vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

glue: the controller's authelia and otel environment moves out of the controller module

Browse source 
The authelia and swarm-otel co-location reads (swarm-controller.nix
autheliaEnv, otelEnv) move into glue-controller-env.nix.
This commit is contained in:
atlas 2026-10-13 08:43:09 +02:00 • committed by mara
commit 1219091788
9 changed files with 115 additions and 69 deletions
Download patch file Download diff file Expand all files Collapse all files

55
nix/host-modules/glue-controller-env.nix Normal file
View file

@ -0,0 +1,55 @@
# Glue: tell the swarm controller about the authelia and the collector that run
# on this host.
#
# ONE PAIRING PER FILE — controller ← the services whose coordinates it reads
# from the environment. Deleting this leaves a controller that exports no
# metrics, and a `swarmctl` that fails `user add` saying the authelia binary and
# users file are unset.
#
# ⚠️ Two gates, one per service, each ANDed with the controller being here:
# `systemd.services.swarm-controller.environment` on a host without the
# controller would define a unit with no ExecStart.
#
# authelia → `swarmctl`'s wrapper, not the daemon's unit. Gated on authelia
# running HERE: the controller can be enabled on a host that is not the swarm's
# SSO host, and there `swarmctl user add` must fail saying the value is unset —
# a guessed path would resolve cleanly and write a file nothing reads. The
# CONFIGURED authelia, not whatever is on PATH: the argon2 parameters baked into
# a hash have to match the verifier's.
#
# swarm-otel → the daemon's unit. `vcs_metrics`/`hive_jobq_metrics` read the
# standard `OTEL_EXPORTER_OTLP_ENDPOINT` and are silent no-ops without it. The
# endpoint is the collector's swarm-service name through the gateway, never a
# loopback literal, with no trailing slash: the http exporter appends
# `/v1/metrics` and the gateway route strips `/${producerName}`.
# `SWARM_CONTROLLER_OTEL_AUDIENCE` is the audience ./glue-controller-oidc-client.nix
# registers and ./swarm-otel.nix's `oidc/${producerName}` authenticator checks.
{
lib,
config,
...
}:
let
hyperhiveCfg = config.services.hyperhive;
deployCfg = hyperhiveCfg.deploy;
otelSwarmCfg = hyperhiveCfg.swarm.otel;
queueClientId = hyperhiveCfg.swarm.controller.queueClientId;
in
{
config = lib.mkIf deployCfg.swarm-controller.enable (
lib.mkMerge [
(lib.mkIf deployCfg.authelia.enable {
services.hyperhive.deploy.swarm-controller.swarmctlEnvironment = {
SWARMCTL_AUTHELIA_BIN = "${deployCfg.authelia.package}/bin/authelia";
SWARMCTL_AUTHELIA_USERS_FILE = deployCfg.authelia.hostUsersFile;
};
})
(lib.mkIf deployCfg.swarm-otel.enable {
systemd.services.swarm-controller.environment = {
OTEL_EXPORTER_OTLP_ENDPOINT = "https://${otelSwarmCfg.domain}/${otelSwarmCfg.producerName}";
SWARM_CONTROLLER_OTEL_AUDIENCE = queueClientId;
};
})
]
);
}