f83030281e
The tmpfiles `r` rule for the stale `oidc-client.secret` in the swarm-nats container sat in swarm-nats.nix under `deploy.nats.enable`, so a host that turned the queue off kept the copy. It now sits in the ungated removal shim next to the seed copies' rules, which is where the S2 plan put it and the one file to delete when the deprecation window closes. The module-eval case asserts the rule on a host with the queue off as well.
55 lines
2.2 KiB
Nix
55 lines
2.2 KiB
Nix
# Removal shim for the queue's callout nkey options, and for the copies of
|
|
# their seeds and of the responder's OIDC client secret inside the
|
|
# `swarm-nats` container.
|
|
#
|
|
# The callout issuer and user keys live in the swarm secret store beside the
|
|
# callout xkey: `swarm-bao-nats-callout-xkey` in ./swarm-nats.nix creates
|
|
# them there, and the server renders their public halves from the store. A
|
|
# definition of a removed option fails evaluation with a message, under its
|
|
# `deploy.nats` path and under the `swarm.nats` one older configs use.
|
|
#
|
|
# The host seed files under /var/lib/swarm-nats-callout are NOT removed here:
|
|
# that unit stores each one before it removes it, and a tmpfiles rule could
|
|
# run first.
|
|
#
|
|
# Self-contained and deletable, like ./host-ca-removed.nix: one file to
|
|
# remove when the deprecation window closes.
|
|
{ lib, ... }:
|
|
let
|
|
inStore = ''
|
|
The queue's callout issuer and user keys live in the swarm secret store:
|
|
swarm-bao-nats-callout-xkey creates them there, and the server renders
|
|
their public halves from it. Remove this definition. See
|
|
docs/swarm/secrets.md.
|
|
'';
|
|
# The seed-file options name a key an operator may want to keep.
|
|
seedFile = name: ''
|
|
${inStore}
|
|
A seed at /var/lib/swarm-nats-callout/${name} is what that unit stores
|
|
when the store holds none, so a key placed there keeps its public half;
|
|
otherwise a new key is created.
|
|
'';
|
|
removed = name: message: [
|
|
(lib.mkRemovedOptionModule [ "services" "hyperhive" "deploy" "nats" name ] message)
|
|
(lib.mkRemovedOptionModule [ "services" "hyperhive" "swarm" "nats" name ] message)
|
|
];
|
|
|
|
containerSecretDir = "/var/lib/nixos-containers/swarm-nats/var/lib/swarm-nats-auth";
|
|
in
|
|
{
|
|
imports = lib.concatLists [
|
|
(removed "autoGenerateCallout" inStore)
|
|
(removed "calloutUserPublicKey" inStore)
|
|
(removed "calloutIssuerPublicKey" inStore)
|
|
(removed "calloutUserSeedFile" (seedFile "callout-user.seed"))
|
|
(removed "calloutIssuerSeedFile" (seedFile "issuer.seed"))
|
|
];
|
|
|
|
# The responder reads both seeds and its OIDC client secret from the store
|
|
# and names none of these files.
|
|
systemd.tmpfiles.rules = map (f: "r ${containerSecretDir}/${f}") [
|
|
"callout-user.seed"
|
|
"issuer.seed"
|
|
"oidc-client.secret"
|
|
];
|
|
}
|