| Filename | Latest commit message | Latest commit date |
|---|---|---|
b68a8ef290
swarm-secret-publish and its path unit now run inside authelia's container, beside the mint, and read each client secret at the path authelia writes it. The host unit and host path unit, which read the secrets through the container's root on the host, are gone, and so is deploy.authelia.hostClientSecretDir, which only they read. The publisher keeps its store identity, the secret-publisher leaf. The host hands the leaf and the store's CA into the container as nspawn system credentials, and the unit loads them; where this host mints the leaf, the container waits for swarm-bao-pki. Authelia does not wait for the publisher, which retries every 30 seconds while the store is down. The container also runs the journal forwarder the other service containers run, pushing to a receiver of its own on the swarm collector (serviceProducers swarm-authelia) as a new machine OIDC client (swarm.authelia.otel.clientId) that authelia registers for itself and the publisher carries to the store. The fetch unit reads it back under the publisher's leaf, also handed to it as a system credential, so the swarm-secret-publisher policy gains read on that one leaf; its stanza keeps create and update, which the exact path would otherwise take from the services/* prefix. Without the leaf the forwarder is off. The container drops --link-journal=host, and the host collector stops reading it. The services' "nothing at <path>" errors name the publisher in authelia's container. |
||
| .. | ||
| src | ||
| Cargo.toml | ||
| README.md | ||
swarm-builder
The swarm builder's build service, in the swarm-builder container on the
host that sets deploy.builder.enable. The design is
docs/swarm/builder.md.
swarm-controller sends one request per config PR head: an agent, a commit and
the PR. This service builds that agent config on the agent base this host was
deployed with, through the host's nix daemon, and answers with the system
closure's store path or the tail of what nix printed. The controller turns
the answer into a swarm-builder commit status on the PR's head.
What a build is
nix buildofnix/builder/check-flake'scheckoutput, with its three inputs overridden:hyperhiveandnixpkgsto this host's own sources, andagenttogit+https://<forge>/agent-configs/<agent>?ref=refs/pull/<pr>/head&rev=<rev>.- The evaluation runs here, pure; the builds run in the host daemon's sandbox as an untrusted client, so a config can neither set daemon options nor read this service's environment.
- Nothing is pushed and nothing is recorded: the closure stays in the host's store until it is collected.
Credentials
The container holds one credential: its own store certificate, which nspawn
hands in at start without a copy on disk. With it the service reads its
queue client secret at start and again when authelia refuses it, and its
read-only forge token at every build.
git gets the token through a credential helper reading the child's
environment, never in a URL or an argument, and the helper answers only an
https request for the forge's host. Its store role reads exactly
those two paths.