vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

authelia: allow only the collector to write to the log store's ingest path

Browse source
This commit is contained in:
atlas 2026-10-17 13:31:11 +02:00
commit 2489830772
3 changed files with 48 additions and 12 deletions
Download patch file Download diff file Expand all files Collapse all files

43
nix/module-eval/swarm-otel-identity.nix
View file

@ -387,8 +387,11 @@ let
rules =
autheliaOnly.containers.swarm-authelia.config.services.authelia.instances.swarm.settings.access_control.rules;
# The metrics store's own name is the case above's; its rules carry
# `resources` for its push route and `/metrics` together.
metricsRules = lib.filter (r: r ? resources && r.domain != "metrics.t.local") rules;
# `resources` for its push route and `/metrics` together. The log
# store's `/insert/` ingest rules are the case below's.
metricsRules = lib.filter (
r: r ? resources && r.domain != "metrics.t.local" && r.resources != [ "^/insert/.*" ]
) rules;
re = lib.head (lib.head metricsRules).resources;
table = [
{
@ -514,10 +517,11 @@ let
&& checksOf locs."^~ /select/logsql/" == [ "auth_request /__swarm_logs_auth;" ];
}
{
# The `deny` that confines the log store's `/metrics` is scoped to that
# path, and comes after the collector's rule: every other path on the
# name still reaches `default_policy`, as it did with no rule at all.
name = "authelia confines the log store's /metrics to the collector and leaves its other paths alone";
# The `deny`s that confine the log store's `/metrics` and its `/insert/`
# ingest prefix are each scoped to their path and come after the
# collector's rule: every other path on the name still reaches
# `default_policy`.
name = "authelia confines the log store's /metrics and ingest to the collector and leaves its other paths alone";
ok =
let
h = autheliaOnly.services.hyperhive;
@ -526,19 +530,38 @@ let
autheliaOnly.containers.swarm-authelia.config.services.authelia.instances.swarm.settings.access_control.rules;
logsRules = lib.filter (r: r.domain == "logs.t.local") rules;
policy = subject: autheliaPolicy autheliaOnly subject "logs.t.local";
ingest = "/insert/opentelemetry/v1/logs";
in
map (r: r.policy) logsRules == [
"one_factor"
"deny"
"one_factor"
"deny"
]
&& lib.all (r: r.resources == [ "^/metrics([?].*)?$" ]) logsRules
&& (lib.head logsRules).subject == [ collector ]
&&
map (r: r.resources) logsRules == [
[ "^/metrics([?].*)?$" ]
[ "^/metrics([?].*)?$" ]
[ "^/insert/.*" ]
[ "^/insert/.*" ]
]
&&
map (r: r.subject or null) logsRules == [
[ collector ]
null
[ collector ]
null
]
&& policy collector "/metrics" == "one_factor"
&& policy "user:someone" "/metrics" == "deny"
&& policy "user:someone" "/metrics?x=1" == "deny"
&& policy collector ingest == "one_factor"
&& policy collector "${ingest}?_msg_field=MESSAGE" == "one_factor"
&& policy "user:someone" ingest == "deny"
&& policy "user:someone" "${ingest}?_msg_field=MESSAGE" == "deny"
&& policy "user:someone" "/insert/jsonline" == "deny"
&& policy "user:someone" "/" == "one_factor"
&& policy "user:someone" "/select/logsql/query" == "one_factor"
&& policy "user:someone" "/insert/opentelemetry/v1/logs" == "one_factor";
&& policy "user:someone" "/select/logsql/query" == "one_factor";
}
{
# Single host: the store is scraped once, by its published name.