From 30d9e1d8e6810c6541648e8832838bd935d031e7 Mon Sep 17 00:00:00 2001 From: atlas Date: Tue, 13 Oct 2026 01:22:17 +0200 Subject: [PATCH] grafana: query VictoriaMetrics by its swarm domain The metrics datasource defaulted to http://127.0.0.1:, which only reached the store when Grafana and VictoriaMetrics ran on the same host. Swarm-tier services may not assume colocation (#4499), so the default is now https://, the gateway vhost the store's host already serves. That vhost's query routes carry no auth_request, and the Grafana container already trusts the hive CA for its authelia token exchange, so no credential is added. The logs datasource stays on loopback: the log store's query route needs a bearer token Grafana does not hold yet. Part of #3742 (item 4, metrics). --- docs/swarm/services.md | 2 +- nix/host-modules/swarm-grafana.nix | 24 +++++++++++------------- 2 files changed, 12 insertions(+), 14 deletions(-) diff --git a/docs/swarm/services.md b/docs/swarm/services.md index 7a0e1da5..2e52ccb5 100644 --- a/docs/swarm/services.md +++ b/docs/swarm/services.md @@ -148,7 +148,7 @@ See `retentionPeriod` below before leaving it at its default. | ---------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `deploy.victoriametrics.retentionPeriod` | Default `5y`. Lower it once you have measured how fast this swarm actually fills a disk — the default is deliberately generous because too-short silently discards history you can't get back. | | `swarm.grafana.oidc.role` | Default `Admin` for everyone who logs in. Lower to `Viewer`/`Editor` if the swarm grows operators who shouldn't be able to reconfigure Grafana. | -| `deploy.grafana.datasourceUrl` | Only if you front VictoriaMetrics with something else. It defaults to the store on this host, which is the only thing it can reach. | +| `deploy.grafana.datasourceUrl` | Only if you front VictoriaMetrics with something else. It defaults to the store's swarm name (`https://`), so Grafana and the store can run on different hosts. | diff --git a/nix/host-modules/swarm-grafana.nix b/nix/host-modules/swarm-grafana.nix index 2286f9a2..db32cdfd 100644 --- a/nix/host-modules/swarm-grafana.nix +++ b/nix/host-modules/swarm-grafana.nix @@ -1,5 +1,5 @@ # The swarm's metrics UI: one Grafana for the whole swarm, in a -# `swarm-grafana` nixos-container next to the VictoriaMetrics store it reads. +# `swarm-grafana` nixos-container, reading the VictoriaMetrics store. # # Two containers rather than one, on the operator's call: Grafana can be # restarted, reconfigured or broken without taking the TSDB down with it. @@ -287,9 +287,7 @@ in # store path, and the directory it shares a socket with nginx through. # `enable` already lives in ./deploy.nix, which also carries the renames. # - # ⚠️ Both datasource URLs are wiring, so they live here. A URL's scope is the - # scope of what it ADDRESSES, not the fact that it is a URL: both stores - # bind loopback, so these can only ever mean "on this host". + # Both datasource URLs are wiring, so they live here. options.services.hyperhive.deploy.grafana = { package = lib.mkOption { type = lib.types.package; @@ -324,14 +322,14 @@ in datasourceUrl = lib.mkOption { type = lib.types.str; - default = "http://127.0.0.1:${toString hyperhiveCfg.swarm.victoriametrics.port}"; - defaultText = lib.literalExpression ''"http://127.0.0.1:''${toString services.hyperhive.swarm.victoriametrics.port}"''; + default = "https://${hyperhiveCfg.swarm.victoriametrics.domain}"; + defaultText = lib.literalExpression ''"https://''${services.hyperhive.swarm.victoriametrics.domain}"''; description = '' Where the provisioned datasource points. Defaults to the metrics - store on this host, which is the only place it can be: that store - binds loopback, so a Grafana somewhere else could not reach it - anyway. Set explicitly if a deployment fronts VictoriaMetrics with - something that does listen wider. + store's swarm name, served by the gateway of whichever host runs the + store, so Grafana and the store need not share a host. The store's + query routes on that vhost take no credential, so the datasource + sends none. ''; }; @@ -340,9 +338,9 @@ in default = "http://127.0.0.1:${toString hyperhiveCfg.swarm.victorialogs.port}"; defaultText = lib.literalExpression ''"http://127.0.0.1:''${toString services.hyperhive.swarm.victorialogs.port}"''; description = '' - Where the provisioned logs datasource points. Same reasoning as - {option}`services.hyperhive.deploy.grafana.datasourceUrl`: the store - binds loopback, so a Grafana elsewhere could not reach it anyway. + Where the provisioned logs datasource points. Defaults to the log + store on this host, which binds loopback, so this default reaches + it only where Grafana and the store share a host. Provisioned unconditionally, like the metrics datasource — the store being off is a deployment choice rather than a reason to withhold the