a2a94f63c8
Each container now runs the journal forwarder the queue's container runs, pushing to a receiver of its own on the swarm collector as the service's existing OIDC client, with the client's secret read inside the container by the fetch unit. Their store identities are system credentials, so the fetch unit loads them too. The three containers drop --link-journal=host, which hid their journals from the forwarder, and the host collector stops reading them.
39 lines
1.4 KiB
Nix
39 lines
1.4 KiB
Nix
# Glue: register the review classifier as an OIDC client wherever authelia
|
|
# runs.
|
|
#
|
|
# ONE PAIRING PER FILE — swarm-review-classifier ← authelia, and nothing else.
|
|
# Deleting this leaves a classifier whose token requests authelia answers with
|
|
# a 401, and no minted secret for swarm-secret-publish to put in the store.
|
|
#
|
|
# ⚠️ Gated on authelia being HERE, and NOT on this host running the
|
|
# classifier, for ./glue-controller-oidc-client.nix's reason: a client is a row
|
|
# in THIS host's provider config. Registered whether or not any host enables
|
|
# the classifier: nothing in `swarm.*` records that, so a swarm without one
|
|
# carries one unused client and one unused minted secret.
|
|
{
|
|
lib,
|
|
config,
|
|
...
|
|
}:
|
|
let
|
|
hyperhiveCfg = config.services.hyperhive;
|
|
deployCfg = hyperhiveCfg.deploy;
|
|
clientId = hyperhiveCfg.swarm.review-classifier.clientId;
|
|
in
|
|
{
|
|
config = lib.mkIf deployCfg.authelia.enable {
|
|
services.hyperhive.swarm.authelia.oidc.clients = [
|
|
{
|
|
id = clientId;
|
|
description = "HyperHive review classifier";
|
|
# `client_credentials`: a daemon authenticating as itself.
|
|
kind = "machine";
|
|
audience = [ clientId ];
|
|
# The container's journal forwarder mints its token as this client, for
|
|
# the swarm collector's receiver, which verifies it offline against
|
|
# `/jwks.json`; authelia's default opaque handle fails there.
|
|
accessTokenSignedResponseAlg = "RS256";
|
|
}
|
|
];
|
|
};
|
|
}
|