1f4736e79b
A new `auth_request` responder on the log store's host. nginx sends it every `/select/logsql/` request whose `Authorization` is `Bearer swarm-agent.<agent>.<secret>`; it answers 200 when the secret is the one stored at `swarm/agents/<agent>/queue` (`swarm-agent-verify`), 401 otherwise. Every other bearer still goes to authelia, so agents still presenting the hive's shared OIDC client keep working. `auth_request` takes a fixed URI, so the split is a `map` on `$http_authorization` plus an internal location that rewrites to the map's pick. Checked against nginx 1.30.5 with stub upstreams: an agent token only the stub validator accepts gets 200, a token only the stub authelia accepts gets 200, every wrong one 401, and the internal locations 404 from outside. The responder serves a unix socket in its own traverse-only runtime directory and reads the store under its own leaf (`swarm-logs-auth`), whose policy is `swarm/agents/+/queue`, read-only. glue-bao-tls mints the leaf where the store runs; elsewhere the operator places it, and eval refuses a log store host without one. Part of #4459.
31 lines
1.1 KiB
Nix
31 lines
1.1 KiB
Nix
# Glue: point the log store's agent auth responder at the bao leaf minted for it.
|
|
#
|
|
# ONE PAIRING PER FILE — the swarm-logs-auth principal ← bao, and nothing else.
|
|
# Deleting this leaves a log store with no responder identity unless the
|
|
# operator names one, which ./swarm-victorialogs.nix refuses at eval.
|
|
#
|
|
# ⚠️ The minting is NOT here. ./glue-bao-tls.nix holds the CA and signs the
|
|
# leaf. What belongs here is the pairing: which paths the responder presents.
|
|
#
|
|
# ⚠️ Gated on the store running on this host, the only place the leaf is
|
|
# minted. A log-store host without the store gets no default here; the
|
|
# operator places the responder's leaf and names it.
|
|
#
|
|
# Everything is `mkDefault`. An operator naming their own paths wins.
|
|
{
|
|
lib,
|
|
config,
|
|
...
|
|
}:
|
|
let
|
|
deployCfg = config.services.hyperhive.deploy;
|
|
pkiDir = import ./lib/bao-pki-dir.nix;
|
|
in
|
|
{
|
|
config = lib.mkIf (deployCfg.victorialogs.enable && deployCfg.bao.enable) {
|
|
services.hyperhive.deploy.victorialogs = {
|
|
authBaoClientCertFile = lib.mkDefault "${pkiDir}/logs-auth.pem";
|
|
authBaoClientKeyFile = lib.mkDefault "${pkiDir}/logs-auth-key.pem";
|
|
};
|
|
};
|
|
}
|