b68a8ef290
swarm-secret-publish and its path unit now run inside authelia's container, beside the mint, and read each client secret at the path authelia writes it. The host unit and host path unit, which read the secrets through the container's root on the host, are gone, and so is deploy.authelia.hostClientSecretDir, which only they read. The publisher keeps its store identity, the secret-publisher leaf. The host hands the leaf and the store's CA into the container as nspawn system credentials, and the unit loads them; where this host mints the leaf, the container waits for swarm-bao-pki. Authelia does not wait for the publisher, which retries every 30 seconds while the store is down. The container also runs the journal forwarder the other service containers run, pushing to a receiver of its own on the swarm collector (serviceProducers swarm-authelia) as a new machine OIDC client (swarm.authelia.otel.clientId) that authelia registers for itself and the publisher carries to the store. The fetch unit reads it back under the publisher's leaf, also handed to it as a system credential, so the swarm-secret-publisher policy gains read on that one leaf; its stanza keeps create and update, which the exact path would otherwise take from the services/* prefix. Without the leaf the forwarder is off. The container drops --link-journal=host, and the host collector stops reading it. The services' "nothing at <path>" errors name the publisher in authelia's container.
24 lines
824 B
Nix
24 lines
824 B
Nix
# Glue: turn the secret publisher on wherever authelia mints the secrets.
|
|
#
|
|
# ONE PAIRING PER FILE — publisher ← authelia, and nothing else. Deleting this
|
|
# leaves the publisher off unless an operator enables it, so every OIDC client
|
|
# secret authelia mints stays in its container and no reader gets one, this
|
|
# host's included.
|
|
#
|
|
# ⚠️ Gated on authelia alone, NOT on `deploy.bao.enable`: a publisher beside a
|
|
# remote store, holding a leaf issued out of band, is a deployment the
|
|
# publisher exists to serve (see that option's description).
|
|
{
|
|
lib,
|
|
config,
|
|
...
|
|
}:
|
|
let
|
|
deployCfg = config.services.hyperhive.deploy;
|
|
in
|
|
{
|
|
# `mkDefault`: an operator's explicit value wins.
|
|
config = lib.mkIf deployCfg.authelia.enable {
|
|
services.hyperhive.deploy.swarm-secret-publisher.enable = lib.mkDefault true;
|
|
};
|
|
}
|