b14ff2796c
Some checks were skipped
public bin cache / build + push to preem:grid (push) Has been skipped
The bao UI at bao-ui.<swarm> took a raw store token and nothing else. It now offers an OIDC tab: authelia's `admins` group logs in and lands on `swarm-operator-viewer`, which is list+read on `secret/metadata/*` and nothing under `secret/data/` or `sys/`. - authelia registers an interactive client `swarm-bao-ui` (glue-bao-ui-oidc-client.nix) with redirect `https://bao-ui.<swarm>/ui/vault/auth/oidc/oidc/callback`; the secret publisher carries its secret to `secret/swarm/services/swarm-bao-ui/oidc/client`. - `swarm-bao-granter-role` (bootstrap token) enables the `oidc` auth mount with listing visibility `unauth`, asked before attempted like cert/approle; `bao-bootstrap-policy.hcl` gains `sys/auth/oidc`. - The granter's policy gains `auth/oidc/config`, `auth/oidc/role/swarm-*` and read on that one secret leaf. It still holds no `sys/auth`. - New granting unit `swarm-bao-operator-viewer-policy` writes the viewer policy, and once the granter may configure `auth/oidc/config` (checked through `sys/capabilities-self`), writes the mount's config from the published secret and the role binding `groups=admins` to the viewer. Before the bootstrap step re-runs it writes the policy, logs the step and exits 0. Route (a) per mara on #4775: enabling the auth method stays a bootstrap-token step, re-run once on the live store. module-eval pins the viewer policy's single metadata stanza, that the granter's policy has no sys/auth path, the oidc enable in the bootstrap unit, the exit-0 path, the config/role contents, and the client registration + publish.
60 lines
2 KiB
Nix
60 lines
2 KiB
Nix
# The full hyperhive host stack, pulled together in one place — this
|
|
# is what the flake exports as `nixosModules.default` (wrapped with
|
|
# the package/source wiring; see flake.nix). One import covers
|
|
# everything; `services.hyperhive.deploy.hive-controller.enable = true`
|
|
# runs a hive on this host.
|
|
#
|
|
# Every swarm needs the forge — hive-c0re mirrors every agent's applied
|
|
# config repo into it and it's the canonical store for the meta flake
|
|
# + `internal/*` repos — but only the host with `deploy.forgejo.enable`
|
|
# runs it (derived from `deploy.allSwarmServices`, see
|
|
# ./swarm-required-services.nix). hive-matrix is opt-in (off by default). All
|
|
# subsystems rely on `services.hyperhive.domain`, which is required
|
|
# (asserted in hive-network.nix) wherever this host runs a hive.
|
|
{
|
|
imports = [
|
|
./hyperhive.nix
|
|
./deploy.nix
|
|
./local-defaults.nix
|
|
./hive-c0re
|
|
./hive-ci.nix
|
|
./hive-forge
|
|
./hive-gateway
|
|
./hive-matrix.nix
|
|
./hive-network.nix
|
|
./hive-priv.nix
|
|
./hive-tls.nix
|
|
./otel.nix
|
|
./glue-bao-readers-policy-order.nix
|
|
./glue-bao-tls.nix
|
|
./glue-bao-ui-oidc-client.nix
|
|
./glue-controller-bao-identity.nix
|
|
./glue-forge-oidc-client.nix
|
|
./glue-grafana-oidc-client.nix
|
|
./glue-matrix-bao-token.nix
|
|
./glue-matrix-ctl-bao-identity.nix
|
|
./glue-nats-auth-bao-identity.nix
|
|
./glue-nats-bao-identity.nix
|
|
./glue-queue-agent-credential.nix
|
|
./glue-secret-publisher-bao-identity.nix
|
|
./glue-services-issuer-bao-identity.nix
|
|
./glue-swarm-bao-otel-oidc-client.nix
|
|
./glue-swarm-otel-oidc-client.nix
|
|
./swarm-authelia.nix
|
|
./swarm-bao.nix
|
|
./swarm-ca.nix
|
|
./swarm-secret-publisher.nix
|
|
./swarm-nats.nix
|
|
./swarm-controller.nix
|
|
./swarm-grafana.nix
|
|
./swarm-otel.nix
|
|
./swarm-snapshot-store.nix
|
|
./swarm-ui.nix
|
|
./swarm-victorialogs.nix
|
|
./swarm-victoriametrics.nix
|
|
./swarm-wireguard.nix
|
|
./swarm.nix
|
|
./swarm-peers-removed.nix
|
|
./swarm-required-services.nix
|
|
];
|
|
}
|