d30cb7d122
The mint creates each client's secret in the swarm secret store and writes only the digest to disk. It mints only when the store answers and holds none. A new unit moves the plaintext files an earlier release left into the store and removes each once the store holds the same value. The bridge reads its secret from the store into /run before each start. The secret publisher unit and its path unit are gone.
39 lines
1.4 KiB
Nix
39 lines
1.4 KiB
Nix
# Glue: register the notification router as an OIDC client wherever authelia
|
|
# runs.
|
|
#
|
|
# ONE PAIRING PER FILE — swarm-notify-router ← authelia, and nothing else.
|
|
# Deleting this leaves a router whose token requests authelia answers with a
|
|
# 401, and no minted secret for authelia's mint to put in the store.
|
|
#
|
|
# ⚠️ Gated on authelia being HERE, and NOT on this host running the router,
|
|
# for ./glue-controller-oidc-client.nix's reason: a client is a row in THIS
|
|
# host's provider config. Registered whether or not any host enables the
|
|
# router: nothing in `swarm.*` records that, so a swarm without one carries
|
|
# one unused client and one unused minted secret.
|
|
{
|
|
lib,
|
|
config,
|
|
...
|
|
}:
|
|
let
|
|
hyperhiveCfg = config.services.hyperhive;
|
|
deployCfg = hyperhiveCfg.deploy;
|
|
clientId = hyperhiveCfg.swarm.notify-router.clientId;
|
|
in
|
|
{
|
|
config = lib.mkIf deployCfg.authelia.enable {
|
|
services.hyperhive.swarm.authelia.oidc.clients = [
|
|
{
|
|
id = clientId;
|
|
description = "HyperHive notification router";
|
|
# `client_credentials`: a daemon authenticating as itself.
|
|
kind = "machine";
|
|
audience = [ clientId ];
|
|
# The container's journal forwarder mints its token as this client, for
|
|
# the swarm collector's receiver, which verifies it offline against
|
|
# `/jwks.json`; authelia's default opaque handle fails there.
|
|
accessTokenSignedResponseAlg = "RS256";
|
|
}
|
|
];
|
|
};
|
|
}
|