privatevoid.net/depot
1
1
Fork 0
Code Issues 23 Pull requests 2 Projects 3 Releases Packages Wiki Activity Actions

WIP: Consul ACLs #117

Draft
max wants to merge 8 commits from pr-consul-acl into master
pull from: pr-consul-acl
merge into: privatevoid.net:master
Conversation 0 Commits 8 Files changed 7 +24 -1
1 changed files with 24 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files
Showing only changes of commit 5704e358e0 - Show all commits

25
cluster/services/consul/agent.nix
View file

@ -35,7 +35,30 @@ in
}; };
}; };
systemd.services.consul.serviceConfig.Type = "notify"; systemd.services = {
consul.serviceConfig.Type = "notify";
consul-load-smt = {
wantedBy = [ "consul.service" ];
after = [ "consul.service" ];
environment.CONSUL_HTTP_ADDR = config.links.consulAgent.tuple;
path = [
config.services.consul.package
];
serviceConfig = {
Type = "oneshot";
RemainAfterExit = true;
};
script = ''
while ! test -e /run/locksmith/consul-systemManagementToken; do
echo Waiting for System Management Token
systemctl start locksmith.service
max commented 2024-08-23 01:11:52 +03:00
Outdated
Review
Copy link

Find a way to make Locksmith work better while bootstrapping. Polling like this is pretty fucked up. Maybe there should be a proper "Consul is ready without SMT" level and Locksmith and the Chant Listener should be configured to work with that level.

Find a way to make Locksmith work better while bootstrapping. Polling like this is pretty fucked up. Maybe there should be a proper "Consul is ready without SMT" level and Locksmith and the Chant Listener should be configured to work with that level.
sleep 5
done
export CONSUL_HTTP_TOKEN_FILE=/run/locksmith/consul-systemManagementToken
consul acl set-agent-token default "$(< /run/locksmith/consul-systemManagementToken)" # TODO: don't leak token on cmdline
max commented 2024-08-23 01:08:44 +03:00
Outdated
Review
Copy link

Setting the default token means it's no longer required to present a token when connecting to this agent. Should probably limit this to automatic actions only (dns, replication token types?)

Setting the default token means it's no longer required to present a token when connecting to this agent. Should probably limit this to automatic actions only (`dns`, `replication` token types?)
'';
};
};
services.grafana-agent.settings.integrations.consul_exporter = { services.grafana-agent.settings.integrations.consul_exporter = {
enabled = true; enabled = true;