vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

every hive runs its otel collector, and agents export to it by default

Browse source
This commit is contained in:
atlas 2026-10-18 23:17:28 +02:00 • committed by mara
commit 13daf4c7dc
28 changed files with 245 additions and 303 deletions
Download patch file Download diff file Expand all files Collapse all files

84
nix/host-modules/hive-c0re/environment.nix
View file

@ -71,64 +71,34 @@ in
# every agent. See services.hyperhive.swarm.github.enable.
HYPERHIVE_GITHUB_DISABLED = "1";
}
// lib.optionalAttrs config.services.hyperhive.otel.enable (
# OTEL config (`swarm.hiveOtel`, `deploy.hive-controller.otel`, gated on
# this hive's `otel.enable`) -> read by meta.rs::otel_config and injected
# as build-time `services.hyperhive.agent.otel.*` into every agent.
# Endpoint presence is the enable signal on the meta side; the
# optional fields are only emitted when set so absent values
# don't render no-op env lines.
let
otel = config.services.hyperhive.otel;
hiveOtel = config.services.hyperhive.swarm.hiveOtel;
controllerOtel = config.services.hyperhive.deploy.hive-controller.otel;
# The first hop, this hive's own collector, under the two spellings its
# two kinds of caller need. Agents get the swarm-wide name, so their
# builds carry nothing hive-specific; this daemon gets the bridge
# address, because on the host the name may resolve to loopback
# (`gateway.localHostsEntry`), where the receiver does not listen.
agentFirstHop = "http://${otel.collector.host}:${toString hiveOtel.collectorPort}";
hostFirstHop = "http://${config.services.hyperhive.network.bridgeIp}:${toString hiveOtel.collectorPort}";
in
{
# `otel.endpoint` means "where telemetry ultimately goes" and keeps
# that meaning; what agents are handed is the *first hop*, which is
# always this hive's own collector. Deriving it rather than
# redefining `endpoint` is what lets every existing deployment keep
# its configured value untouched.
HYPERHIVE_OTEL_ENDPOINT = agentFirstHop;
# hive-c0re's OWN container-resource exporter (stats/otel_metrics.rs)
# reads the STANDARD OTLP variable — the same one hive-metric and every
# agent read — and lets the SDK resolve the URL, which appends the
# signal path (`/v1/metrics`). Handing the SDK an address
# programmatically instead takes it verbatim: it POSTs to the
# collector's root, gets a 404 on every export, and says nothing,
# because OTLP export failures go to an error handler no binary here
# installs — the daemon logged "exporter enabled" and never delivered a
# sample, for as long as it had that exporter. The variable above cannot
# replace this one:
# it is the agent-config transport meta.rs reads, and the SDK does not
# know that name.
OTEL_EXPORTER_OTLP_ENDPOINT = hostFirstHop;
# The first hop is the collector's OTLP/HTTP receiver, which speaks
# protobuf regardless of what the upstream wants — `otel.protocol`
# describes the *upstream* link, and the collector's own exporter is
# what has to honour it (see nix/host-modules/otel.nix).
HYPERHIVE_OTEL_PROTOCOL = "http/protobuf";
}
// lib.optionalAttrs (controllerOtel.extraResourceAttributes != "") {
HYPERHIVE_OTEL_EXTRA_RESOURCE_ATTRIBUTES = controllerOtel.extraResourceAttributes;
}
# HYPERHIVE_OTEL_HEADERS_CREDENTIAL is deliberately NOT emitted, and
# its absence is the security half of this design: that variable would
# put the upstream token into an agent's own settings.json. Nothing
# delivers the token into the container — no nspawn credential, no
# agent-readable header file.
// {
# hive-c0re's OWN container-resource exporter (stats/otel_metrics.rs) reads
# the STANDARD OTLP variable — the same one hive-metric and every agent
# read — and lets the SDK resolve the URL, which appends the signal path
# (`/v1/metrics`). Handing the SDK an address programmatically instead
# takes it verbatim: it POSTs to the collector's root, gets a 404 on every
# export, and says nothing, because OTLP export failures go to an error
# handler no binary here installs.
#
# The rule: the collector holding the credential achieves nothing while
# anything else hands out a copy, so there is exactly one holder and it
# is on the host.
)
# The bridge address, not `otel.collector.host`: on the host that name may
# resolve to loopback (`gateway.localHostsEntry`), where the receiver does
# not listen. Agents are not told an address at all; their module defaults
# to the collector's name.
OTEL_EXPORTER_OTLP_ENDPOINT = "http://${config.services.hyperhive.network.bridgeIp}:${toString config.services.hyperhive.swarm.hiveOtel.collectorPort}";
}
//
lib.optionalAttrs
(config.services.hyperhive.deploy.hive-controller.otel.extraResourceAttributes != "")
{
HYPERHIVE_OTEL_EXTRA_RESOURCE_ATTRIBUTES =
config.services.hyperhive.deploy.hive-controller.otel.extraResourceAttributes;
}
# No upstream credential is emitted here, and its absence is the security half
# of this design: it would put the upstream token where an agent could read
# it. Nothing delivers the token into a container — no nspawn credential, no
# agent-readable header file. The collector holding the credential achieves
# nothing while anything else hands out a copy, so there is exactly one
# holder and it is on the host.
// {
# In-cluster forge URL — the gateway vhost (`forge.<domain>`), which
# nginx proxies to forgejo. Used both for internal API calls in