52c931c3a7
The responder reads the callout xkey before it connects, so a responder with no secret store no longer starts, and its "deny every agent token, serve OIDC" mode could not run. That mode is gone: `agent_token::Store` is built from the settings the xkey load already read, and `authorize` takes a source rather than an `Option` of one. On the nix side, `deploy.nats.authBaoClientCertFile` and `authBaoClientKeyFile` are now asserted at eval when the queue is enabled. The units' no-identity branches, the copy unit's empty-file fallback and its "denies agent tokens" message are removed; an absent leaf file fails `swarm-nats-auth-secrets` like an absent seed does.
37 lines
1.4 KiB
Nix
37 lines
1.4 KiB
Nix
# Glue: point the queue's auth-callout responder at the bao leaf minted for it.
|
|
#
|
|
# ONE PAIRING PER FILE — the swarm-nats-auth principal ← bao, and nothing else.
|
|
# Deleting this leaves a queue with no responder identity unless the operator
|
|
# names one, which ./swarm-nats.nix refuses at eval.
|
|
#
|
|
# ⚠️ The minting is NOT here. ./glue-bao-tls.nix holds the CA and signs the
|
|
# leaf. What belongs here is the pairing: which paths the responder presents.
|
|
#
|
|
# ⚠️ Gated on the leaf existing, not on the store being enabled, for the reason
|
|
# ./glue-nats-bao-identity.nix states: the hive hosting the queue need not be
|
|
# the hive hosting the store.
|
|
#
|
|
# Everything is `mkDefault`. An operator naming their own paths wins.
|
|
{
|
|
lib,
|
|
config,
|
|
...
|
|
}:
|
|
let
|
|
hyperhiveCfg = config.services.hyperhive;
|
|
deployCfg = hyperhiveCfg.deploy;
|
|
baoDeploy = deployCfg.bao;
|
|
|
|
# Where ./glue-bao-tls.nix puts the leaves, derived from the reader's own path
|
|
# rather than repeating that file's directory literal.
|
|
haveMintedPki = baoDeploy.clientCertFile != null;
|
|
pkiDir = if haveMintedPki then builtins.dirOf baoDeploy.clientCertFile else null;
|
|
in
|
|
{
|
|
config = lib.mkIf (deployCfg.nats.enable && haveMintedPki) {
|
|
services.hyperhive.deploy.nats = {
|
|
authBaoClientCertFile = lib.mkDefault "${pkiDir}/nats-auth.pem";
|
|
authBaoClientKeyFile = lib.mkDefault "${pkiDir}/nats-auth-key.pem";
|
|
};
|
|
};
|
|
}
|