Revert "swarm-otel: run in its own network namespace, receivers on unix sockets"

This reverts commit 8aad8db30d.

nix/module-eval/nats-authelia.nix

@@ -795,7 +795,7 @@ let
           otel = h.services.hyperhive.swarm.otel;
           s = h.containers.swarm-otel.config.services.opentelemetry-collector.settings;
           clientOf = svc: h.services.hyperhive.swarm.${svc.name}.clientId;
-          socks = map (svc: s.receivers."otlp/${svc.machine}".protocols.http.endpoint) forwarderServices;
+          ports = map (svc: otel.serviceProducers.${svc.machine}.port) forwarderServices;
         in
         !h.services.hyperhive.deploy.builder.enable
         && lib.all (
@@ -806,9 +806,9 @@ let
           && lib.elem "otlp/${svc.machine}" s.service.pipelines."logs/${otel.producerName}".receivers
           && h.services.nginx.virtualHosts.${otel.domain}.locations ? "/${svc.machine}/"
         ) forwarderServices
-        # Their receivers and the queue's on the collector's host, none sharing a socket.
+        # Their receivers and the queue's on the collector's host, none sharing a port.
         &&
-          lib.length (lib.unique (socks ++ [ s.receivers."otlp/swarm-nats".protocols.http.endpoint ]))
+          lib.length (lib.unique (ports ++ [ otel.serviceProducers.swarm-nats.port ]))
           == lib.length forwarderServices + 1;
     }
     {
@@ -837,9 +837,7 @@ let
           h = shared.baoWithCollector;
           otel = h.services.hyperhive.swarm.otel;
           s = h.containers.swarm-otel.config.services.opentelemetry-collector.settings;
-          socks = map (n: s.receivers."otlp/${n}".protocols.http.endpoint) (
-            lib.attrNames otel.serviceProducers
-          );
+          ports = map (p: p.port) (lib.attrValues otel.serviceProducers);
         in
         lib.all (
           svc:
@@ -849,7 +847,7 @@ let
           && lib.elem "otlp/${svc.machine}" s.service.pipelines."logs/${otel.producerName}".receivers
           && h.services.nginx.virtualHosts.${otel.domain}.locations ? "/${svc.machine}/"
         ) ownClientForwarders
-        && lib.length (lib.unique socks) == lib.length socks;
+        && lib.length (lib.unique ports) == lib.length ports;
     }
     {
       # Grafana's forwarder is a second client beside its browser login, which

nix/module-eval/swarm-services-switch.nix

@@ -170,10 +170,9 @@ let
     lib.filter (l: swarmServiceLinkDomains ? ${l.label}) cfg.services.hyperhive.swarm.controller.links;
 
   # Every service container at once: the services-only host plus the CI
-  # runner. The CI runner, the review classifier, the notification router, the
-  # builder, the claude login minter, the metrics store, the homeserver,
-  # authelia, Grafana and the collector are the ten containers on a netns of
-  # their own.
+  # runner. The CI runner, the review classifier, the builder, the claude login
+  # minter, the metrics store, the homeserver, authelia and Grafana are the eight
+  # containers on a netns of their own.
   serviceContainersWithCi = hive {
     deploy.hive-controller.enable = false;
     deploy.allSwarmServices = true;
@@ -793,62 +792,6 @@ let
         && lib.all (lib.hasPrefix "http://unix:${sock}:") forwarded
         && c.bindMounts.${dir}.hostPath == dir;
     }
-    {
-      # On the bridge by DHCP, with every receiver on a socket: the hive's, the
-      # swarm tier's and each service forwarder's. Every gateway location that
-      # forwards goes through one of them, and each receiver's socket is the
-      # one its location names. The three kinds are named so an empty filter
-      # can't pass.
-      name = "the swarm collector runs on a netns of its own and the gateway reaches every receiver over a socket";
-      ok =
-        let
-          host = serviceContainersWithCi;
-          net = host.services.hyperhive.network;
-          c = host.containers.swarm-otel;
-          otel = host.services.hyperhive.swarm.otel;
-          dir = "/run/swarm-otel";
-          sock = n: "${dir}/${n}.sock";
-          locs = host.services.nginx.virtualHosts.${otel.domain}.locations;
-          forwarded = lib.filter (p: p != null) (map (l: l.proxyPass) (lib.attrValues locs));
-          inner = c.config;
-          s = inner.services.opentelemetry-collector.settings;
-          unit = inner.systemd.services.opentelemetry-collector.serviceConfig;
-          nginxGid = host.ids.gids.nginx;
-          receivers = lib.filterAttrs (n: _: lib.hasPrefix "otlp/" n) s.receivers;
-          onSocket =
-            owner:
-            let
-              r = s.receivers."otlp/${owner}".protocols.http;
-            in
-            r.transport == "unix"
-            && r.endpoint == sock owner
-            && locs."/${owner}/".proxyPass == "http://unix:${sock owner}:/";
-        in
-        c.privateNetwork
-        && c.hostBridge == net.bridgeName
-        && c.hostAddress == null
-        && c.localAddress == null
-        && inner.networking.interfaces.eth0.useDHCP
-        && inner.networking.firewall.enable
-        && onSocket "h1"
-        && onSocket otel.producerName
-        && onSocket "swarm-grafana"
-        && lib.all (n: (receivers.${n}.protocols.http.transport or null) == "unix") (
-          lib.attrNames receivers
-        )
-        &&
-          lib.length (lib.attrNames receivers)
-          == lib.length (lib.attrNames host.services.hyperhive.swarm.hives)
-          + 1
-          + lib.length (lib.attrNames otel.serviceProducers)
-        && forwarded != [ ]
-        && lib.all (lib.hasPrefix "http://unix:${dir}/") forwarded
-        && c.bindMounts.${dir}.hostPath == dir
-        && builtins.elem "d ${dir} 2770 root ${toString nginxGid} - -" host.systemd.tmpfiles.rules
-        && inner.users.groups.gateway-nginx.gid == nginxGid
-        && lib.elem "gateway-nginx" unit.SupplementaryGroups
-        && unit.UMask == "0007";
-    }
     {
       # The DynamicUser layout keeps the history under /var/lib/private; the
       # static user's StateDirectory is the plain path. The move runs as its