40 lines
1.7 KiB
Nix
40 lines
1.7 KiB
Nix
# Glue: where authelia runs on this host, the hive collector's wait for its
|
|
# client secret file is ordered after authelia's container, because the
|
|
# named file may be one authelia mints.
|
|
#
|
|
# ONE PAIRING PER FILE — the hive collector's secret-wait unit ← authelia's
|
|
# container, and nothing else. Deleting this leaves a wait that polls for the
|
|
# file without ordering against anything, which is what a host without
|
|
# authelia already gets.
|
|
#
|
|
# ⚠️ Gated on the unit existing, not only on authelia being here: setting
|
|
# `systemd.services.hive-otel-client-secret.after` on a host without the unit
|
|
# would define one with no ExecStart. The gate restates ./otel.nix's `waits`
|
|
# (a sender identity, and a secret file that is not the one the store fetch
|
|
# writes); a change to `waits` must change it here too.
|
|
{
|
|
lib,
|
|
config,
|
|
...
|
|
}:
|
|
let
|
|
hyperhiveCfg = config.services.hyperhive;
|
|
otel = hyperhiveCfg.otel;
|
|
autheliaMachine = hyperhiveCfg.swarm.authelia.machine;
|
|
|
|
# ./otel.nix: `senderAuth`, `hiveLeaf`, `fetches`, `fetchedSecretPath`.
|
|
senderAuth = otel.clientSecretFile != null && hyperhiveCfg.hiveName != null;
|
|
hiveLeaf =
|
|
hyperhiveCfg.deploy.bao.clientCertFile != null && hyperhiveCfg.deploy.bao.clientKeyFile != null;
|
|
fetchedSecretPath = "/var/lib/hive-otel-oidc/${hyperhiveCfg.swarm.authelia.hiveClientPrefix}${toString hyperhiveCfg.hiveName}.secret";
|
|
fetches = senderAuth && hiveLeaf && otel.clientSecretFile == fetchedSecretPath;
|
|
waits = senderAuth && !fetches;
|
|
in
|
|
{
|
|
config = lib.mkIf (hyperhiveCfg.deploy.authelia.enable && otel.collector.enable && waits) {
|
|
systemd.services.hive-otel-client-secret = {
|
|
after = [ "container@${autheliaMachine}.service" ];
|
|
requires = [ "container@${autheliaMachine}.service" ];
|
|
};
|
|
};
|
|
}
|