3202cde704
`services.hyperhive.enable` and `services.hyperhive.c0re.enable` are gone. One switch, `services.hyperhive.deploy.hive-controller.enable` (default false, as the old toggle was), now gates hive-c0re and hive-priv. Both old paths are `mkRenamedOptionModule` shims in deploy.nix, so a host config that still sets either evaluates as before and gets a rename warning. Every other read of the old toggle is resolved, including the 29 made through the `hyperhiveCfg`/`hiveCfg` aliases: - Dropped: each swarm service and its glue keeps only its own deploy toggle (authelia, bao and its PKI glue, grafana, victorialogs, victoriametrics, the secret publisher, swarm-ca, the OIDC client rows, the controller/nats/matrix-ctl/publisher/services-issuer identities), the forge, and the `domain` deprecation warning. - To deploy.hive-controller.enable: the queue-agent credential reader and its assertion, which feed hive-c0re and write under its state dir, plus their policy-order entry; the network identity assertions; hive-tls's two writes into hive-c0re's environment. - hive-tls runs where the gateway runs self-signed (`gateway.enable && useSelfSigned`), not on every host. - The matrix appservice-token reader and its assertion stay on `deploy.matrix.enable` plus their client-identity checks. They read deploy.matrix's token file and registration script; their deploy.bao inputs are the client-half options a hive sets to read a store it does not run, so gating on deploy.bao.enable would drop the tested remote-reader case. - The `hiveName` assertion moves from hive-network.nix to hyperhive.nix and fires wherever the hive, the store or the homeserver runs: each turns the name into an identifier with no fallback. On a host with `deploy.allSwarmServices` and no hive, the documented services-host recipe, authelia, bao, grafana, victorialogs, victoriametrics, the OIDC client rows and the hive CA now render; before, the old toggle being off left them out. Refs #4500
56 lines
2.6 KiB
Nix
56 lines
2.6 KiB
Nix
# Glue: register the secret store's own journal forwarder as an OIDC client
|
|
# wherever authelia runs.
|
|
#
|
|
# ONE PAIRING PER FILE — swarm-bao's forwarder ← authelia, and nothing else.
|
|
# Deleting this leaves a forwarder authelia has never heard of: the token
|
|
# endpoint refuses it, nothing is minted, the publisher has nothing to copy
|
|
# into the store, and the collector's export is a 401 nobody asked for.
|
|
#
|
|
# ⚠️ A SECOND client beside ./glue-swarm-otel-oidc-client.nix's, not a reuse
|
|
# of it. That one is the swarm collector's identity for what IT pushes; this
|
|
# one belongs to the collector inside the store's container, which is a
|
|
# different principal on a different host — one identity per principal, the
|
|
# rule `swarm-controller.nix` states over its own `queueClientId`.
|
|
#
|
|
# ⚠️ Gated on authelia being HERE, and deliberately NOT on this host running
|
|
# the store. A client is a row in THIS host's provider config, so it can only
|
|
# be declared where that config is rendered, and ./swarm-bao.nix's `config`
|
|
# hangs off `deploy.bao.enable` — the split ./glue-grafana-oidc-client.nix and
|
|
# ./glue-swarm-otel-oidc-client.nix each made for the same reason. Read either
|
|
# file's own comment for the property this one shares with them.
|
|
{
|
|
lib,
|
|
config,
|
|
...
|
|
}:
|
|
let
|
|
hyperhiveCfg = config.services.hyperhive;
|
|
deployCfg = hyperhiveCfg.deploy;
|
|
baoCfg = hyperhiveCfg.swarm.bao;
|
|
in
|
|
{
|
|
config = lib.mkIf deployCfg.authelia.enable {
|
|
# One declaration, two readers: `clientId` is a read-only option
|
|
# ./swarm-bao.nix owns, and ./swarm-otel.nix builds this principal's
|
|
# authenticator audience from the same option.
|
|
services.hyperhive.swarm.authelia.oidc.clients = [
|
|
{
|
|
id = baoCfg.otel.clientId;
|
|
description = "HyperHive secret store journal forwarder";
|
|
kind = "machine";
|
|
redirectUris = [ ];
|
|
# Its own id as its own permitted audience — the self-referential
|
|
# form `swarm-authelia.nix`'s `hiveClients` uses, which is the shape
|
|
# to copy here: this forwarder's token lands on an `oidc/*` receiver
|
|
# of the swarm collector, exactly as a hive's does.
|
|
audience = [ baoCfg.otel.clientId ];
|
|
# ⚠️ What makes the token READABLE by that receiver at all. Authelia's
|
|
# default is an opaque handle, and an `oidc` extension verifies
|
|
# offline against `/jwks.json` — so without this the export fails with
|
|
# a message about the verifier rather than about the token. Same
|
|
# value, same reason, as every hive's client.
|
|
accessTokenSignedResponseAlg = "RS256";
|
|
}
|
|
];
|
|
};
|
|
}
|