978164dc53
Every hive with hyperhive enabled ran its own hive-forge container, and its gateway answered forge.<swarm> with its own bridge IP, so on a multi-host swarm each hive talked to its own forge. deploy.forgejo.enable defaults to false and allSwarmServices sets it with mkDefault, like authelia and bao; singleHostSwarm gets it through that. The forge's OIDC client moves to a glue module gated on authelia, so a split authelia/forge swarm still registers it. CI now requires the forge on the same host, and the controller's forgeTokenFile defaults to null where the forge is not. Closes #4705 Refs #3782
40 lines
1.5 KiB
Nix
40 lines
1.5 KiB
Nix
# Glue: register the swarm's forge as an OIDC client wherever authelia runs.
|
|
#
|
|
# ONE PAIRING PER FILE — forge ← authelia, and nothing else. Deleting this
|
|
# leaves a swarm whose forge is not a client authelia has ever heard of, so
|
|
# its "sign in with" button can never complete a login and nothing minted its
|
|
# secret either.
|
|
#
|
|
# ⚠️ Gated on authelia being HERE, and deliberately NOT on this host running
|
|
# the forge. A client is a row in THIS host's provider config, so it can only be
|
|
# declared where that config is rendered — and ./hive-forge/default.nix's whole
|
|
# `config` block hangs off `deploy.forgejo.enable`, so a swarm with the forge
|
|
# and authelia on different hosts would register the client nowhere at all.
|
|
# Same shape as ./glue-grafana-oidc-client.nix, for the same reason.
|
|
#
|
|
# Unlike Grafana's, this client is never unused: every swarm runs a forge.
|
|
{
|
|
lib,
|
|
config,
|
|
...
|
|
}:
|
|
let
|
|
hyperhiveCfg = config.services.hyperhive;
|
|
deployCfg = hyperhiveCfg.deploy;
|
|
forgeCfg = hyperhiveCfg.swarm.forge;
|
|
in
|
|
{
|
|
config = lib.mkIf (hyperhiveCfg.enable && deployCfg.authelia.enable) {
|
|
# One declaration, two readers. The forge knows its own callback URL;
|
|
# making the operator restate it in authelia's client list would be a
|
|
# second source of truth for a string whose mismatch is a silent
|
|
# rejected login.
|
|
services.hyperhive.swarm.authelia.oidc.clients = [
|
|
{
|
|
id = forgeCfg.sso.clientId;
|
|
description = "HyperHive forge";
|
|
redirectUris = [ forgeCfg.sso.redirectUri ];
|
|
}
|
|
];
|
|
};
|
|
}
|