vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

swarm-otel: declare forgejo's published scrape target on every host

Browse source 
The forgejo entry in `swarm.otel.publishedScrapeTargets` was declared
under `deploy.forgejo.enable`, so it existed only in the forge host's
evaluation. Its two readers evaluate elsewhere: the collector renders
its prometheus jobs from its own host's list, and authelia registers
the collector client's audience from its own host's list. With the
forge, the collector and authelia on different hosts, the collector
had no forgejo job and authelia would have refused its token.

Declare the entry unconditionally in swarm-otel-service.nix, keyed on
`swarm.forge.domain`, which every host evaluates identically. A swarm
with no forge scrapes a name that answers nothing and shows a failing
job, the same trade the collector and grafana OIDC clients already make.

Single-host render is unchanged: the entry already existed there.

Part of #5205
This commit is contained in:
atlas 2026-10-13 10:24:17 +02:00 • committed by mara
commit 6c1ab87f68
4 changed files with 82 additions and 23 deletions
Download patch file Download diff file Expand all files Collapse all files

15
nix/host-modules/hive-forge/default.nix
View file

@ -290,17 +290,6 @@ in
# The forge container resolves the rest of the hive through dnsmasq.
services.hyperhive.gateway.dns.enable = lib.mkDefault true;
# The metrics endpoint, declared once: the collector both scrapes this
# URL and derives from it the audience its token is minted for.
#
# ⚠️ Written as the exact URL a collector requests, because that is
# what authelia compares against — this string agreeing with the
# `location` block above it is the whole mechanism. A near miss is a
# correctly minted token refused at the target.
services.hyperhive.swarm.otel.publishedScrapeTargets = {
forgejo = "https://${cfg.domain}/metrics";
};
# `server_name = forge.domain`, proxies all `/` → forgejo. Tuned for
# git: `client_max_body_size 1G`, `proxy_read_timeout 1h` (multi-GB
# clones). SSH stays direct on `forge.sshPort`. See
@ -327,6 +316,10 @@ in
# endpoint would ride that catch-all to anyone. `= /metrics`
# outranks the `/` prefix in nginx, so this location — and its
# auth — is the one that runs.
#
# The collector requests exactly this URL, declared as
# `publishedScrapeTargets.forgejo` in ../swarm-otel-service.nix;
# the two must agree, since that string is also the token's audience.
"= /metrics" = {
proxyPass = "http://127.0.0.1:${toString cfg.httpPort}/metrics";
extraConfig = ''