0ff5c8110b
The swarm collector's OIDC client secret only existed where authelia did: `swarm-otel-oidc-secret.service` copied the minted plaintext out of authelia's container tree, reachable only because the two share a host's network namespace. A swarm that placed authelia elsewhere delivered nothing, and the option's own description said so — "a deployment that places authelia elsewhere points this at a file it delivers itself." Same gap as #3853 and #4234, and this is the swarm-otel twin of #4234's fix for Grafana. Mirrors PR #4361 (Grafana) almost exactly: - `swarm-bao-otel-oidc.service` reads `swarm/services/<client-id>/oidc/client` out of the store, in every deployment, replacing the co-located copy unit outright — one delivery route, not two, per the ruling that landed under #4234. - Client registration moved out of `swarm-otel.nix`'s own `config` block (gated on this host running the collector) into `glue-swarm-otel-oidc-client.nix` (gated on this host running authelia), the same split `glue-grafana-oidc-client.nix` made. It was broken the same way: a split deployment registered the client nowhere at all, so authelia never minted a secret for the publisher to send on. - The publisher's `services` prefix (write grant in `swarm-bao.nix`, hive read grant in `policy::render`) already covers any service's path — nothing to add there. `swarm-secret-publisher.nix` only grew `serviceClientIds` by one entry. One judgement call, stated rather than buried: the store-reading unit renders only where this host holds a client identity (`deploy.bao.clientCertFile`/`clientKeyFile`), rather than asserting it the way `swarm-grafana.nix` does. Grafana's local login form is disabled unconditionally, so a Grafana with no OIDC secret has no way in at all — that earns a hard refusal. This collector without a credential still receives every hive's telemetry; only its own pushes to the stores go out unauthenticated and get refused there, an already-supported degrade the module's own `haveCollectorSecret` flag named before this change. So the reading unit follows the shape `glue-matrix-bao-token.nix` and `glue-queue-agent-credential.nix` use for their own optional readers: no unit when the identity is absent, not a build refusal. Fixtures mirror #4361's: `otelBaoWithAuthelia`/`otelBaoRemoteAuthelia` are the positive pair (co-located and split, both reading through the store), `otelNoIdentity` is the negative — no reading unit, no assertion firing, `clientSecretFile` left null. Refs #4258
58 lines
2.5 KiB
Nix
58 lines
2.5 KiB
Nix
# Glue: register the swarm's collector as an OIDC client wherever authelia
|
|
# runs.
|
|
#
|
|
# ONE PAIRING PER FILE — swarm-otel ← authelia, and nothing else. Deleting
|
|
# this leaves a swarm whose collector is not a client authelia has ever heard
|
|
# of, so no token it presents is ever accepted and authelia mints no secret
|
|
# for the publisher to send on.
|
|
#
|
|
# ⚠️ Gated on authelia being HERE, and deliberately NOT on this host running
|
|
# the collector. A client is a row in THIS host's provider config, so it can
|
|
# only be declared where that config is rendered — and ./swarm-otel.nix's
|
|
# whole `config` block hangs off `deploy.swarm-otel.enable`, so a swarm with
|
|
# the collector and authelia on different hosts registered the client
|
|
# nowhere at all. Same bug, same fix, as ./glue-grafana-oidc-client.nix one
|
|
# module over — read that file's own comment for the property this one
|
|
# shares with it.
|
|
#
|
|
# ⚠️ Registered whether or not the swarm has a collector, for the same
|
|
# reason as Grafana's: nothing in `swarm.*` records that one exists,
|
|
# `deploy.swarm-otel.enable` only answers "does THIS host run it". The cost
|
|
# is one unused client and one unused minted secret in a swarm with no
|
|
# collector — the same trade ./swarm-otel.nix already made for this exact
|
|
# client when it dropped the published-scrape-target guard on registering it.
|
|
{
|
|
lib,
|
|
config,
|
|
...
|
|
}:
|
|
let
|
|
hyperhiveCfg = config.services.hyperhive;
|
|
deployCfg = hyperhiveCfg.deploy;
|
|
otelCfg = hyperhiveCfg.swarm.otel;
|
|
in
|
|
{
|
|
config = lib.mkIf (hyperhiveCfg.enable && deployCfg.authelia.enable) {
|
|
# One declaration, two readers: `clientId` and `audience` are read-only
|
|
# options ./swarm-otel.nix derives from the scrape/push targets it owns,
|
|
# so this file states neither formula a second time.
|
|
services.hyperhive.swarm.authelia.oidc.clients = [
|
|
{
|
|
id = otelCfg.clientId;
|
|
description = "HyperHive swarm collector";
|
|
kind = "machine";
|
|
# Grants `authelia.bearer.authz`, without which the authz endpoint
|
|
# refuses an otherwise valid token and blames the token rather than
|
|
# the missing grant.
|
|
bearerAuthz = true;
|
|
audience = otelCfg.audience;
|
|
# Stated rather than left on authelia's default, because the two
|
|
# agreeing today is not the same as this being the required value:
|
|
# authelia permits only basic / JWT methods for a confidential
|
|
# client holding this scope, and enforces it in the startup
|
|
# validator.
|
|
tokenEndpointAuthMethod = "client_secret_basic";
|
|
}
|
|
];
|
|
};
|
|
}
|