diff --git a/docs/swarm/services.md b/docs/swarm/services.md index 0df067d3..bf601cdc 100644 --- a/docs/swarm/services.md +++ b/docs/swarm/services.md @@ -1,6 +1,7 @@ | `deploy.victoriametrics.agentAuthRate` | Default `50r/s` per client address, for agent reads checked by `swarm-metrics-agent-auth`; over it and `agentAuthBurst`, the gateway answers 403. | | `deploy.victoriametrics.agentAuthBurst` | Default `500` requests above `agentAuthRate` before the 403s start. | | `deploy.victoriametrics.agentAuthVerdictTtl` | Default `60` seconds that `swarm-metrics-agent-auth` keeps granting an agent secret it verified. A replaced or deleted secret keeps working at the metrics store for up to that long. | +| `deploy.victoriametrics.agentAuthPackage` | The `swarm-logs-auth` build that runs as `swarm-metrics-agent-auth`. Set on its own: `deploy.victorialogs.authPackage` doesn't reach it. | # Swarm-wide services @@ -269,14 +270,15 @@ Drilldown_ app is deliberately not installed: it only supports Loki, and no setting here changes that, so Explore is the log browser for this swarm. -| Option | When you'd touch it | -| ------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -| `deploy.victorialogs.retentionPeriod` | Default `30d`, far shorter than the metrics store's — logs are bulkier per unit of value and are typically read within days of ingestion. Raise it if you need to answer questions about last quarter. | -| `deploy.victorialogs.authRate` | Default `50r/s` per client address, for agent queries checked by `swarm-logs-auth`; over it and `authBurst`, the gateway answers 403. Agents on one host share the address; the default covers about a hundred cold-starting together. | -| `deploy.victorialogs.authBurst` | Default `500` requests above `authRate` before the 403s start. | -| `deploy.victorialogs.authVerdictTtl` | Default `60` seconds that `swarm-logs-auth` keeps granting an agent secret it verified, without asking the secret store. A replaced or deleted secret keeps working at the log store for up to that long. | -| `swarm.victorialogs.domain` | Only to rename it. | -| `swarm.victorialogs.port` | Only if something else on the services host already claims `9428`. | +| Option | When you'd touch it | +| ---------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | +| `deploy.victorialogs.retentionPeriod` | Default `30d`, far shorter than the metrics store's — logs are bulkier per unit of value and are typically read within days of ingestion. Raise it if you need to answer questions about last quarter. | +| `deploy.victorialogs.authRate` | Default `50r/s` per client address, for agent queries checked by `swarm-logs-auth`; over it and `authBurst`, the gateway answers 403. Agents on one host share the address; the default covers about a hundred cold-starting together. | +| `deploy.victorialogs.authBurst` | Default `500` requests above `authRate` before the 403s start. | +| `deploy.victorialogs.authVerdictTtl` | Default `60` seconds that `swarm-logs-auth` keeps granting an agent secret it verified, without asking the secret store. A replaced or deleted secret keeps working at the log store for up to that long. | +| `deploy.victorialogs.grafanaAuthPackage` | The `swarm-metrics-auth` build that runs as `swarm-logs-grafana-auth`. Set on its own: `deploy.victoriametrics.authPackage` doesn't reach it. | +| `swarm.victorialogs.domain` | Only to rename it. | +| `swarm.victorialogs.port` | Only if something else on the services host already claims `9428`. | It binds loopback and takes no credential of its own: the gateway vhost is the only way in, and the collector is the only intended writer. diff --git a/flake.nix b/flake.nix index 4a85bc31..667b22c5 100644 --- a/flake.nix +++ b/flake.nix @@ -156,6 +156,12 @@ services.hyperhive.deploy.victoriametrics.authPackage = lib.mkDefault self.packages.${pkgs.stdenv.hostPlatform.system}.swarm-metrics-auth; + services.hyperhive.deploy.victorialogs.grafanaAuthPackage = + lib.mkDefault + self.packages.