2f05e2db28
Seven host oneshots fetch a secret from the swarm secret store into a file their consumer loads at start: swarm-bao-grafana-oidc, swarm-bao-otel-oidc, swarm-bao-matrix-oidc, swarm-bao-ci-runner, swarm-bao-forge-oidc, swarm-bao-hive-otel-oidc and swarm-bao-forwarder-oidc. Each was RemainAfterExit with no timer, so it ran at boot or deploy and never again: a secret re-minted in the store reached its consumer only through an operator restarting the fetch. lib/store-refresh-timer.nix gives each one a timer (OnUnitInactiveSec 10min, RandomizedDelaySec 1min, the agent's own store re-read interval), and each drops RemainAfterExit so a timer start is not a no-op. Each script already writes the file only when secret_differs, and refresh_consumer/refresh_unit restart the consumer only when the file is newer than its last start, so a run reading an unchanged value restarts nothing. Two docs said these units do not run on a timer; credentials.md's ci-runner row said the runner token is not re-pulled. Part of #5017 (slice T).
27 lines
1.1 KiB
Nix
27 lines
1.1 KiB
Nix
# Timer for a host oneshot that fetches a credential from the swarm secret
|
|
# store: it starts the oneshot again 10 minutes after each run, so a value
|
|
# re-minted in the store lands on the host and restarts its consumer with no
|
|
# operator step. Ten minutes matches the agent's own store re-read
|
|
# (../../agent-modules/bao.nix).
|
|
#
|
|
# ⚠️ The oneshot must not be `RemainAfterExit`: starting a unit that stays
|
|
# `active (exited)` is a no-op, so the timer would fire and fetch nothing.
|
|
# A run that reads an unchanged value writes nothing and restarts nothing —
|
|
# its `secret_differs` gate and ./refresh-consumer.nix see to that.
|
|
#
|
|
# Gate the timer exactly as its service is gated: a timer whose unit does
|
|
# not exist fails to load.
|
|
#
|
|
# Pure function — NOT a NixOS module. Call it from a module's `let`:
|
|
#
|
|
# storeRefreshTimer = import ./lib/store-refresh-timer.nix { };
|
|
# systemd.timers.swarm-bao-foo = storeRefreshTimer "re-read foo's secret from the swarm secret store";
|
|
{ }:
|
|
description: {
|
|
inherit description;
|
|
wantedBy = [ "timers.target" ];
|
|
timerConfig = {
|
|
OnUnitInactiveSec = "10min";
|
|
RandomizedDelaySec = "1min";
|
|
};
|
|
}
|