d30cb7d122
The mint creates each client's secret in the swarm secret store and writes only the digest to disk. It mints only when the store answers and holds none. A new unit moves the plaintext files an earlier release left into the store and removes each once the store holds the same value. The bridge reads its secret from the store into /run before each start. The secret publisher unit and its path unit are gone.
86 lines
3.8 KiB
Nix
86 lines
3.8 KiB
Nix
# The binary cache the swarm pushes agent closures to, as every host sees it:
|
|
# which attic server, and which cache on it. Both default to the swarm's own,
|
|
# which the host that sets `deploy.attic.enable` runs (./swarm-attic.nix); an
|
|
# operator with an instance outside the swarm overrides both.
|
|
{ lib, config, ... }:
|
|
let
|
|
swarmDomain = config.services.hyperhive.swarm.domain;
|
|
|
|
# Total on a null swarm domain, as every sibling module is: the
|
|
# required-domain assertion in hive-network.nix is what an operator should
|
|
# see, not a coercion error from here.
|
|
domainBase = if swarmDomain == null then "invalid" else swarmDomain;
|
|
in
|
|
{
|
|
options.services.hyperhive.swarm.attic = {
|
|
otel.clientId = lib.mkOption {
|
|
type = lib.types.str;
|
|
readOnly = true;
|
|
default = "swarm-attic-collector";
|
|
description = ''
|
|
OAuth2 client id the journal forwarder inside the cache's container
|
|
authenticates as, and the audience it asks its token for.
|
|
|
|
Read-only because three hosts have to agree on it: authelia registers
|
|
the client (`glue-attic-otel-oidc-client.nix`), the swarm collector
|
|
admits it on the container's receiver (`swarm.otel.serviceProducers`),
|
|
and authelia's mint stores its secret in the store.
|
|
'';
|
|
};
|
|
|
|
ownDomain = lib.mkOption {
|
|
type = lib.types.str;
|
|
readOnly = true;
|
|
default = "attic.${domainBase}";
|
|
defaultText = lib.literalExpression ''"attic.''${services.hyperhive.swarm.domain}"'';
|
|
description = ''
|
|
Read-only: the name the swarm's own cache is served under, which
|
|
{option}`services.hyperhive.swarm.attic.domain` defaults to. A sibling of the
|
|
swarm's other service names, so the swarm-services sub-CA can issue for it,
|
|
and in `swarm.serviceDomains` on every host whether or not one runs it.
|
|
'';
|
|
};
|
|
|
|
domain = lib.mkOption {
|
|
type = lib.types.nullOr lib.types.str;
|
|
default = config.services.hyperhive.swarm.attic.ownDomain;
|
|
defaultText = lib.literalExpression "services.hyperhive.swarm.attic.ownDomain";
|
|
example = "cache.example.org";
|
|
description = ''
|
|
Name of the attic server, with no scheme: the swarm builder pushes to
|
|
`https://<domain>`, and trusts the certificate the system roots do, so
|
|
a Let's Encrypt certificate works and none is pinned. Set together with
|
|
{option}`services.hyperhive.swarm.attic.cache`; evaluation fails when only
|
|
one is set.
|
|
|
|
Defaults to the swarm's own cache, the same on every host. For a cache
|
|
outside the swarm, override both options and leave
|
|
{option}`services.hyperhive.deploy.attic.enable` unset. With no cache
|
|
behind the default, a push fails and the closure record says it is not
|
|
cached.
|
|
|
|
Null pushes nothing: the swarm builder does not push, and the closure
|
|
record says it is not cached.
|
|
|
|
The push token is not an option. It is at
|
|
`secret/swarm/services/attic/push-token` in the swarm secret store
|
|
(field `value`), and the builder reads it on every push. The swarm's own
|
|
cache creates it; for an external cache the operator writes it.
|
|
'';
|
|
};
|
|
|
|
cache = lib.mkOption {
|
|
# attic's own rule for a cache name; the builder checks the same at start.
|
|
type = lib.types.nullOr (lib.types.strMatching "^[A-Za-z0-9][A-Za-z0-9_+-]{0,49}$");
|
|
default = "swarm";
|
|
example = "grid";
|
|
description = ''
|
|
Name of the cache on {option}`services.hyperhive.swarm.attic.domain`
|
|
that the swarm builder pushes closures to, the swarm's own cache by
|
|
default. The push token must be allowed to
|
|
push to it. The name follows attic's rule: 1 to 50 letters,
|
|
digits, `-`, `_` or `+`, starting with a letter or digit.
|
|
'';
|
|
};
|
|
};
|
|
}
|