vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

ship the cache host init units' journal through the hive collector

Browse source
This commit is contained in:
atlas 2026-10-27 21:53:38 +01:00 • committed by mara
commit 28be594f79
2 changed files with 43 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

8
nix/host-modules/swarm-attic.nix
View file

@ -233,6 +233,14 @@ in
services.hyperhive.gateway.localNames = [ atticCfg.domain ];
# The init units' journal reaches the log store through the hive collector.
# A host that also runs the swarm collector ships its whole journal already
# (./swarm-otel.nix), so naming them there would send each line twice.
services.hyperhive.otel.journalUnits = lib.optionals (!hyperhiveCfg.deploy.swarm-otel.enable) [
"swarm-bao-attic-secret.service"
"swarm-bao-attic-tokens.service"
];
# This host serves the vhost, and the host's own resolver finds the name.
services.hyperhive.gateway.enable = lib.mkDefault true;
services.hyperhive.gateway.dns.enable = lib.mkDefault true;

29
nix/module-eval/builder.nix
View file

@ -95,7 +95,7 @@ let
atticVhost = atticHere.services.hyperhive.gateway.vhosts."attic.t.local";
# The cache switched on while the operator overrides the options.
atticByHand = hive {
atticByHand = hiveWithController {
deploy.bao.enable = true;
deploy.attic.enable = true;
swarm.attic.domain = "cache.example.org";
@ -388,6 +388,33 @@ let
&& atticHere.systemd.services ? swarm-bao-attic-secret
&& atticHere.systemd.services ? swarm-bao-attic-tokens;
}
{
# The hive collector's journal allow-list carries the cache's init units
# on a hive host with the cache and no swarm collector (`atticByHand`).
# Where the swarm collector runs too (`atticHere`) it reads the whole
# journal, so the units are not named twice; without the cache
# (`atticExternal`) they are absent. `hive-c0re.service` is the control
# that each list is the one the collector reads.
name = "the hive collector ships the cache's init units only where nothing else reads the host journal";
ok =
let
units = m: m.services.opentelemetry-collector.settings.receivers.journald.units;
initUnits = [
"swarm-bao-attic-secret.service"
"swarm-bao-attic-tokens.service"
];
has = m: lib.all (u: lib.elem u (units m)) initUnits;
hasNone = m: lib.all (u: !(lib.elem u (units m))) initUnits;
in
has atticByHand
&& hasNone atticHere
&& hasNone atticExternal
&& lib.all (m: lib.elem "hive-c0re.service" (units m)) [
atticByHand
atticHere
atticExternal
];
}
{
# Both host units log in as the cache's principal, not the hive's, and
# the container reaches the key through a read-only directory. The