bed4358e19
- swarm.serviceDomains lists every swarm service name on every host. The
store's issuing role is built from it, so the store now admits a leaf
for grafana, metrics, otel, logs, the bao UI and the apex whichever host
runs the store. Each gateway's own leaf stays narrowed by
localServiceDomains.
- swarm.matrix.apiUrl defaults to http://<swarm.matrix.gatewayHost>
(null when gatewayHost is null) instead of loopback on the matrix host.
- The authelia vhost proxies /bridge/ to swarm-authelia-bridge with the
prefix stripped, and deploy.swarm-controller.authBridgeUrl defaults to
${swarm.authelia.url}/bridge on every host. swarm.authelia.bridgeUrl is
removed.
- swarm-authelia-bridge admits only swarm-controller's OIDC client on
every request (403 for any other active token), configured by
SWARM_AUTHELIA_BRIDGE_CONTROLLER_CLIENT_ID (renamed from
..._OPERATOR_READER_CLIENT_ID, which gated ListOperators alone).
- swarm.peerHives is removed; swarm-wireguard.nix filters this host's own
hive out of swarm.hives itself.
Closes #4933
65 lines
3.1 KiB
Markdown
65 lines
3.1 KiB
Markdown
# swarm-authelia-bridge
|
|
|
|
The only thing allowed to write `swarm-authelia`'s users database.
|
|
|
|
## Why this exists
|
|
|
|
`swarm-controller`'s `CreateIdentity` job needs to add an agent as an
|
|
authelia subject, but `swarm-controller` runs unprivileged and does not own
|
|
`users.yml` — a different uid does (`authelia-swarm`, the user
|
|
`services.authelia.instances.swarm` runs as). Root/`CAP_CHOWN`/a shared
|
|
group were all examined and rejected during this crate's design thread —
|
|
see `swarmctl/README.md`'s identical analysis of this same file, written
|
|
before this crate existed.
|
|
|
|
The fix: run **this** process as `User = "authelia-swarm";` instead —
|
|
inside the `swarm-authelia` container, alongside authelia itself — so it
|
|
simply owns the file it writes. No elevated privilege anywhere.
|
|
|
|
## Shape
|
|
|
|
- One endpoint, `POST /requests`, body = `swarm-authelia-bridge-sock`'s
|
|
`BridgeRequest` verbatim — `EnsureAgentIdentity` (idempotently ensure an
|
|
agent exists as an authelia subject), `ListAgentIdentities` (the
|
|
roster: the subjects carrying the agent marker group, names only) and
|
|
`ListOperators` (the operator group's usernames).
|
|
- Bearer-authenticated via authelia's own OIDC token introspection (RFC
|
|
7662), against `swarm-controller`'s **existing** machine-client identity
|
|
(already minted for the queue connection) — no new credential. ⚠️ Every
|
|
request admits only the client named by
|
|
`SWARM_AUTHELIA_BRIDGE_CONTROLLER_CLIENT_ID` (`swarm-controller`'s) and
|
|
answers every other active token `403`: authelia issues machine tokens to
|
|
every hive and its agents too.
|
|
- No restart of authelia after a write — relies on
|
|
`authentication_backend.file.watch`, confirmed working against the
|
|
pinned 4.39.20 build during this design work.
|
|
- Listens on loopback. The authelia vhost proxies `/bridge/` to it with
|
|
the prefix stripped, so `swarm-controller` on any host calls
|
|
`https://<swarm.authelia.domain>/bridge/requests`.
|
|
|
|
## One store, two writers
|
|
|
|
This bridge and `swarmctl` both read and write authelia's `users.yml`
|
|
directly. That is the whole arrangement — neither keeps a private copy it
|
|
considers canonical.
|
|
|
|
It used to be otherwise, and the seam was real: each side had its own
|
|
`users.json` treated as authoritative, rendering the _same_ physical
|
|
`users.yml`. A writer whose own JSON was missing could not tell "nothing
|
|
here yet" from "someone else's users", so it refused to write at all —
|
|
which is exactly what a hive with existing users hit.
|
|
|
|
What still has to hold, since two processes share the file:
|
|
|
|
- **Read before write.** Both do, so neither can drop a user the other
|
|
added between operations.
|
|
- **Unknown keys survive.** Both carry unmodelled top-level and per-user
|
|
fields through a round-trip, or whichever writes second would silently
|
|
delete what the first added.
|
|
- **Every user gets an email.** A relying party asking for the claim fails
|
|
rather than degrades, so both write paths fill in a synthetic address
|
|
when none was supplied.
|
|
|
|
Neither restarts authelia: it watches the file. `swarmctl` _could_ (it is
|
|
root); this bridge deliberately cannot, and a reload that depends on which
|
|
process wrote is not a reload.
|