vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

hive-c0re: its otel exporter goes to the bridge, not the swarm upstream

Browse source
This commit is contained in:
atlas 2026-10-21 12:50:06 +02:00
commit 013bbe5adc
2 changed files with 9 additions and 11 deletions
Download patch file Download diff file Expand all files Collapse all files

8
hive-c0re/src/main.rs
View file

@ -373,10 +373,10 @@ async fn cmd_serve(
// cgroup files. Feeds `disk_bytes` to the OTEL exporter. See // cgroup files. Feeds `disk_bytes` to the OTEL exporter. See
// container_stats::disk_sampler_loop. // container_stats::disk_sampler_loop.
crate::container_stats::spawn_disk_sampler(); crate::container_stats::spawn_disk_sampler();
// Per-agent container-resource OTEL export: rides the same // Per-agent container-resource OTEL export: rides the same cgroup
// cgroup gauges out to the configured OTLP endpoint, reusing the hive // gauges out to the hive's collector on the bridge
// `services.hyperhive.otel` config (endpoint + LoadCredential auth). // (`OTEL_EXPORTER_OTLP_ENDPOINT`), unauthenticated. The swarm-otel
// No-op when OTEL isn't configured. // collector alone forwards upstream. No-op when the endpoint is unset.
crate::otel_metrics::spawn_exporter(&coord.hyperhive_flake); crate::otel_metrics::spawn_exporter(&coord.hyperhive_flake);
// build_logs.sqlite vacuum: c0re-side (single db). Failures kept // build_logs.sqlite vacuum: c0re-side (single db). Failures kept
// 30d, successes 24h — see `build_logs::vacuum` for the rule. // 30d, successes 24h — see `build_logs::vacuum` for the rule.

12
nix/host-modules/hive-c0re/default.nix
View file

@ -143,13 +143,11 @@ in
# contain. The queue's TLS is verified against `HIVE_C0RE_OIDC_CA_FILE` # contain. The queue's TLS is verified against `HIVE_C0RE_OIDC_CA_FILE`
# (../glue-hive-tls-controllers.nix), not this bundle. # (../glue-hive-tls-controllers.nix), not this bundle.
# #
# ⚠️ `SSL_CERT_FILE` REPLACES the trust store, and unlike the other # ⚠️ `SSL_CERT_FILE` REPLACES the trust store, so the bundle is system
# consumers of this helper, hive-c0re already makes a *public*-TLS call: # CAs + the store's root: narrowing it to the root alone would break any
# the OTEL exporter reaches whatever # public-TLS call this daemon makes. Its OTEL exporter is not one: it
# `deploy.swarm-otel.upstream.endpoint` names, typically a # posts plain http to the bridge collector. Only the swarm-otel collector
# normal internet host. The bundle is system CAs + the store's root # reaches `deploy.swarm-otel.upstream.endpoint`.
# precisely so that path keeps working — narrowing it to the store's root
# alone would fix a case nobody hits yet and break one that runs today.
(caTrust.trustBundle { (caTrust.trustBundle {
inherit pkgs; inherit pkgs;
name = "hive-c0re"; name = "hive-c0re";