22 lines
922 B
Nix
22 lines
922 B
Nix
# Where `swarm-bao-hive-otel-oidc` lands this hive's OIDC client secret on
|
|
# the host, and where it sat before it moved. Spelled once because
|
|
# ../otel.nix, ../glue-hive-otel-authelia.nix and
|
|
# ../glue-bao-readers-store-order.nix each compare `otel.clientSecretFile`
|
|
# against it to decide whether the fetch unit exists; a copy that drifts makes
|
|
# that comparison false and the secret stops refreshing.
|
|
#
|
|
# `path` is on /run (tmpfs): the secret never reaches persistent disk and the
|
|
# unit fetches it again after a reboot.
|
|
#
|
|
# Pure function — NOT a NixOS module. Call it from a module's `let`:
|
|
#
|
|
# hiveOtelSecret = import ./lib/hive-otel-secret.nix { inherit (cfg) hiveClientPrefix hiveName; };
|
|
{ hiveClientPrefix, hiveName }:
|
|
let
|
|
file = "${hiveClientPrefix}${toString hiveName}.secret";
|
|
in
|
|
{
|
|
dir = "/run/hive-otel-oidc";
|
|
path = "/run/hive-otel-oidc/${file}";
|
|
legacyPath = "/var/lib/hive-otel-oidc/${file}";
|
|
}
|