d273fa8028
secrets.md and credentials-reference.md answered the same question from two pages. secrets.md's text now follows the reference's table and operating notes as a 'Where each secret lives' section, unchanged apart from where it sits. Every link and doc path that named secrets.md (docs, nix comments, crate READMEs) points at credentials-reference.md; anchors are unchanged.
55 lines
2.2 KiB
Nix
55 lines
2.2 KiB
Nix
# Removal shim for the queue's callout nkey options, and for the copies of
|
|
# their seeds and of the responder's OIDC client secret inside the
|
|
# `swarm-nats` container.
|
|
#
|
|
# The callout issuer and user keys live in the swarm secret store beside the
|
|
# callout xkey: `swarm-bao-nats-callout-xkey` in ./swarm-nats.nix creates
|
|
# them there, and the server renders their public halves from the store. A
|
|
# definition of a removed option fails evaluation with a message, under its
|
|
# `deploy.nats` path and under the `swarm.nats` one older configs use.
|
|
#
|
|
# The host seed files under /var/lib/swarm-nats-callout are NOT removed here:
|
|
# that unit stores each one before it removes it, and a tmpfiles rule could
|
|
# run first.
|
|
#
|
|
# Self-contained and deletable, like ./host-ca-removed.nix: one file to
|
|
# remove when the deprecation window closes.
|
|
{ lib, ... }:
|
|
let
|
|
inStore = ''
|
|
The queue's callout issuer and user keys live in the swarm secret store:
|
|
swarm-bao-nats-callout-xkey creates them there, and the server renders
|
|
their public halves from it. Remove this definition. See
|
|
docs/swarm/credentials-reference.md.
|
|
'';
|
|
# The seed-file options name a key an operator may want to keep.
|
|
seedFile = name: ''
|
|
${inStore}
|
|
A seed at /var/lib/swarm-nats-callout/${name} is what that unit stores
|
|
when the store holds none, so a key placed there keeps its public half;
|
|
otherwise a new key is created.
|
|
'';
|
|
removed = name: message: [
|
|
(lib.mkRemovedOptionModule [ "services" "hyperhive" "deploy" "nats" name ] message)
|
|
(lib.mkRemovedOptionModule [ "services" "hyperhive" "swarm" "nats" name ] message)
|
|
];
|
|
|
|
containerSecretDir = "/var/lib/nixos-containers/swarm-nats/var/lib/swarm-nats-auth";
|
|
in
|
|
{
|
|
imports = lib.concatLists [
|
|
(removed "autoGenerateCallout" inStore)
|
|
(removed "calloutUserPublicKey" inStore)
|
|
(removed "calloutIssuerPublicKey" inStore)
|
|
(removed "calloutUserSeedFile" (seedFile "callout-user.seed"))
|
|
(removed "calloutIssuerSeedFile" (seedFile "issuer.seed"))
|
|
];
|
|
|
|
# The responder reads both seeds and its OIDC client secret from the store
|
|
# and names none of these files.
|
|
systemd.tmpfiles.rules = map (f: "r ${containerSecretDir}/${f}") [
|
|
"callout-user.seed"
|
|
"issuer.seed"
|
|
"oidc-client.secret"
|
|
];
|
|
}
|