vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

drop the one-time migration: seed the store from a leftover file once, leave the file

Browse source 
A leftover plaintext client secret is stored once with -cas=0 when the store holds none, so nothing rotates. A store value wins over a different file. The file is no longer read back, compared or removed, and the migration unit is gone.
This commit is contained in:
atlas 2026-10-30 16:12:37 +01:00 • committed by mara
commit fcc9c8d0ba
1 changed files with 114 additions and 350 deletions
Download patch file Download diff file Expand all files Collapse all files

14
docs/swarm/credentials.md
View file

@ -90,8 +90,7 @@ only when the store answers and holds none does it run `authelia crypto hash gen
create the leaf and write the digest. Authelia keeps only the digest on disk, in
`oidc-clients/<id>.digest`, and starts from it while the store is down. A store that
can't answer a read never mints, because a second secret would rotate the first. A client with a
secret but no digest, in the store or in a leftover plaintext file, gets the digest of
that secret and keeps the secret; `authelia crypto hash generate` computes the digest,
secret in the store but no digest gets the digest of that secret and keeps the secret; `authelia crypto hash generate` computes the digest,
with the password typed into its prompt through a pty, never in a command line.
`swarm-authelia-bridge` fetches its own secret from
`swarm/services/swarm-authelia-bridge/oidc/client` into
@ -99,14 +98,9 @@ with the password typed into its prompt through a pty, never in a command line.
answer keeps the bridge down while it retries. A container without the publisher's
identity keeps the plaintext in `oidc-clients/<id>.secret`, as before.
`authelia-swarm-client-secrets` moves the `oidc-clients/<id>.secret` files an earlier
release left. For each, it stores the file's value when the store holds none, reads it
back, and removes the file only when the store holds the same value; it logs one line per
client containing `removed the file`. A store that holds a different value keeps both and
logs an `err` line, and the unit stays failed without retrying, because only an operator can
say which value is right; a store that doesn't answer keeps the file and retries. Once no
file remains the unit does nothing. A file for a client that's no longer registered stays
in place, with a log line.
The mint reads an `oidc-clients/<id>.secret` file an earlier release left once: when the store holds
no value for that client, it stores the file's value with `-cas=0`, so the secret keeps its value.
A store that holds a value wins, whatever the file says, and the file stays on disk, unused.
Three telemetry collectors exist, and each one fails that test: each reads its
own secret out of the store, under its own identity.