vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

module-eval: the collector's metrics push path must be the vhost's gated push route

Browse source 
The metrics vhost is default-deny; ingest works only because the collector's
metrics_endpoint path equals the vhost's gated exact location. The literals
live in separate modules, so renaming either broke ingest with CI green.
Assert the endpoint path is a location on the metrics vhost carrying
auth_request, in the existing core-toggle fixture.

Refs #5186
This commit is contained in:
atlas 2026-10-13 08:27:41 +02:00 • committed by mara
commit 37c58e79dc
1 changed files with 16 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

16
nix/module-eval/core-toggle.nix
View file

@ -26,6 +26,7 @@ let
bridgePorts bridgePorts
bridgePortsOrNone bridgePortsOrNone
swarmServiceEnables swarmServiceEnables
otelSettings
; ;
inherit (shared) allLocal; inherit (shared) allLocal;
@ -399,6 +400,21 @@ let
&& lib.hasInfix "auth_request" m.extraConfig && lib.hasInfix "auth_request" m.extraConfig
&& lib.hasInfix "auth_request" l.extraConfig; && lib.hasInfix "auth_request" l.extraConfig;
} }
{
# The metrics vhost is default-deny; the collector's push only lands
# because its `metrics_endpoint` path is the vhost's one gated exact
# location. The two literals live in different modules, so renaming
# either alone breaks ingest while everything still evaluates.
name = "the collector's metrics push path is a gated location on the metrics vhost";
ok =
let
endpoint = (otelSettings allLocal).exporters."otlphttp/victoriametrics".metrics_endpoint;
# "https://host/path" -> "/path"
path = "/" + lib.concatStringsSep "/" (lib.drop 3 (lib.splitString "/" endpoint));
loc = allLocal.services.nginx.virtualHosts."metrics.t.local".locations."= ${path}" or null;
in
loc != null && lib.hasInfix "auth_request" loc.extraConfig;
}
{ {
# The arm that actually protects something. A pusher handed # The arm that actually protects something. A pusher handed
# `error_page 401 =302` FOLLOWS it and POSTs its batch at a login page, # `error_page 401 =302` FOLLOWS it and POSTs its batch at a login page,