f6ca5f1433
The forge's login source read its OIDC client secret from a file that `hive-forge-oidc-secret` copied out of authelia's container tree. That unit only existed where authelia ran on the forge's host (`ssoLocal`), so a forge anywhere else needed the file placed by hand. The publisher on authelia's host now carries the forge's client secret to `secret/swarm/services/<forge client id>/oidc/client`, like every other swarm service's. On the forge's host `swarm-bao-forge-oidc`, a copy of `swarm-bao-matrix-oidc`, reads it under the forge publisher's leaf (the forge host's one store identity, whose policy gains read on that one path) and writes the file `forgejo-sso-source` reads, re-running the login source when the value changes. It retries on the shared store-retry shape while the store is down or the secret is not yet published. `hive-forge-oidc-secret` is removed, `clientSecretFile` defaults to the in-container path wherever the forge runs, and the `ssoLocal` gate on the login source's resolver ordering goes with it: the login source fetches the issuer's discovery document on every forge host. Refs #5015
95 lines
3.7 KiB
Nix
95 lines
3.7 KiB
Nix
# Glue: where the store and one of its readers share a host, the reader waits
|
|
# for the unit that writes the cert-auth role it logs in with, and for any
|
|
# other policy unit whose rules it relies on.
|
|
#
|
|
# ONE PAIRING PER FILE — the store's policy units ← the readers that rely
|
|
# on them, and nothing else. Deleting this leaves every reader as it is on a
|
|
# host whose store is remote: it may log in before its role exists, and its own
|
|
# retries are what carry it past that.
|
|
#
|
|
# ⚠️ Gated on BOTH the store and that reader being here. Off the store's host
|
|
# there is no local policy unit to order against. On the store's host without
|
|
# the reader, setting `systemd.services.<reader>.after` would define a unit
|
|
# with no ExecStart, so each gate below restates the one the reader's own
|
|
# module puts on it. A reader whose gate changes must change here too.
|
|
#
|
|
# Ordering, never a requirement: a policy unit that failed still counts as
|
|
# done, and the reader's own retries carry it past that. `wants` as well as
|
|
# `after`, so a reader started on its own pulls its policy unit into the same
|
|
# transaction.
|
|
{
|
|
lib,
|
|
config,
|
|
...
|
|
}:
|
|
let
|
|
hyperhiveCfg = config.services.hyperhive;
|
|
deployCfg = hyperhiveCfg.deploy;
|
|
baoDeploy = deployCfg.bao;
|
|
|
|
havePair = cert: key: cert != null && key != null;
|
|
|
|
# Reader unit → the gate its own module defines it under.
|
|
readersHere = {
|
|
# ./glue-queue-agent-credential.nix
|
|
swarm-bao-queue-agent =
|
|
deployCfg.hive-controller.enable
|
|
&& havePair baoDeploy.queueAgentClientCertFile baoDeploy.queueAgentClientKeyFile;
|
|
# ./swarm-grafana.nix
|
|
swarm-bao-grafana-oidc = deployCfg.grafana.enable;
|
|
# ./swarm-otel.nix
|
|
swarm-bao-otel-oidc =
|
|
deployCfg.swarm-otel.enable
|
|
&& havePair baoDeploy.otelOidcClientCertFile baoDeploy.otelOidcClientKeyFile;
|
|
# ./swarm-bao.nix: its block is gated on the store, which `orderAfterPolicies`
|
|
# already checks.
|
|
swarm-bao-forwarder-oidc = true;
|
|
# ./swarm-nats.nix: the queue's TLS leaf, not a secret, but the same wait.
|
|
swarm-bao-nats-tls = deployCfg.nats.enable;
|
|
# ./swarm-ci-runner.nix
|
|
swarm-bao-ci-runner = deployCfg.ci-runner.enable;
|
|
# ./hive-forge/default.nix
|
|
swarm-bao-forge-publisher = deployCfg.forgejo.enable;
|
|
};
|
|
|
|
# Readers that log in under another unit's principal: reader unit → the
|
|
# gate its own module defines it under, and the policy units it waits for.
|
|
readersOfOtherPolicy = {
|
|
# ./swarm-nats.nix, under the queue responder's leaf. Also after the
|
|
# publisher's policy, which denies the publisher the callout seeds' paths:
|
|
# until it is written the publisher may create them, and this unit keeps
|
|
# a seed it finds there.
|
|
swarm-bao-nats-callout-xkey = {
|
|
here = deployCfg.nats.enable;
|
|
policies = [
|
|
"swarm-bao-nats-auth-policy"
|
|
"swarm-bao-secret-publisher-policy"
|
|
];
|
|
};
|
|
# ./hive-matrix.nix, under matrix-ctl's leaf.
|
|
swarm-bao-matrix-oidc = {
|
|
here = deployCfg.matrix.enable;
|
|
policies = [ "swarm-bao-matrix-ctl-policy" ];
|
|
};
|
|
# ./hive-forge/default.nix, under the forge publisher's leaf.
|
|
swarm-bao-forge-oidc = {
|
|
here = deployCfg.forgejo.enable;
|
|
policies = [ "swarm-bao-forge-publisher-policy" ];
|
|
};
|
|
};
|
|
|
|
orderAfterPolicies =
|
|
reader: here: policies:
|
|
lib.mkIf (baoDeploy.enable && here) {
|
|
systemd.services.${reader} = {
|
|
after = map (p: "${p}.service") policies;
|
|
wants = map (p: "${p}.service") policies;
|
|
};
|
|
};
|
|
in
|
|
{
|
|
config = lib.mkMerge (
|
|
lib.mapAttrsToList (reader: here: orderAfterPolicies reader here [ "${reader}-policy" ]) readersHere
|
|
++ lib.mapAttrsToList (reader: r: orderAfterPolicies reader r.here r.policies) readersOfOtherPolicy
|
|
);
|
|
}
|