8371e1ca62
The comment said it bounds the wait rather than hanging the boot, and nothing in the unit bounded anything. What actually held was systemd's default start timeout plus the homeserver only Wants= this unit — both true, neither stated here, so a reader had to already know them. TimeoutStartSec puts the number a boot waits on in the file that waits, and the comment now names the degradation: hitting it keeps the locally minted token, same as every other failure path in this unit. Caught by argus reviewing the slice it shipped in.
109 lines
4.7 KiB
Nix
109 lines
4.7 KiB
Nix
# Glue: the matrix registration token comes from the secret store.
|
|
#
|
|
# The store's first reader, and deliberately a small one. It fetches an opaque
|
|
# 32-byte value and writes it where ./hive-matrix.nix already looks — the
|
|
# homeserver never learns the store exists, and its config is unchanged.
|
|
#
|
|
# ⚠️ Why this credential first. It has no second file and no format: authelia's
|
|
# OIDC secret needs a `.secret` *and* a matching `.digest`, so shipping that
|
|
# one first would debug "can a reader authenticate and get bytes back" and
|
|
# "did we write authelia's file format right" at the same time, with an SSO
|
|
# outage as the failure mode. Here the failure is narrow — new agent accounts
|
|
# cannot be provisioned, existing ones are untouched, nothing crash-loops.
|
|
#
|
|
# ⚠️ The fallback is today's behaviour, not a new one. `hive-matrix.nix`'s
|
|
# activation script still mints a token when the file is absent; this unit
|
|
# overwrites it with the swarm's copy when the store has one. A store that is
|
|
# empty or unreachable leaves a working hive with a local token.
|
|
#
|
|
# 📌 LIMIT, stated rather than hidden: this gates on the store running HERE.
|
|
# A hive reading from a store on another machine needs the same unit with that
|
|
# machine's address and a client leaf issued out of band — the mechanism is
|
|
# identical, only `-address` and the cert's provenance differ. Deferred until
|
|
# there is a second hive to test it against, rather than shipped untested.
|
|
{
|
|
pkgs,
|
|
lib,
|
|
config,
|
|
...
|
|
}:
|
|
let
|
|
hyperhiveCfg = config.services.hyperhive;
|
|
deployCfg = hyperhiveCfg.deploy;
|
|
baoCfg = hyperhiveCfg.swarm.bao;
|
|
matrixCfg = hyperhiveCfg.swarm.matrix;
|
|
|
|
# Owned by ./glue-bao-tls.nix, which mints them. Named here rather than
|
|
# shared through a `let`: a cross-module binding would make these two files
|
|
# one file with a gap in the middle, and the whole point of a glue module is
|
|
# that it can be deleted on its own.
|
|
pkiDir = "/var/lib/swarm-bao-pki";
|
|
|
|
# Where the token lives in the store. A path, not a convention to guess at:
|
|
# whoever writes it and whoever reads it must agree, and the agreement
|
|
# belongs in one visible place.
|
|
tokenPath = "secret/swarm/matrix/registration-token";
|
|
|
|
# A literal, not an option — ./hive-matrix.nix names its container
|
|
# `containers.hive-matrix` directly and declares no `machine` to derive it
|
|
# from, which the trust-bundle call in that file already says out loud.
|
|
# ⚠️ `matrixCfg.machine` parses fine and fails at module-system resolution,
|
|
# so this is the kind of mistake only reading the target module catches.
|
|
matrixMachine = "hive-matrix";
|
|
in
|
|
{
|
|
config = lib.mkIf (hyperhiveCfg.enable && deployCfg.bao.enable && deployCfg.matrix.enable) {
|
|
systemd.services.swarm-bao-matrix-token = {
|
|
description = "fetch the matrix registration token from the swarm secret store";
|
|
after = [
|
|
"swarm-bao-pki.service"
|
|
"container@${baoCfg.machine}.service"
|
|
];
|
|
wants = [ "container@${baoCfg.machine}.service" ];
|
|
requires = [ "swarm-bao-pki.service" ];
|
|
before = [ "container@${matrixMachine}.service" ];
|
|
wantedBy = [ "container@${matrixMachine}.service" ];
|
|
path = [
|
|
deployCfg.bao.package
|
|
pkgs.coreutils
|
|
];
|
|
serviceConfig = {
|
|
Type = "oneshot";
|
|
RemainAfterExit = true;
|
|
# What actually bounds the read below. Stated here rather than
|
|
# left to systemd's default, so the number a boot waits on is in
|
|
# the file that waits.
|
|
TimeoutStartSec = 30;
|
|
};
|
|
environment = {
|
|
BAO_ADDR = "https://${baoCfg.domain}:${toString baoCfg.port}";
|
|
BAO_CACERT = "${pkiDir}/ca.pem";
|
|
BAO_CLIENT_CERT = "${pkiDir}/client.pem";
|
|
BAO_CLIENT_KEY = "${pkiDir}/client-key.pem";
|
|
};
|
|
script = ''
|
|
set -euo pipefail
|
|
|
|
# A sealed or uninitialised store answers on the port and never
|
|
# answers the read, so "the store is up" is not the same as "the
|
|
# store can answer". `TimeoutStartSec` above is the bound; the
|
|
# homeserver only `Wants=` this unit, so hitting it degrades to
|
|
# keeping the local token rather than holding up the container.
|
|
if ! token="$(bao kv get -field=value ${lib.escapeShellArg tokenPath} 2>/dev/null)"; then
|
|
echo "swarm-bao holds no ${tokenPath}, or is sealed/unreachable." >&2
|
|
echo "Keeping the token hive-matrix already has." >&2
|
|
exit 0
|
|
fi
|
|
|
|
if [ -z "$token" ]; then
|
|
echo "swarm-bao returned an empty ${tokenPath}; keeping the local token." >&2
|
|
exit 0
|
|
fi
|
|
|
|
umask 077
|
|
printf '%s\n' "$token" > ${lib.escapeShellArg (toString matrixCfg.registrationTokenFile)}
|
|
chmod 0600 ${lib.escapeShellArg (toString matrixCfg.registrationTokenFile)}
|
|
'';
|
|
};
|
|
};
|
|
}
|