move the small per-service host options to deploy.<service>
This commit is contained in:
atlas
mara
parent
400fdd7f0e
commit
525de62b06
1 changed files with 407 additions and 251 deletions
|
|
@ -364,6 +364,64 @@ in
|
|||
# ./deploy.nix, which also carries the renames. The callout's keys are no
|
||||
# option at all: they live in the secret store (docs/swarm/credentials.md).
|
||||
options.services.hyperhive.deploy.nats = {
|
||||
monitorPort = lib.mkOption {
|
||||
type = lib.types.port;
|
||||
default = 8222;
|
||||
description = ''
|
||||
Port NATS serves its **monitoring** endpoint on, bound to
|
||||
loopback.
|
||||
|
||||
Not a metrics endpoint: the server has no Prometheus format of its
|
||||
own. This serves `/varz`, `/connz`, `/routez` as JSON, and the
|
||||
exporter below is what translates it — which is why enabling the
|
||||
exporter without this produces a process that starts cleanly and
|
||||
scrapes nothing.
|
||||
|
||||
⚠️ Loopback, and the exporter is the only intended reader. The
|
||||
endpoint is unauthenticated and `/connz` names every connected
|
||||
client, so the address it binds is the whole access control. Do
|
||||
not widen it, and do not put it behind a gateway vhost expecting
|
||||
that to add one.
|
||||
'';
|
||||
};
|
||||
|
||||
metricsPort = lib.mkOption {
|
||||
type = lib.types.port;
|
||||
default = 7777;
|
||||
description = ''
|
||||
Port the Prometheus exporter serves NATS's metrics on, bound to
|
||||
loopback. The gateway's `= /metrics` location on
|
||||
{option}`services.hyperhive.swarm.nats.domain` proxies it, behind
|
||||
the swarm collector's authelia check.
|
||||
|
||||
⚠️ This and {option}`services.hyperhive.deploy.nats.monitorPort` are two
|
||||
more claims on a port
|
||||
space every swarm container shares — they run in this container but
|
||||
`privateNetwork = false`, so a collision with any other hyperhive
|
||||
service is a runtime coin toss over which process gets the port,
|
||||
with nothing in any log saying so. Both defaults are upstream's
|
||||
own (`nats-server` 8222, `prometheus-nats-exporter` 7777) and
|
||||
neither is claimed elsewhere in this repo, checked when they were
|
||||
added.
|
||||
'';
|
||||
};
|
||||
|
||||
otel.telemetryPort = lib.mkOption {
|
||||
type = lib.types.port;
|
||||
default = 8891;
|
||||
description = ''
|
||||
Loopback port the journal forwarder inside the queue's container
|
||||
serves its own metrics on (refused and dropped records, exporter
|
||||
failures).
|
||||
|
||||
⚠️ Not 8888 or 8890: the hive collector and the store's forwarder
|
||||
bind those ({option}`services.hyperhive.otel.telemetryPort`,
|
||||
{option}`services.hyperhive.deploy.bao.otel.telemetryPort`), and this
|
||||
container shares the host netns with them when co-located. The second
|
||||
collector to bind a port dies with `bind: address already in use`.
|
||||
'';
|
||||
};
|
||||
|
||||
authPackage = lib.mkOption {
|
||||
type = lib.types.package;
|
||||
defaultText = lib.literalExpression "hyperhive.packages.\${system}.swarm-nats-auth";
|
||||
|
|
@ -485,7 +543,7 @@ in
|
|||
# Authelia's rules for it admit the collector's client and deny
|
||||
# every other subject (`metricsRules` in ./swarm-authelia.nix).
|
||||
"= /metrics" = {
|
||||
proxyPass = "http://127.0.0.1:${toString cfg.metricsPort}/metrics";
|
||||
proxyPass = "http://127.0.0.1:${toString deployCfg.nats.metricsPort}/metrics";
|
||||
extraConfig = ''
|
||||
auth_request /__nats_metrics_authz;
|
||||
'';
|
||||
|
|
@ -597,17 +655,17 @@ in
|
|||
let
|
||||
ports = [
|
||||
cfg.port
|
||||
cfg.monitorPort
|
||||
cfg.metricsPort
|
||||
cfg.otel.telemetryPort
|
||||
deployCfg.nats.monitorPort
|
||||
deployCfg.nats.metricsPort
|
||||
deployCfg.nats.otel.telemetryPort
|
||||
config.services.hyperhive.otel.telemetryPort
|
||||
config.services.hyperhive.swarm.bao.otel.telemetryPort
|
||||
deployCfg.bao.otel.telemetryPort
|
||||
];
|
||||
in
|
||||
lib.length (lib.unique ports) == lib.length ports;
|
||||
message = ''
|
||||
services.hyperhive.swarm.nats.otel.telemetryPort
|
||||
(${toString cfg.otel.telemetryPort}) collides with another port in
|
||||
services.hyperhive.deploy.nats.otel.telemetryPort
|
||||
(${toString deployCfg.nats.otel.telemetryPort}) collides with another port in
|
||||
the host netns: the queue's own ports, or the telemetry port of the
|
||||
hive collector or the store's forwarder. Pick
|
||||
a free port.
|
||||
|
|
@ -687,7 +745,7 @@ in
|
|||
endpoint = forwarderEndpoint;
|
||||
inherit (cfg) clientId;
|
||||
tokenUrl = "${toString autheliaUrl}/api/oidc/token";
|
||||
telemetryPort = cfg.otel.telemetryPort;
|
||||
telemetryPort = deployCfg.nats.otel.telemetryPort;
|
||||
store = {
|
||||
package = baoDeploy.package;
|
||||
addr = "https://${baoCfg.domain}:${toString baoCfg.port}";
|
||||
|
|
@ -749,7 +807,7 @@ in
|
|||
#
|
||||
# ⚠️ Loopback: unauthenticated, and `/connz` lists every
|
||||
# connected client.
|
||||
http = "127.0.0.1:${toString cfg.monitorPort}";
|
||||
http = "127.0.0.1:${toString deployCfg.nats.monitorPort}";
|
||||
|
||||
# TLS required on the client port: a server with a `tls`
|
||||
# block advertises `tls_required` and refuses a client that
|
||||
|
|
@ -782,8 +840,8 @@ in
|
|||
services.prometheus.exporters.nats = {
|
||||
enable = true;
|
||||
listenAddress = "127.0.0.1";
|
||||
port = cfg.metricsPort;
|
||||
url = "http://127.0.0.1:${toString cfg.monitorPort}";
|
||||
port = deployCfg.nats.metricsPort;
|
||||
url = "http://127.0.0.1:${toString deployCfg.nats.monitorPort}";
|
||||
|
||||
# ⚠️ NOT optional, despite the name. Upstream renders
|
||||
# `-addr … -port … ${extraFlags} ${url}` and defaults
|
||||
|
|
|
|||
Loading…
Reference in a new issue