| Filename | Latest commit message | Latest commit date |
|---|---|---|
e94406cdb9
Some checks were skipped
public bin cache / build + push to preem:grid (push) Has been skipped
The controller's OIDC client secret (client `swarm-controller`, used for the queue connection, the auth-bridge bearer and the OTLP push) came from an operator-placed file, `deploy.swarm-controller.queue.clientSecretFile`, handed in by `LoadCredential=`. Now `swarm-secret-publish`, which already copies authelia's minted OIDC secrets into the store, also publishes this one, to `swarm/controller/swarm-controller/oidc/client`. That path sits under `controller/`, which no hive's policy reads. The controller reads it once at start with its existing store certificate and holds it in memory, as `swarm_queue_client::ClientSecret::Value`. If the store is down, it retries for about a minute and then fails the start, so `Restart=` tries again. Policy delta: the controller gets `read` on that leaf, and the publisher gets `create`/`update` on that leaf. Removed: the `queue.clientSecretFile` option (both spellings, now removed options with a message), its singleHostSwarm default, the credential and placeholder, and the path watcher plus its restart oneshot. A controller without a store identity is now an eval error, because it has no other way to get the secret. |
||
| .. | ||
| agent-modules | ||
| docs | ||
| host-modules | ||
| module-eval | ||
| packages | ||
| templates | ||
| checks.nix | ||
| devshell.nix | ||
| journald-severity.nix | ||
| reserved-hive-fragments.nix | ||
| reserved-names.nix | ||
| rust.nix | ||
| sources.nix | ||
| treefmt.nix | ||