vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

swarm-grafana: run in its own network namespace

Browse source
This commit is contained in:
atlas 2026-10-22 02:56:53 +02:00 • committed by mara
commit 08f010b742
3 changed files with 55 additions and 23 deletions
Download patch file Download diff file Expand all files Collapse all files

37
nix/module-eval/swarm-services-switch.nix
View file

@ -171,8 +171,8 @@ let
# Every service container at once: the services-only host plus the CI
# runner. The CI runner, the review classifier, the builder, the claude login
# minter, the metrics store, the homeserver and authelia are the seven containers on a
# netns of their own.
# minter, the metrics store, the homeserver, authelia and Grafana are the eight
# containers on a netns of their own.
serviceContainersWithCi = hive {
deploy.hive-controller.enable = false;
deploy.allSwarmServices = true;
@ -621,7 +621,7 @@ let
let
shared = lib.filter (c: !c.privateNetwork) (lib.attrValues serviceContainers);
in
lib.length shared == 6
lib.length shared == 5
&& lib.all (
c: !c.config.networking.firewall.enable && !c.config.networking.resolvconf.enable
) shared;
@ -761,6 +761,37 @@ let
&& bridge.serviceConfig.Group == "gateway-nginx"
&& lib.elem dir unit.serviceConfig.ReadWritePaths;
}
{
# On the bridge by DHCP, listening on a socket (protocol `socket` ignores the
# upstream-default `http_port`, which stays in the settings): the
# gateway's locations (UI, metrics, websocket upgrade) all forward to it.
# `forwarded != []` keeps an empty filter from passing.
name = "grafana runs on a netns of its own and the gateway reaches it over its socket";
ok =
let
host = serviceContainersWithCi;
net = host.services.hyperhive.network;
c = host.containers.swarm-grafana;
dir = "/run/swarm-grafana";
sock = "${dir}/grafana.sock";
locs = host.services.nginx.virtualHosts.${host.services.hyperhive.swarm.grafana.domain}.locations;
forwarded = lib.filter (p: p != null && !(lib.hasPrefix "https://" p)) (
map (l: l.proxyPass) (lib.attrValues locs)
);
server = c.config.services.grafana.settings.server;
in
c.privateNetwork
&& c.hostBridge == net.bridgeName
&& c.hostAddress == null
&& c.localAddress == null
&& c.config.networking.interfaces.eth0.useDHCP
&& c.config.networking.firewall.enable
&& server.protocol == "socket"
&& server.socket == sock
&& forwarded != [ ]
&& lib.all (lib.hasPrefix "http://unix:${sock}:") forwarded
&& c.bindMounts.${dir}.hostPath == dir;
}
{
# The DynamicUser layout keeps the history under /var/lib/private; the
# static user's StateDirectory is the plain path. The move runs as its