vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

swarm-otel: let the collector write its socket dir, and probe every route through nginx

Browse source
This commit is contained in:
atlas 2026-10-24 21:12:35 +02:00 • committed by mara
commit 41bea3c6d9
3 changed files with 104 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

30
nix/host-modules/swarm-otel.nix
View file

@ -697,12 +697,17 @@ in
# A collector that is up but not listening on a socket the gateway names
# answers every producer with a 502 and fails no unit. This one fails when
# any receiver socket refuses a connection for 30s, so the switch reports
# it. It runs as the gateway's user: a socket nginx cannot open fails too.
# Any HTTP status counts as accepted; only a failed connect is a failure.
# any receiver socket refuses a connection for 30s, or when the running
# nginx cannot reach one, so the switch reports it. It runs as the
# gateway's user: a socket nginx cannot open fails too. On the socket any
# HTTP status counts as accepted. Through nginx 000, 502 and 504 fail and
# every other status passes, a collector's 4xx included.
systemd.services.swarm-otel-sockets = {
description = "wait for every swarm collector receiver socket to accept a connection";
after = [ "container@${cfg.machine}.service" ];
after = [
"container@${cfg.machine}.service"
"nginx.service"
];
wants = [ "container@${cfg.machine}.service" ];
# Restarted with the container, so every start of the collector is
# checked and not only the first one after a boot.
@ -727,6 +732,19 @@ in
echo "no connection to $sock after 30s" >&2
exit 1
done
# The running nginx, not its config. `--resolve` pins the vhost to
# this host's gateway.
for route in ${lib.escapeShellArgs (lib.attrNames receiverSockets)}; do
for _ in $(seq 30); do
code=$(curl -sk --max-time 5 --resolve ${cfg.domain}:443:127.0.0.1 -o /dev/null -w '%{http_code}' \
"https://${cfg.domain}/$route/") || code=000
case $code in 000 | 502 | 504) ;; *) continue 2 ;; esac
sleep 1
done
echo "https://${cfg.domain}/$route/ answered $code after 30s" >&2
exit 1
done
'';
};
@ -1666,6 +1684,10 @@ in
# `0007` makes each socket `0770`: group nginx can connect.
SupplementaryGroups = [ socketGroup ];
UMask = "0007";
# `DynamicUser` forces `ProtectSystem=strict` over upstream's
# `full`, so `/run` is read-only in the unit and the socket
# directory's writable bind mount does not reach it.
ReadWritePaths = [ socketDir ];
# A socket left by a killed process would fail the next `bind`.
ExecStartPre = [ "${pkgs.coreutils}/bin/rm -f ${lib.escapeShellArgs allSockets}" ];
};