vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

swarm-otel: add an unauthenticated swarm-tier OTLP receiver for swarm-controller to push to

Browse source
This commit is contained in:
damocles 2026-08-26 21:36:45 +02:00 • committed by mara
commit 2aa33f12d2
2 changed files with 83 additions and 9 deletions
Download patch file Download diff file Expand all files Collapse all files

36
nix/host-modules/swarm-controller.nix
View file

@ -149,6 +149,35 @@ let
SWARM_CONTROLLER_NAME = config.services.hyperhive.swarm.name;
};
# `vcs_metrics`/`hive_jobq_metrics` (this daemon's OTLP push exporters)
# read the standard `OTEL_EXPORTER_OTLP_ENDPOINT` var and are silent,
# graceful no-ops without it — same shape as `forgeEnv`/`authBridgeEnv`
# above, genuinely optional and gated on the option resolving rather
# than assumed.
#
# Gated on THIS HOST running `swarm-otel`, not merely on it existing
# somewhere in the swarm: its receiver for a swarm-tier producer binds
# `127.0.0.1` only (see `swarm-otel.nix::producerPort`), so reaching it
# needs co-location, and this checks that directly rather than assuming
# it — the unasserted-co-location gap flagged elsewhere in this codebase
# doesn't apply here because there is nothing to assert: a controller on
# a host that doesn't run the collector simply exports nothing, the same
# graceful absence `forgeEnv` already models.
otelSwarmCfg = config.services.hyperhive.swarm.otel;
otelEnv = lib.optionalAttrs otelSwarmCfg.enable {
OTEL_EXPORTER_OTLP_ENDPOINT = "http://${otelSwarmCfg.domain}:${toString otelSwarmCfg.producerPort}";
};
# Only when THIS host also runs `swarm-otel` — same reasoning and same
# shape as `hive-forge/default.nix`'s `ssoLocal`-gated entry: a raw host
# systemd unit does not get the bridge's dnsmasq resolution containers
# get, so the name that reaches a co-located collector over `otelEnv`
# above needs an explicit loopback alias here, or it resolves however
# (or however it fails to) off-host DNS says on this host.
otelHostsEntry = lib.optionalAttrs otelSwarmCfg.enable {
"127.0.0.1" = [ otelSwarmCfg.domain ];
};
# Wrapped rather than documented: every one of these values is derived
# from an option this deployment already set, so making the operator
# re-supply them on the command line would be asking them to repeat the
@ -450,6 +479,10 @@ in
"swarm-controller-credential"
];
# See `otelHostsEntry`'s own comment: only present, and only ever
# `{ "127.0.0.1" = [ ... ]; }`, when this host also runs `swarm-otel`.
networking.hosts = otelHostsEntry;
users.users.swarm-controller = {
isSystemUser = true;
group = "swarm-controller";
@ -676,7 +709,8 @@ in
// forgeEnv
// webhookEnv
// authBridgeEnv
// swarmNameEnv;
// swarmNameEnv
// otelEnv;
};
# A systemd credential is a SNAPSHOT: it is materialised into `%d` once,