vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

grafana: query VictoriaMetrics by its swarm domain

Browse source 
The metrics datasource defaulted to http://127.0.0.1:<port>, which only
reached the store when Grafana and VictoriaMetrics ran on the same host.
Swarm-tier services may not assume colocation (#4499), so the default is
now https://<swarm.victoriametrics.domain>, the gateway vhost the store's
host already serves. That vhost's query routes carry no auth_request, and
the Grafana container already trusts the hive CA for its authelia token
exchange, so no credential is added.

The logs datasource stays on loopback: the log store's query route needs
a bearer token Grafana does not hold yet.

Part of #3742 (item 4, metrics).
This commit is contained in:
atlas 2026-10-13 01:22:17 +02:00 • committed by mara
commit 30d9e1d8e6
2 changed files with 12 additions and 14 deletions
Download patch file Download diff file Expand all files Collapse all files

2
docs/swarm/services.md
View file

@ -148,7 +148,7 @@ See `retentionPeriod` below before leaving it at its default.
| ---------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | ---------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `deploy.victoriametrics.retentionPeriod` | Default `5y`. Lower it once you have measured how fast this swarm actually fills a disk — the default is deliberately generous because too-short silently discards history you can't get back. | | `deploy.victoriametrics.retentionPeriod` | Default `5y`. Lower it once you have measured how fast this swarm actually fills a disk — the default is deliberately generous because too-short silently discards history you can't get back. |
| `swarm.grafana.oidc.role` | Default `Admin` for everyone who logs in. Lower to `Viewer`/`Editor` if the swarm grows operators who shouldn't be able to reconfigure Grafana. | | `swarm.grafana.oidc.role` | Default `Admin` for everyone who logs in. Lower to `Viewer`/`Editor` if the swarm grows operators who shouldn't be able to reconfigure Grafana. |
| `deploy.grafana.datasourceUrl` | Only if you front VictoriaMetrics with something else. It defaults to the store on this host, which is the only thing it can reach. | | `deploy.grafana.datasourceUrl` | Only if you front VictoriaMetrics with something else. It defaults to the store's swarm name (`https://<swarm.victoriametrics.domain>`), so Grafana and the store can run on different hosts. |
<!-- vale write-good.Passive = NO --> <!-- vale write-good.Passive = NO -->

24
nix/host-modules/swarm-grafana.nix
View file

@ -1,5 +1,5 @@
# The swarm's metrics UI: one Grafana for the whole swarm, in a # The swarm's metrics UI: one Grafana for the whole swarm, in a
# `swarm-grafana` nixos-container next to the VictoriaMetrics store it reads. # `swarm-grafana` nixos-container, reading the VictoriaMetrics store.
# #
# Two containers rather than one, on the operator's call: Grafana can be # Two containers rather than one, on the operator's call: Grafana can be
# restarted, reconfigured or broken without taking the TSDB down with it. # restarted, reconfigured or broken without taking the TSDB down with it.
@ -287,9 +287,7 @@ in
# store path, and the directory it shares a socket with nginx through. # store path, and the directory it shares a socket with nginx through.
# `enable` already lives in ./deploy.nix, which also carries the renames. # `enable` already lives in ./deploy.nix, which also carries the renames.
# #
# ⚠️ Both datasource URLs are wiring, so they live here. A URL's scope is the # Both datasource URLs are wiring, so they live here.
# scope of what it ADDRESSES, not the fact that it is a URL: both stores
# bind loopback, so these can only ever mean "on this host".
options.services.hyperhive.deploy.grafana = { options.services.hyperhive.deploy.grafana = {
package = lib.mkOption { package = lib.mkOption {
type = lib.types.package; type = lib.types.package;
@ -324,14 +322,14 @@ in
datasourceUrl = lib.mkOption { datasourceUrl = lib.mkOption {
type = lib.types.str; type = lib.types.str;
default = "http://127.0.0.1:${toString hyperhiveCfg.swarm.victoriametrics.port}"; default = "https://${hyperhiveCfg.swarm.victoriametrics.domain}";
defaultText = lib.literalExpression ''"http://127.0.0.1:''${toString services.hyperhive.swarm.victoriametrics.port}"''; defaultText = lib.literalExpression ''"https://''${services.hyperhive.swarm.victoriametrics.domain}"'';
description = '' description = ''
Where the provisioned datasource points. Defaults to the metrics Where the provisioned datasource points. Defaults to the metrics
store on this host, which is the only place it can be: that store store's swarm name, served by the gateway of whichever host runs the
binds loopback, so a Grafana somewhere else could not reach it store, so Grafana and the store need not share a host. The store's
anyway. Set explicitly if a deployment fronts VictoriaMetrics with query routes on that vhost take no credential, so the datasource
something that does listen wider. sends none.
''; '';
}; };
@ -340,9 +338,9 @@ in
default = "http://127.0.0.1:${toString hyperhiveCfg.swarm.victorialogs.port}"; default = "http://127.0.0.1:${toString hyperhiveCfg.swarm.victorialogs.port}";
defaultText = lib.literalExpression ''"http://127.0.0.1:''${toString services.hyperhive.swarm.victorialogs.port}"''; defaultText = lib.literalExpression ''"http://127.0.0.1:''${toString services.hyperhive.swarm.victorialogs.port}"'';
description = '' description = ''
Where the provisioned logs datasource points. Same reasoning as Where the provisioned logs datasource points. Defaults to the log
{option}`services.hyperhive.deploy.grafana.datasourceUrl`: the store store on this host, which binds loopback, so this default reaches
binds loopback, so a Grafana elsewhere could not reach it anyway. it only where Grafana and the store share a host.
Provisioned unconditionally, like the metrics datasource — the store Provisioned unconditionally, like the metrics datasource — the store
being off is a deployment choice rather than a reason to withhold the being off is a deployment choice rather than a reason to withhold the