316cef94d1
One SSO provider per swarm, and a hive is a client of it by default: `url` exists everywhere so a hive knows where to send people, while the container only exists where `swarm.enableRequiredServices` says the swarm's shared services live. Operator and agents are both subjects of the same provider, differentiated by roles/claims rather than by mechanism. The users store is therefore written by swarm-controller rather than maintained by hand — agents are created and destroyed continuously, so the subject set is dynamic. This module only guarantees the file exists and parses, so authelia starts with nobody in it instead of failing to start; a placeholder account would be a credential nobody meant to create. Small-deployment defaults, with scope as the justification rather than preference: file users backend, local sqlite storage (redis buys shared session state across replicas and there is one instance), filesystem notifier (SMTP mails humans; provisioning is programmatic). Secrets are generated in-container on first boot, sharing the authelia unit's user/group/StateDirectory so systemd creates the directory owned by the account that reads them. Nothing outside the container reads these keys, which is what makes that right rather than merely easier — hive-matrix generates its token host-side only because hive-c0re has to read that one. Per-service integration (authelia's auth_request in front of the gateway's existing auth_basic locations) is deliberately not here: standing an SSO provider up is reversible, cutting every operator-facing vhost over to it is not.
31 lines
1 KiB
Nix
31 lines
1 KiB
Nix
# The full hyperhive host stack, pulled together in one place — this
|
|
# is what the flake exports as `nixosModules.default` (wrapped with
|
|
# the package/source wiring; see flake.nix). One import covers
|
|
# everything; `services.hyperhive.enable = true` turns the stack on.
|
|
#
|
|
# The forge is mandatory — hive-c0re mirrors every agent's applied
|
|
# config repo into it and it's the canonical store for the meta flake
|
|
# + `internal/*` repos, so there's no enable toggle; it deploys with
|
|
# hyperhive itself. hive-matrix is opt-in (off by default). All
|
|
# subsystems rely on `services.hyperhive.domain`, which is required
|
|
# (asserted in hive-network.nix) whenever hyperhive is enabled.
|
|
{
|
|
imports = [
|
|
./hyperhive.nix
|
|
./hive-c0re
|
|
./hive-ci.nix
|
|
./hive-forge
|
|
./hive-gateway
|
|
./hive-matrix.nix
|
|
./hive-network.nix
|
|
./hive-priv.nix
|
|
./hive-tls.nix
|
|
./otel.nix
|
|
./swarm-authelia.nix
|
|
./swarm-ca.nix
|
|
./swarm-controller.nix
|
|
./swarm-snapshot-store.nix
|
|
./swarm-wireguard.nix
|
|
./swarm.nix
|
|
];
|
|
}
|