mara/hyperhive
mara/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

gateway: cache authelia's 200 verdicts on the log and metric ingest routes

Browse source
This commit is contained in:
atlas 2026-11-14 22:05:08 +01:00
commit f5e99fe248
1 changed files with 167 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

58
nix/host-modules/swarm-victorialogs.nix
View file

@ -52,6 +52,29 @@ let
error_page 401 =302 https://${hyperhiveCfg.swarm.authelia.domain}/?rd=$target_url;
'';
# Cache directives for the ingest route's authelia subrequest. The key is
# the `Authorization` header and the route, and only a 200 is stored, so a
# 401 or 403 always reaches authelia again. A request without an
# `Authorization` header skips the cache both ways
# (`swarm_logs_ingest_nocache` in `appendHttpConfig`), so a cached grant is
# never read by a caller that presented no token. The `Cookie` header is
# dropped from the subrequest, because authelia also accepts a session
# cookie and the key does not cover it. `proxy_ignore_headers` makes the
# `proxy_cache_valid` line the only lifetime, whatever cache headers
# authelia sends.
ingestAuthzCache = ''
proxy_set_header Cookie "";
proxy_cache swarm_logs_ingest_authz;
proxy_cache_key "$http_authorization|$http_host$request_uri";
proxy_cache_valid 200 60s;
proxy_cache_lock on;
proxy_cache_lock_timeout 30s;
proxy_cache_use_stale updating;
proxy_cache_bypass $swarm_logs_ingest_nocache;
proxy_no_cache $swarm_logs_ingest_nocache;
proxy_ignore_headers Cache-Control Expires Set-Cookie Vary;
'';
# The agents' `auth_request` responder (`swarm-logs-auth`). Its socket's
# directory holds that socket alone and is traverse-only for others, the
# shape `swarm-controller.nix` gives its own.
@ -326,8 +349,21 @@ in
default /__hive_authelia;
}
limit_req_zone $binary_remote_addr zone=swarm_logs_agent_auth:1m rate=${deployCfg.victorialogs.authRate};
map $http_authorization $swarm_logs_ingest_nocache {
"" 1;
default 0;
}
'';
# The zone behind `ingestAuthzCache`.
services.nginx.proxyCachePath.swarm_logs_ingest_authz = {
enable = true;
keysZoneName = "swarm_logs_ingest_authz";
keysZoneSize = "1m";
maxSize = "10m";
inactive = "10m";
};
# The gateway name, inside `deployCfg.victorialogs.enable` — same
# "only the host that runs the service may claim the name" guard every
# sibling swarm-service module uses (`swarm-grafana.nix`,
@ -372,7 +408,7 @@ in
"= /insert/opentelemetry/v1/logs" = {
proxyPass = "http://127.0.0.1:${toString deployCfg.victorialogs.port}/insert/opentelemetry/v1/logs";
extraConfig = ''
auth_request /__hive_authelia;
auth_request /__swarm_logs_ingest_authz;
'';
};
@ -466,6 +502,26 @@ in
'';
};
# The ingest route's copy of the subrequest below, plus the verdict
# cache. Separate because `/__hive_authelia` also serves the browser
# and scrape routes, which must not be cached.
"= /__swarm_logs_ingest_authz" = {
proxyPass = "https://${hyperhiveCfg.swarm.authelia.domain}/api/authz/auth-request";
recommendedProxySettings = false;
extraConfig = ''
internal;
${gatewayCfg.lib.verifiedProxyTo hyperhiveCfg.swarm.authelia.domain}
proxy_pass_request_body off;
proxy_set_header Content-Length "";
proxy_set_header X-Original-Method $request_method;
proxy_set_header X-Original-URL $scheme://$http_host$request_uri;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header X-Forwarded-Host $http_host;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
${ingestAuthzCache}
'';
};
# The subrequest itself — same target, same header set, same
# reasoning as `swarm-ui.nix`'s own copy (measured against the
# pinned authelia binary, not copied from an example).