5d8ab675cd
deploy.review-classifier.enable (off by default, not derived from allSwarmServices) puts swarm-review-classifier in its own network namespace on the bridge, with claude-code and the daemon. A host unit copies the classifier's store leaf into the container; the daemon reads its queue client secret and the API key from the store with it. - glue-bao-tls mints the review-classifier leaf; swarm-bao writes the swarm-review-classifier role, reading exactly the API key path and the classifier's queue client secret; swarm.nix reserves its CN. - glue-review-classifier-oidc-client registers the machine client where authelia runs, and the publisher carries its secret to the store. - swarm-nats passes the client id to the responder as --review-classifier-client. - Where the host runs a hive-tier collector, claude exports its metrics there; the daemon adds the repo and the PR to the resource attributes. - module-eval: the new grant and leaf (bao-grants, now sixteen granting units), the container's presence and its unit (core-toggle), and the client registration and publishing (secret-publisher).
35 lines
1.2 KiB
Nix
35 lines
1.2 KiB
Nix
# Glue: register the review classifier as an OIDC client wherever authelia
|
|
# runs.
|
|
#
|
|
# ONE PAIRING PER FILE — swarm-review-classifier ← authelia, and nothing else.
|
|
# Deleting this leaves a classifier whose token requests authelia answers with
|
|
# a 401, and no minted secret for swarm-secret-publish to put in the store.
|
|
#
|
|
# ⚠️ Gated on authelia being HERE, and NOT on this host running the
|
|
# classifier, for ./glue-controller-oidc-client.nix's reason: a client is a row
|
|
# in THIS host's provider config. Registered whether or not any host enables
|
|
# the classifier: nothing in `swarm.*` records that, so a swarm without one
|
|
# carries one unused client and one unused minted secret.
|
|
{
|
|
lib,
|
|
config,
|
|
...
|
|
}:
|
|
let
|
|
hyperhiveCfg = config.services.hyperhive;
|
|
deployCfg = hyperhiveCfg.deploy;
|
|
clientId = hyperhiveCfg.swarm.review-classifier.clientId;
|
|
in
|
|
{
|
|
config = lib.mkIf deployCfg.authelia.enable {
|
|
services.hyperhive.swarm.authelia.oidc.clients = [
|
|
{
|
|
id = clientId;
|
|
description = "HyperHive review classifier";
|
|
# `client_credentials`: a daemon authenticating as itself.
|
|
kind = "machine";
|
|
audience = [ clientId ];
|
|
}
|
|
];
|
|
};
|
|
}
|