vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

swarm-otel: authelia is no longer declared as both a loopback and a published scrape target

Browse source 
#5215 moved authelia's scrape to `publishedScrapeTargets` and removed
its loopback entry from the authelia module. It was rebased at merge
onto c06aa78b6, which had already moved that loopback entry into
glue-otel-scrape-targets.nix, so the entry survived there. Every host
running authelia and the collector, `singleHostSwarm` included, then
failed swarm-otel.nix's job-name assertion.

The glue now declares only grafana and nats. forge-placement's case
that pinned authelia on loopback now pins its absence, and
swarm-otel-identity gains a case reading the assertion itself on the
single-host fixture, since the option-level case cannot fail a
rebuild the way the assertion does.

Fixes #5247
This commit is contained in:
atlas 2026-10-14 10:28:48 +02:00
commit 07f093c400
4 changed files with 17 additions and 9 deletions
Download patch file Download diff file Expand all files Collapse all files

9
nix/host-modules/glue-otel-scrape-targets.nix
View file

@ -1,7 +1,9 @@
# Glue: declare the loopback scrape targets of authelia, grafana and nats on the # Glue: declare the loopback scrape targets of grafana and nats on the swarm's
# swarm's OTEL collector, wherever one of them shares a host with it. # OTEL collector, wherever one of them shares a host with it. Authelia is a
# `publishedScrapeTargets` job (./swarm-otel-service.nix); a loopback job of
# the same name fails ./swarm-otel.nix's job-name assertion.
# #
# ONE FILE, THREE PAIRINGS — each service ← the collector, with the same shape. # ONE FILE, TWO PAIRINGS — each service ← the collector, with the same shape.
# Deleting this leaves the collector scraping none of them: no error, no # Deleting this leaves the collector scraping none of them: no error, no
# metrics. # metrics.
# #
@ -31,7 +33,6 @@ let
in in
{ {
config.services.hyperhive.swarm.otel.scrapeTargets = { config.services.hyperhive.swarm.otel.scrapeTargets = {
authelia = withCollector "authelia" "127.0.0.1:${toString swarmCfg.authelia.metricsPort}";
grafana = withCollector "grafana" "127.0.0.1:${toString swarmCfg.grafana.metricsPort}"; grafana = withCollector "grafana" "127.0.0.1:${toString swarmCfg.grafana.metricsPort}";
nats = withCollector "nats" "127.0.0.1:${toString swarmCfg.nats.metricsPort}"; nats = withCollector "nats" "127.0.0.1:${toString swarmCfg.nats.metricsPort}";
}; };

2
nix/host-modules/swarm-otel-service.nix
View file

@ -240,7 +240,7 @@ in
declared on a host that does not serve it. An entry that also needs declared on a host that does not serve it. An entry that also needs
the collector on the same host (the loopback address is only honest the collector on the same host (the loopback address is only honest
then) is declared from a glue module instead, which reads both then) is declared from a glue module instead, which reads both
switches: authelia, grafana and nats are declared by switches: grafana and nats are declared by
`glue-otel-scrape-targets.nix`. `glue-otel-scrape-targets.nix`.
⚠️ **That constrains the TARGET, not the SCRAPER, and the difference ⚠️ **That constrains the TARGET, not the SCRAPER, and the difference

9
nix/module-eval/forge-placement.nix
View file

@ -138,15 +138,16 @@ let
&& !(refusedOver bare "deploy.forgejo.sso.clientSecretFile"); && !(refusedOver bare "deploy.forgejo.sso.clientSecretFile");
} }
{ {
name = "a host running the collector and authelia, grafana and nats scrapes all three on loopback"; # Authelia is a published target; ./swarm-otel-identity.nix covers it.
name = "a host running the collector, authelia, grafana and nats scrapes grafana and nats on loopback, authelia not";
ok = ok =
let let
t = servicesHere.services.hyperhive.swarm.otel.scrapeTargets; t = servicesHere.services.hyperhive.swarm.otel.scrapeTargets;
port = n: toString servicesHere.services.hyperhive.swarm.${n}.metricsPort; port = n: toString servicesHere.services.hyperhive.swarm.${n}.metricsPort;
in in
t.authelia == "127.0.0.1:${port "authelia"}" t.grafana == "127.0.0.1:${port "grafana"}"
&& t.grafana == "127.0.0.1:${port "grafana"}" && t.nats == "127.0.0.1:${port "nats"}"
&& t.nats == "127.0.0.1:${port "nats"}"; && !(t ? authelia);
} }
{ {
name = "hosting the swarm's shared services runs the forge"; name = "hosting the swarm's shared services runs the forge";

6
nix/module-eval/swarm-otel-identity.nix
View file

@ -367,6 +367,12 @@ let
&& lib.length jobs == 1 && lib.length jobs == 1
&& (lib.head jobs).static_configs == [ { targets = [ "auth.t.local" ]; } ]; && (lib.head jobs).static_configs == [ { targets = [ "auth.t.local" ]; } ];
} }
{
# The case above reads the options; this one reads the assertion they
# feed, which is what refuses an operator's `nixos-rebuild`.
name = "a single-host swarm passes the loopback-vs-published job name assertion";
ok = !(refusedOver allLocal "is declared as both a loopback");
}
{ {
# Read against the roster the fixture declares rather than against # Read against the roster the fixture declares rather than against
# names spelled here: an arm naming `h1` passes on a single-hive # names spelled here: an arm naming `h1` passes on a single-hive