a2a94f63c8
Each container now runs the journal forwarder the queue's container runs, pushing to a receiver of its own on the swarm collector as the service's existing OIDC client, with the client's secret read inside the container by the fetch unit. Their store identities are system credentials, so the fetch unit loads them too. The three containers drop --link-journal=host, which hid their journals from the forwarder, and the host collector stops reading them.
38 lines
1.4 KiB
Nix
38 lines
1.4 KiB
Nix
# Glue: register the swarm builder as an OIDC client wherever authelia runs.
|
|
#
|
|
# ONE PAIRING PER FILE — swarm-builder ← authelia, and nothing else. Deleting
|
|
# this leaves a builder whose token requests authelia answers with a 401, and
|
|
# no minted secret for swarm-secret-publish to put in the store.
|
|
#
|
|
# ⚠️ Gated on authelia being HERE, and NOT on this host running the builder,
|
|
# for ./glue-controller-oidc-client.nix's reason: a client is a row in THIS
|
|
# host's provider config. Registered whether or not any host enables the
|
|
# builder: nothing in `swarm.*` records that, so a swarm without one carries
|
|
# one unused client and one unused minted secret.
|
|
{
|
|
lib,
|
|
config,
|
|
...
|
|
}:
|
|
let
|
|
hyperhiveCfg = config.services.hyperhive;
|
|
deployCfg = hyperhiveCfg.deploy;
|
|
clientId = hyperhiveCfg.swarm.builder.clientId;
|
|
in
|
|
{
|
|
config = lib.mkIf deployCfg.authelia.enable {
|
|
services.hyperhive.swarm.authelia.oidc.clients = [
|
|
{
|
|
id = clientId;
|
|
description = "HyperHive swarm builder";
|
|
# `client_credentials`: a daemon authenticating as itself.
|
|
kind = "machine";
|
|
audience = [ clientId ];
|
|
# The container's journal forwarder mints its token as this client, for
|
|
# the swarm collector's receiver, which verifies it offline against
|
|
# `/jwks.json`; authelia's default opaque handle fails there.
|
|
accessTokenSignedResponseAlg = "RS256";
|
|
}
|
|
];
|
|
};
|
|
}
|