasInfix "oidc-client" copy)
&& !(lib.hasInfix "authelia" copy);
}