3be6096c26
The publisher's `enable` default read `deploy.authelia.enable` from the publisher's own module (swarm-secret-publisher.nix). It now defaults to `false`, and glue-secret-publisher-authelia.nix sets it `mkDefault true` wherever authelia runs, so the effective value is unchanged. The option loses its `defaultText`, and its description names the glue. The `deploy.authelia.enable` read in `active` stays: every file the unit copies is under authelia's `hostClientSecretDir`, so it is a requirement of the unit, not a co-location toggle. Part of #3742.
24 lines
820 B
Nix
24 lines
820 B
Nix
# Glue: turn the secret publisher on wherever authelia mints the secrets.
|
|
#
|
|
# ONE PAIRING PER FILE — publisher ← authelia, and nothing else. Deleting this
|
|
# leaves the publisher off unless an operator enables it, so every OIDC client
|
|
# secret authelia mints stays on this host and no reader gets one, this
|
|
# host's included.
|
|
#
|
|
# ⚠️ Gated on authelia alone, NOT on `deploy.bao.enable`: a publisher beside a
|
|
# remote store, holding a leaf issued out of band, is a deployment the
|
|
# publisher exists to serve (see that option's description).
|
|
{
|
|
lib,
|
|
config,
|
|
...
|
|
}:
|
|
let
|
|
deployCfg = config.services.hyperhive.deploy;
|
|
in
|
|
{
|
|
# `mkDefault`: an operator's explicit value wins.
|
|
config = lib.mkIf deployCfg.authelia.enable {
|
|
services.hyperhive.deploy.swarm-secret-publisher.enable = lib.mkDefault true;
|
|
};
|
|
}
|