vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(#1930): forward otel headers credential into agent containers via nspawn --load-credential

Browse source
This commit is contained in:
damocles 2026-06-23 21:12:39 +02:00 • committed by mara
commit 21ec7dc23d
6 changed files with 140 additions and 20 deletions
Download patch file Download diff file Expand all files Collapse all files

13
nix/modules/hive-c0re.nix
View file

@ -236,11 +236,14 @@ in
description = ''
Absolute path to an operator-provided secret file whose contents
become `OTEL_EXPORTER_OTLP_HEADERS` (e.g.
`Authorization=Bearer <token>`). Loaded via systemd
`LoadCredential` into each agent's unit-private credential store
at runtime, so the token is never copied into the nix store or
exposed in argv. Must be absolute. Leave null if the endpoint
needs no auth header.
`Authorization=Bearer <token>`). hive-c0re forwards this host
file into each agent container's credential store via
systemd-nspawn `--load-credential=otel-headers:<path>`; the inner
harness unit inherits it by name (`LoadCredential`), so the token
is never copied into the nix store, the generated config, a bind
mount, or argv. Must be absolute. Leave null if the endpoint
needs no auth header. A configured-but-missing file is skipped
with a log warning (OTEL still exports, without the auth header).
'';
};