vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

ship the cache host init units' journal through the hive collector

Browse source
This commit is contained in:
atlas 2026-10-27 21:53:38 +01:00 • committed by mara
commit 28be594f79
4 changed files with 43 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

2
docs/scheduler/observability.md
View file

@ -377,6 +377,8 @@ this change removed them in favour of the log line.
The hive tier's own collector runs a `journald` receiver scoped to the units
in `services.hyperhive.otel.journalUnits`: `hive-c0re.service`, plus
`squid.service` and `squid-selfcheck.service` (see [Egress proxy](../networking/network.md#egress-proxy-squid)).
A host that runs the cache without the swarm collector adds `swarm-bao-attic-secret.service`
and `swarm-bao-attic-tokens.service`.
No bind mount is needed. Unlike an agent's journal, this collector already
shares a filesystem with the units it reads, because it's a host systemd
service rather than a container. It forwards the crash log line alongside the

7
docs/swarm/services.md
View file

@ -453,8 +453,11 @@ file to copy. The builder pushes green builds to it. How it works, and the
external alternative, are in [`builder.md`](builder.md#binary-cache).
The container forwards atticd's journal to the swarm collector like the other
service containers (see [Telemetry collector](#telemetry-collector-otel)). The two host units' lines
stay in the host's journal.
service containers (see [Telemetry collector](#telemetry-collector-otel)). The two host
units' lines reach the log store too: through the hive collector's journal
allow-list on a hive host, or through the swarm collector's whole-journal
receiver where the host runs that. A host with neither keeps them in its own
journal.
### CI metrics

8
nix/host-modules/swarm-attic.nix
View file

@ -233,6 +233,14 @@ in
services.hyperhive.gateway.localNames = [ atticCfg.domain ];
# The init units' journal reaches the log store through the hive collector.
# A host that also runs the swarm collector ships its whole journal already
# (./swarm-otel.nix), so naming them there would send each line twice.
services.hyperhive.otel.journalUnits = lib.optionals (!hyperhiveCfg.deploy.swarm-otel.enable) [
"swarm-bao-attic-secret.service"
"swarm-bao-attic-tokens.service"
];
# This host serves the vhost, and the host's own resolver finds the name.
services.hyperhive.gateway.enable = lib.mkDefault true;
services.hyperhive.gateway.dns.enable = lib.mkDefault true;

29
nix/module-eval/builder.nix
View file

@ -95,7 +95,7 @@ let
atticVhost = atticHere.services.hyperhive.gateway.vhosts."attic.t.local";
# The cache switched on while the operator overrides the options.
atticByHand = hive {
atticByHand = hiveWithController {
deploy.bao.enable = true;
deploy.attic.enable = true;
swarm.attic.domain = "cache.example.org";
@ -388,6 +388,33 @@ let
&& atticHere.systemd.services ? swarm-bao-attic-secret
&& atticHere.systemd.services ? swarm-bao-attic-tokens;
}
{
# The hive collector's journal allow-list carries the cache's init units
# on a hive host with the cache and no swarm collector (`atticByHand`).
# Where the swarm collector runs too (`atticHere`) it reads the whole
# journal, so the units are not named twice; without the cache
# (`atticExternal`) they are absent. `hive-c0re.service` is the control
# that each list is the one the collector reads.
name = "the hive collector ships the cache's init units only where nothing else reads the host journal";
ok =
let
units = m: m.services.opentelemetry-collector.settings.receivers.journald.units;
initUnits = [
"swarm-bao-attic-secret.service"
"swarm-bao-attic-tokens.service"
];
has = m: lib.all (u: lib.elem u (units m)) initUnits;
hasNone = m: lib.all (u: !(lib.elem u (units m))) initUnits;
in
has atticByHand
&& hasNone atticHere
&& hasNone atticExternal
&& lib.all (m: lib.elem "hive-c0re.service" (units m)) [
atticByHand
atticHere
atticExternal
];
}
{
# Both host units log in as the cache's principal, not the hive's, and
# the container reaches the key through a read-only directory. The