Watch

History

Repository files (latest commit first)
Filename	Latest commit message	Latest commit date
atlas cf88fbba9d operator admin sync: cap the grant at one send, split out response verdicts The admin-room command stays in #admins' history, so a grant tuwunel ignores must not be re-sent every five minutes. The controller now sends `make-user-admin` at most once per operator per process; an operator still missing from the room on a later pass is logged as "make-user-admin for an operator failed to take" and left alone until the controller restarts. The cap lives in the pure `plan()`. swarm-matrix-client's `user_exists` and `joined_members` read their responses through pure `profile_verdict` / `joined_verdict`, the shape `whoami` / `whoami_verdict` already has, with every branch tested: only M_NOT_FOUND is "no account", and a 403 or a list without `joined` is an error rather than an answer. The bridge's handling after authentication moves into `respond()`, which takes the config and write lock instead of the whole AppState, so a test can drive ListOperators through the real request path and see the 403 without an HTTP client or an authelia. docs/integrations/matrix.md no longer says @swarm is the only homeserver admin.		2026-10-04 16:45:08 +02:00
..
src	operator admin sync: cap the grant at one send, split out response verdicts	2026-10-04 16:45:08 +02:00
Cargo.toml	fix(#3344 ): type the roster entry's name as Ident, per review	2026-08-20 00:15:48 +02:00
README.md	swarm-controller: make authelia's operators matrix homeserver admins	2026-10-04 16:45:08 +02:00

README.md

swarm-authelia-bridge

The only thing allowed to write swarm-authelia's users database.

Why this exists

swarm-controller's CreateIdentity job needs to add an agent as an authelia subject, but swarm-controller runs unprivileged and does not own users.yml — a different uid does (authelia-swarm, the user services.authelia.instances.swarm runs as). Root/CAP_CHOWN/a shared group were all examined and rejected during this crate's design thread — see swarmctl/README.md's identical analysis of this same file, written before this crate existed.

The fix: run this process as User = "authelia-swarm"; instead — inside the swarm-authelia container, alongside authelia itself — so it simply owns the file it writes. No elevated privilege anywhere.

Shape

One endpoint, POST /requests, body = swarm-authelia-bridge-sock's BridgeRequest verbatim — EnsureAgentIdentity (idempotently ensure an agent exists as an authelia subject), ListAgentIdentities (the roster: the subjects carrying the agent marker group, names only) and ListOperators (the operator group's usernames).
Bearer-authenticated via authelia's own OIDC token introspection (RFC 7662), against swarm-controller's existing machine-client identity (already minted for the queue connection) — no new credential. The two agent verbs admit any active token. ⚠️ ListOperators admits only the client named by SWARM_AUTHELIA_BRIDGE_OPERATOR_READER_CLIENT_ID (swarm-controller's) and answers every other active token 403: authelia issues machine tokens to every hive and its agents too.
No restart of authelia after a write — relies on authentication_backend.file.watch, confirmed working against the pinned 4.39.20 build during this design work.
Network-facing rather than unix-socket-only: swarm-authelia's container shares the host netns, so the same listener serves both a co-located swarm-controller (loopback) and a split-host one (bind wider + firewall) with no separate transport.

One store, two writers

This bridge and swarmctl both read and write authelia's users.yml directly. That is the whole arrangement — neither keeps a private copy it considers canonical.

It used to be otherwise, and the seam was real: each side had its own users.json treated as authoritative, rendering the same physical users.yml. A writer whose own JSON was missing could not tell "nothing here yet" from "someone else's users", so it refused to write at all — which is exactly what a hive with existing users hit.

What still has to hold, since two processes share the file:

Read before write. Both do, so neither can drop a user the other added between operations.
Unknown keys survive. Both carry unmodelled top-level and per-user fields through a round-trip, or whichever writes second would silently delete what the first added.
Every user gets an email. A relying party asking for the claim fails rather than degrades, so both write paths fill in a synthetic address when none was supplied.

Neither restarts authelia: it watches the file. swarmctl could (it is root); this bridge deliberately cannot, and a reload that depends on which process wrote is not a reload.