vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(otel): point agents at the collector, and stop shipping them the token

Browse source 
The agent-facing endpoint becomes derived rather than `otel.endpoint`
re-defined: with the collector on, agents and hive-c0re's own exporter
send to the bridge address; with it off the expression is the old value
character for character. `otel.endpoint` keeps meaning "where telemetry
ultimately goes" on every hive that already sets it.

Suppressing HYPERHIVE_OTEL_HEADERS_CREDENTIAL is the half that actually
closes the hole this issue is about. The credential path host -> container
is sound (/run/credentials is dr-x------ root), but the hive-otel-header
oneshot then writes the value into the agent's own settings.json, mode
0600 and owned by the agent — so today every agent can read the hive's
upstream telemetry credential. With a collector there is nothing to
forward.

The protocol is derived for the same reason the endpoint is: the first
hop is now the collector's OTLP/HTTP receiver, while otel.protocol
describes the upstream link.
This commit is contained in:
atlas 2026-08-15 09:31:42 +02:00 • committed by mara
commit 2a2f5a754e
1 changed files with 27 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

30
nix/host-modules/hive-c0re/environment.nix
View file

@ -81,15 +81,39 @@ in
# don't render no-op env lines. # don't render no-op env lines.
let let
otel = config.services.hyperhive.otel; otel = config.services.hyperhive.otel;
# `otel.endpoint` keeps meaning "where telemetry ultimately goes",
# on every hive, whether or not a collector runs. What changes with
# a collector is only where the *first* hop lands — so the
# agent-facing value is DERIVED here rather than by redefining the
# option. Redefining it would migrate the meaning of a value every
# existing hive already has set, silently, while still evaluating.
# With the collector off this expression is `otel.endpoint`, i.e.
# byte-identical to before the collector existed.
collectorOn = otel.collector.enable;
in in
{ {
HYPERHIVE_OTEL_ENDPOINT = otel.endpoint; HYPERHIVE_OTEL_ENDPOINT =
HYPERHIVE_OTEL_PROTOCOL = otel.protocol; if collectorOn then
"http://${config.services.hyperhive.network.bridgeIp}:${toString otel.collector.port}"
else
otel.endpoint;
# The first hop is the collector's OTLP/HTTP receiver, which speaks
# protobuf regardless of what the upstream wants — `otel.protocol`
# describes the *upstream* link, and the collector's own exporter is
# what has to honour it (see nix/host-modules/otel.nix).
HYPERHIVE_OTEL_PROTOCOL = if collectorOn then "http/protobuf" else otel.protocol;
} }
// lib.optionalAttrs (otel.extraResourceAttributes != "") { // lib.optionalAttrs (otel.extraResourceAttributes != "") {
HYPERHIVE_OTEL_EXTRA_RESOURCE_ATTRIBUTES = otel.extraResourceAttributes; HYPERHIVE_OTEL_EXTRA_RESOURCE_ATTRIBUTES = otel.extraResourceAttributes;
} }
// lib.optionalAttrs (otel.headersCredential != null) { // lib.optionalAttrs (otel.headersCredential != null && !collectorOn) {
# This is the variable that puts the upstream token in an agent's
# own `~/.claude/settings.json` (host_config.rs forwards it into the
# container as an nspawn credential; claude-settings.nix's
# `hive-otel-header` oneshot then writes it into a file the agent
# can read). Not emitting it is what actually removes the token from
# agent containers — the collector holding the credential is only
# half of it, and the half that is invisible in a diff.
HYPERHIVE_OTEL_HEADERS_CREDENTIAL = otel.headersCredential; HYPERHIVE_OTEL_HEADERS_CREDENTIAL = otel.headersCredential;
} }
// lib.optionalAttrs (otel.metricIntervalMs != null) { // lib.optionalAttrs (otel.metricIntervalMs != null) {