99905f50b0
authelia 4.39.20 exits at startup on `users: {}` ("users: non zero value
required"), and the first-boot unit seeded exactly that, so a swarm with
no users crash-looped authelia and answered 502 until `swarmctl user add`
ran.
The first-boot unit now writes one subject, `swarm.placeholder`, when
the users database is absent, empty, or exactly `users: {}`:
- `disabled: true` — authelia returns "user not found" for a disabled
user before any password check (file_user_provider.go,
CheckUserPassword).
- password: an argon2id digest with an all-zero key. It decodes (authelia
rejects a non-digest at startup) and no known password hashes to it.
- the `.` keeps it out of agent names (`[a-z0-9-]`), and `swarmctl user
add` refuses it as already existing. Neither writer removes users, and
both round-trip `disabled`.
A file with any user in it is never touched.
The docs that described the crash-loop (sso.md, gateway.md, setup.md,
the sso-unavailable error page) now describe the placeholder; the
writers' load_store docs and the seed fixtures follow. module-eval
nats-authelia asserts the seed branch.
83 lines
3.2 KiB
Nix
83 lines
3.2 KiB
Nix
# Static error/help pages the gateway serves for routes it has
|
|
# special-cased, all rendered from one Catppuccin-styled template.
|
|
# Useful pages instead of nginx's default 404/502 — see
|
|
# `docs/networking/gateway.md::Per-agent error pages` for the design rationale +
|
|
# page-vs-status semantics. Consumed by ./vhosts.nix.
|
|
{ pkgs }:
|
|
let
|
|
mkPage =
|
|
{
|
|
name,
|
|
title,
|
|
accent,
|
|
body,
|
|
}:
|
|
pkgs.writeText "hive-gateway-${name}.html" ''
|
|
<!DOCTYPE html>
|
|
<html lang="en">
|
|
<head>
|
|
<meta charset="utf-8">
|
|
<title>${title} ◆ hyperhive</title>
|
|
<style>
|
|
body { background: #1e1e2e; color: #cdd6f4; font: 14px/1.5 -apple-system, system-ui, sans-serif; margin: 0; padding: 4rem 1rem; text-align: center; }
|
|
h1 { color: ${accent}; font-size: 1.5rem; margin: 0 0 0.5rem; }
|
|
p { max-width: 36rem; margin: 0.5rem auto; color: #a6adc8; }
|
|
code { background: #313244; color: #f5c2e7; padding: 0.1rem 0.35rem; border-radius: 0.2rem; font-size: 0.92em; }
|
|
pre { background: #181825; color: #cdd6f4; text-align: left; display: inline-block; padding: 0.75rem 1.25rem; border-radius: 0.4rem; margin: 0.75rem 0; font-size: 0.88em; line-height: 1.6; }
|
|
a { color: #89b4fa; }
|
|
.hint { color: #a6adc8; font-size: 0.9em; margin-top: 1.5rem; }
|
|
</style>
|
|
</head>
|
|
<body>
|
|
<h1>◆ ${title}</h1>
|
|
${body}
|
|
</body>
|
|
</html>
|
|
'';
|
|
in
|
|
{
|
|
notFound = mkPage {
|
|
name = "agent-not-found";
|
|
title = "agent not found";
|
|
accent = "#cba6f7";
|
|
body = ''
|
|
<p>No agent matches the requested <code>/agent/<name>/</code> path on this hive.</p>
|
|
<p>Operator: check the agent name in <a href="/">the dashboard</a>.</p>
|
|
'';
|
|
};
|
|
|
|
unreachable = mkPage {
|
|
name = "agent-unreachable";
|
|
title = "agent unreachable";
|
|
accent = "#f9e2af";
|
|
body = ''
|
|
<p>The agent's harness web server isn't responding. Container restarting, or the agent crashed.</p>
|
|
<p>Operator: <a href="/">dashboard</a> → check the container status / journal; the page will recover on retry once the harness is back up.</p>
|
|
'';
|
|
};
|
|
|
|
# Shown when the authelia vhost's upstream refuses the connection: authelia
|
|
# is down behind a working gateway, and the raw 502 points at the proxy.
|
|
ssoUnavailable = mkPage {
|
|
name = "sso-unavailable";
|
|
title = "sso unavailable";
|
|
accent = "#f9e2af";
|
|
body = ''
|
|
<p>The swarm's identity provider isn't answering. The gateway is fine — nothing is listening behind it.</p>
|
|
<p class="hint">Check the container: <code>journalctl -M swarm-authelia -u authelia-swarm</code>. This page recovers on reload once the provider is up.</p>
|
|
'';
|
|
};
|
|
|
|
unauthorized = mkPage {
|
|
name = "unauthorized";
|
|
title = "unauthorized";
|
|
accent = "#f38ba8";
|
|
body = ''
|
|
<p>This hive is protected by HTTP Basic auth. Valid credentials are required.</p>
|
|
<p class="hint">Operator: add a user with <code>hivectl gateway create-user</code>:</p>
|
|
<pre>hivectl gateway create-user \
|
|
<username> --password-stdin</pre>
|
|
<p class="hint">Then reload your browser and enter the credentials when prompted.</p>
|
|
'';
|
|
};
|
|
}
|