vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

grafana: query VictoriaMetrics by its swarm domain

Browse source 
The metrics datasource defaulted to http://127.0.0.1:<port>, which only
reached the store when Grafana and VictoriaMetrics ran on the same host.
Swarm-tier services may not assume colocation (#4499), so the default is
now https://<swarm.victoriametrics.domain>, the gateway vhost the store's
host already serves. That vhost's query routes carry no auth_request, and
the Grafana container already trusts the hive CA for its authelia token
exchange, so no credential is added.

The logs datasource stays on loopback: the log store's query route needs
a bearer token Grafana does not hold yet.

Part of #3742 (item 4, metrics).
This commit is contained in:
atlas 2026-10-13 01:22:17 +02:00 • committed by mara
commit 30d9e1d8e6
2 changed files with 12 additions and 14 deletions
Download patch file Download diff file Expand all files Collapse all files

24
nix/host-modules/swarm-grafana.nix
View file

@ -1,5 +1,5 @@
# The swarm's metrics UI: one Grafana for the whole swarm, in a
# `swarm-grafana` nixos-container next to the VictoriaMetrics store it reads.
# `swarm-grafana` nixos-container, reading the VictoriaMetrics store.
#
# Two containers rather than one, on the operator's call: Grafana can be
# restarted, reconfigured or broken without taking the TSDB down with it.
@ -287,9 +287,7 @@ in
# store path, and the directory it shares a socket with nginx through.
# `enable` already lives in ./deploy.nix, which also carries the renames.
#
# ⚠️ Both datasource URLs are wiring, so they live here. A URL's scope is the
# scope of what it ADDRESSES, not the fact that it is a URL: both stores
# bind loopback, so these can only ever mean "on this host".
# Both datasource URLs are wiring, so they live here.
options.services.hyperhive.deploy.grafana = {
package = lib.mkOption {
type = lib.types.package;
@ -324,14 +322,14 @@ in
datasourceUrl = lib.mkOption {
type = lib.types.str;
default = "http://127.0.0.1:${toString hyperhiveCfg.swarm.victoriametrics.port}";
defaultText = lib.literalExpression ''"http://127.0.0.1:''${toString services.hyperhive.swarm.victoriametrics.port}"'';
default = "https://${hyperhiveCfg.swarm.victoriametrics.domain}";
defaultText = lib.literalExpression ''"https://''${services.hyperhive.swarm.victoriametrics.domain}"'';
description = ''
Where the provisioned datasource points. Defaults to the metrics
store on this host, which is the only place it can be: that store
binds loopback, so a Grafana somewhere else could not reach it
anyway. Set explicitly if a deployment fronts VictoriaMetrics with
something that does listen wider.
store's swarm name, served by the gateway of whichever host runs the
store, so Grafana and the store need not share a host. The store's
query routes on that vhost take no credential, so the datasource
sends none.
'';
};
@ -340,9 +338,9 @@ in
default = "http://127.0.0.1:${toString hyperhiveCfg.swarm.victorialogs.port}";
defaultText = lib.literalExpression ''"http://127.0.0.1:''${toString services.hyperhive.swarm.victorialogs.port}"'';
description = ''
Where the provisioned logs datasource points. Same reasoning as
{option}`services.hyperhive.deploy.grafana.datasourceUrl`: the store
binds loopback, so a Grafana elsewhere could not reach it anyway.
Where the provisioned logs datasource points. Defaults to the log
store on this host, which binds loopback, so this default reaches
it only where Grafana and the store share a host.
Provisioned unconditionally, like the metrics datasource — the store
being off is a deployment choice rather than a reason to withhold the