From 1f24193609714e4e20b237ddae2c5bc60c7bc9a2 Mon Sep 17 00:00:00 2001
From: atlas <atlas@hyperhive.local>
Date: Wed, 19 Aug 2026 21:18:13 +0200
Subject: [PATCH] feat(swarm-victoriametrics): scrape the store's own
 prometheus endpoint
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The scraper shipped with no targets, so nothing exercised it. This is its
first user, and the one with the least new surface: victoriametrics
publishes prometheus metrics on the listener it already serves queries on,
so there is no exporter, no extra port and no new reach — the collector's
otlphttp exporter already writes to that same loopback address.

Declared from this module rather than the collector's, per the option's own
rule: an entry exists only where the service that named it runs.
---
 nix/host-modules/swarm-victoriametrics.nix | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/nix/host-modules/swarm-victoriametrics.nix b/nix/host-modules/swarm-victoriametrics.nix
index 533dff8b..25c1f328 100644
--- a/nix/host-modules/swarm-victoriametrics.nix
+++ b/nix/host-modules/swarm-victoriametrics.nix
@@ -113,6 +113,21 @@ in
       }
     ];
 
+    # This store publishes its own health as prometheus metrics on the same
+    # listener it serves queries on, so the swarm's collector can scrape it
+    # with no exporter and no extra port.
+    #
+    # Declared here rather than in the collector's module because that is the
+    # rule the option carries: an entry exists only where the service that
+    # named it runs, which is what keeps scraper and target on one host by
+    # construction instead of by luck.
+    #
+    # The loopback literal introduces no new assumption — it is the address
+    # this module already pins the listener to, and the same one the
+    # collector's `otlphttp/victoriametrics` exporter already writes to. If
+    # that reach is ever wrong, it is wrong for the write path first.
+    services.hyperhive.swarm.otel.scrapeTargets.victoriametrics = "127.0.0.1:${toString cfg.port}";
+
     services.nginx.virtualHosts."${cfg.domain}" = (gatewayCfg.lib.tlsFor cfg.domain) // {
       listen = gatewayCfg.lib.listen;
       extraConfig = gatewayCfg.lib.securityHeaders;