ce44b6e77e
Each container now runs the journal forwarder the CI runner's, Grafana's and the log store's containers run, pushing to a receiver of its own on the swarm collector (serviceProducers hive-forge and hive-matrix). Each authenticates as a new machine OIDC client of its own (swarm.forge.otel.clientId, swarm.matrix.otel.clientId), registered by a glue file wherever authelia runs, minted by authelia and published to the store by the secret publisher. The forge's and the homeserver's browser login clients are unchanged. The client ids are swarm-forge-collector and swarm-matrix-collector, not hive-<x>-collector, which is the client id a hive named <x>-collector gets. The fetch unit inside each container reads the client secret with the store identity the host already holds for that service. The forge publisher's leaf is handed into the forge container as an nspawn system credential, as the grafana and log store containers do. matrix-ctl's leaf is already bound into the homeserver's container, so its forwarder reads it at those paths, as swarm-matrix-appservice-publish does; with no matrix-ctl identity the homeserver's forwarder is off. Each of the two policies gains one read stanza on its forwarder's client path. The host units that use those identities are unchanged. The two containers drop --link-journal=host, and the host collector stops reading them.
37 lines
1.2 KiB
Nix
37 lines
1.2 KiB
Nix
# Glue: register the forge container's journal forwarder as an OIDC
|
|
# client wherever authelia runs.
|
|
#
|
|
# ONE PAIRING PER FILE: that forwarder ← authelia, and nothing else.
|
|
# Without it authelia mints no secret, the publisher has nothing to copy into
|
|
# the store, and the forwarder's export is a 401.
|
|
#
|
|
# Gated on authelia being HERE, not on this host running the forge: a
|
|
# client is a row in THIS host's provider config, the split
|
|
# ./glue-swarm-bao-otel-oidc-client.nix makes for the same reason.
|
|
{
|
|
lib,
|
|
config,
|
|
...
|
|
}:
|
|
let
|
|
hyperhiveCfg = config.services.hyperhive;
|
|
clientId = hyperhiveCfg.swarm.forge.otel.clientId;
|
|
in
|
|
{
|
|
config = lib.mkIf hyperhiveCfg.deploy.authelia.enable {
|
|
services.hyperhive.swarm.authelia.oidc.clients = [
|
|
{
|
|
id = clientId;
|
|
description = "HyperHive forge journal forwarder";
|
|
kind = "machine";
|
|
redirectUris = [ ];
|
|
# Its own id as its own permitted audience, the one the swarm
|
|
# collector's receiver for this container checks.
|
|
audience = [ clientId ];
|
|
# The receiver verifies the token offline against `/jwks.json`;
|
|
# authelia's default opaque handle fails there.
|
|
accessTokenSignedResponseAlg = "RS256";
|
|
}
|
|
];
|
|
};
|
|
}
|