From 013bbe5adc4bbd3d239182144f21ce17fe79275d Mon Sep 17 00:00:00 2001
From: atlas <atlas@hyperhive.local>
Date: Wed, 21 Oct 2026 12:50:06 +0200
Subject: [PATCH] hive-c0re: its otel exporter goes to the bridge, not the
 swarm upstream

---
 hive-c0re/src/main.rs                  |  8 ++++----
 nix/host-modules/hive-c0re/default.nix | 12 +++++-------
 2 files changed, 9 insertions(+), 11 deletions(-)

diff --git a/hive-c0re/src/main.rs b/hive-c0re/src/main.rs
index 4e4db6c9..420340c4 100644
--- a/hive-c0re/src/main.rs
+++ b/hive-c0re/src/main.rs
@@ -373,10 +373,10 @@ async fn cmd_serve(
     // cgroup files. Feeds `disk_bytes` to the OTEL exporter. See
     // container_stats::disk_sampler_loop.
     crate::container_stats::spawn_disk_sampler();
-    // Per-agent container-resource OTEL export: rides the same
-    // cgroup gauges out to the configured OTLP endpoint, reusing the hive
-    // `services.hyperhive.otel` config (endpoint + LoadCredential auth).
-    // No-op when OTEL isn't configured.
+    // Per-agent container-resource OTEL export: rides the same cgroup
+    // gauges out to the hive's collector on the bridge
+    // (`OTEL_EXPORTER_OTLP_ENDPOINT`), unauthenticated. The swarm-otel
+    // collector alone forwards upstream. No-op when the endpoint is unset.
     crate::otel_metrics::spawn_exporter(&coord.hyperhive_flake);
     // build_logs.sqlite vacuum: c0re-side (single db). Failures kept
     // 30d, successes 24h — see `build_logs::vacuum` for the rule.
diff --git a/nix/host-modules/hive-c0re/default.nix b/nix/host-modules/hive-c0re/default.nix
index c2603a70..9b38328f 100644
--- a/nix/host-modules/hive-c0re/default.nix
+++ b/nix/host-modules/hive-c0re/default.nix
@@ -143,13 +143,11 @@ in
     # contain. The queue's TLS is verified against `HIVE_C0RE_OIDC_CA_FILE`
     # (../glue-hive-tls-controllers.nix), not this bundle.
     #
-    # ⚠️ `SSL_CERT_FILE` REPLACES the trust store, and unlike the other
-    # consumers of this helper, hive-c0re already makes a *public*-TLS call:
-    # the OTEL exporter reaches whatever
-    # `deploy.swarm-otel.upstream.endpoint` names, typically a
-    # normal internet host. The bundle is system CAs + the store's root
-    # precisely so that path keeps working — narrowing it to the store's root
-    # alone would fix a case nobody hits yet and break one that runs today.
+    # ⚠️ `SSL_CERT_FILE` REPLACES the trust store, so the bundle is system
+    # CAs + the store's root: narrowing it to the root alone would break any
+    # public-TLS call this daemon makes. Its OTEL exporter is not one: it
+    # posts plain http to the bridge collector. Only the swarm-otel collector
+    # reaches `deploy.swarm-otel.upstream.endpoint`.
     (caTrust.trustBundle {
       inherit pkgs;
       name = "hive-c0re";