962da3b784
The three client registrations move into glue-{controller,nats,matrix}-oidc-client.nix,
gated only on deploy.authelia.enable and reading their ids from swarm.* options,
so the host running authelia registers every one of them whichever host runs
the service. The matrix callback is a new read-only swarm.matrix.sso.redirectUri,
read by both the homeserver's config and its client entry.
swarm-secret-publish now also publishes the queue's and the homeserver's minted
secrets to swarm/services/<id>/oidc/client. The queue host reads its responder's
secret there with swarm-bao-nats-auth-oidc under the responder's own leaf
(swarm-nats-auth role gains that one read path), and the homeserver's host with
swarm-bao-matrix-oidc under matrix-ctl's leaf (swarm-matrix-ctl role gains its
one read path). The host-file copies are gone: swarm-nats-auth-secrets now
delivers only the callout seeds and the store identity, and
hive-matrix-oidc-secret is removed. A fetch unit whose leaf is unset still
renders and fails naming the option pair.
Closes #4943
46 lines
1.9 KiB
Nix
46 lines
1.9 KiB
Nix
# Glue: register the swarm's homeserver as an OIDC client wherever authelia
|
|
# runs.
|
|
#
|
|
# ONE PAIRING PER FILE — matrix ← authelia, and nothing else. Deleting this
|
|
# leaves a homeserver whose SSO login authelia has never heard of, and no
|
|
# minted secret for swarm-secret-publish to put in the store.
|
|
#
|
|
# ⚠️ Gated on authelia being HERE, and NOT on this host running the
|
|
# homeserver. A client is a row in THIS host's provider config, so it is
|
|
# declared where that config is rendered; ./hive-matrix.nix's `config` hangs
|
|
# off `deploy.matrix.enable`, which answers a question about a different host.
|
|
# Same shape as ./glue-grafana-oidc-client.nix.
|
|
#
|
|
# Registered whether or not the swarm runs a homeserver: nothing in `swarm.*`
|
|
# records that. The one swarm-level fact that rules a login out is a null
|
|
# `gatewayHost`, which leaves no callback a browser can reach, so that alone
|
|
# skips the client.
|
|
{
|
|
lib,
|
|
config,
|
|
...
|
|
}:
|
|
let
|
|
hyperhiveCfg = config.services.hyperhive;
|
|
deployCfg = hyperhiveCfg.deploy;
|
|
matrixCfg = hyperhiveCfg.swarm.matrix;
|
|
in
|
|
{
|
|
config = lib.mkIf (deployCfg.authelia.enable && matrixCfg.sso.redirectUri != null) {
|
|
# One declaration, two readers: the callback is the read-only option the
|
|
# homeserver's own config renders, so it is spelled once.
|
|
services.hyperhive.swarm.authelia.oidc.clients = [
|
|
{
|
|
id = matrixCfg.sso.clientId;
|
|
description = "HyperHive matrix";
|
|
redirectUris = [ matrixCfg.sso.redirectUri ];
|
|
# tuwunel authenticates at the token endpoint by putting the secret in
|
|
# the POST body. Authelia enforces the *registered* method, and its
|
|
# default is `client_secret_basic` — so without this the browser flow
|
|
# completes, consent is granted, and the last hop fails with a 401
|
|
# that names neither the secret nor the redirect.
|
|
tokenEndpointAuthMethod = "client_secret_post";
|
|
}
|
|
];
|
|
};
|
|
}
|