${pkgs.stdenv.hostPlatform.system}.swarm-metrics-auth; + services.hyperhive.deploy.victoriametrics.agentAuthPackage = + lib.mkDefault + self.packages.${pkgs.stdenv.hostPlatform.system}.swarm-logs-auth; services.hyperhive.deploy.nats.authPackage = lib.mkDefault self.packages.${pkgs.stdenv.hostPlatform.system}.swarm-nats-auth; diff --git a/nix/host-modules/swarm-victorialogs.nix b/nix/host-modules/swarm-victorialogs.nix index 549a9fc2..2276ad6e 100644 --- a/nix/host-modules/swarm-victorialogs.nix +++ b/nix/host-modules/swarm-victorialogs.nix @@ -152,6 +152,20 @@ in ''; }; + options.services.hyperhive.deploy.victorialogs.grafanaAuthPackage = lib.mkOption { + type = lib.types.package; + defaultText = lib.literalExpression "hyperhive.packages.\${system}.swarm-metrics-auth"; + description = '' + The `swarm-metrics-auth` package, run as `swarm-logs-grafana-auth`: the + gateway's `auth_request` responder that checks the bearer Grafana's + logs datasource presents on `/select/logsql/` against the secret store. + + ⚠️ Not folded into `authPackage` above: that one is `swarm-logs-auth`, + a different binary. Same split as + {option}`services.hyperhive.deploy.nats.authPackage`. + ''; + }; + options.services.hyperhive.deploy.victorialogs.authBaoClientCertFile = lib.mkOption { type = lib.types.nullOr lib.types.str; default = null; @@ -540,7 +554,7 @@ in ]; serviceConfig = { ExecStart = lib.concatStringsSep " " [ - "${deployCfg.victoriametrics.authPackage}/bin/swarm-metrics-auth" + "${deployCfg.victorialogs.grafanaAuthPackage}/bin/swarm-metrics-auth" "--socket ${grafanaAuthSocket}" "--store-cert-role swarm-logs-auth" "--store-path ${grafanaBearerStorePath}" diff --git a/nix/host-modules/swarm-victoriametrics.nix b/nix/host-modules/swarm-victoriametrics.nix index 27d5f8e3..a8a2f86b 100644 --- a/nix/host-modules/swarm-victoriametrics.nix +++ b/nix/host-modules/swarm-victoriametrics.nix @@ -244,6 +244,21 @@ in ''; }; + options.services.hyperhive.deploy.victoriametrics.agentAuthPackage = lib.mkOption { + type = lib.types.package; + defaultText = lib.literalExpression "hyperhive.packages.\${system}.swarm-logs-auth"; + description = '' + The `swarm-logs-auth` package, run as `swarm-metrics-agent-auth`: the + gateway's `auth_request` responder that checks an agent's + `swarm-agent..` bearer on the read API against the + secret store. + + ⚠️ Not folded into `authPackage` above: that one is + `swarm-metrics-auth`, a different binary. Same split as + {option}`services.hyperhive.deploy.nats.authPackage`. + ''; + }; + options.services.hyperhive.deploy.victoriametrics.authBaoClientCertFile = lib.mkOption { type = lib.types.nullOr lib.types.str; default = null; @@ -594,7 +609,7 @@ in ]; serviceConfig = { ExecStart = lib.concatStringsSep " " [ - "${deployCfg.victorialogs.authPackage}/bin/swarm-logs-auth" + "${deployCfg.victoriametrics.agentAuthPackage}/bin/swarm-logs-auth" "--socket ${agentAuthSocket}" "--store-cert-role swarm-metrics-auth" "--verdict-ttl ${toString deployCfg.victoriametrics.agentAuthVerdictTtl}" diff --git a/nix/module-eval/core-toggle.nix b/nix/module-eval/core-toggle.nix index 812c3d0e..0f6adda0 100644 --- a/nix/module-eval/core-toggle.nix +++ b/nix/module-eval/core-toggle.nix @@ -33,6 +33,12 @@ let bare = shared.bareWithController; + # `lib.hasInfix` matches by regex, which refuses a needle that refers to a + # store path. Both sides lose their string context here. + hasStorePath = + needle: hay: + lib.hasInfix (builtins.unsafeDiscardStringContext needle) (builtins.unsafeDiscardStringContext hay); + # The same stub with the central toggle (`deploy.hive-controller.enable`) # off. Paired with `bare` below to pin the defaults that do not read it: # each is asserted to hold the SAME literal in both, so a future edit @@ -723,6 +729,7 @@ let agentArm = "\"~^Bearer swarm-agent\\.\" /__metrics_agent_auth;"; bearerArm = "\"~^Bearer \" /__metrics_grafana_auth;"; v = allLocal.services.hyperhive.deploy.victoriametrics; + logs = allLocal.services.hyperhive.deploy.victorialogs; reads = lib.filterAttrs (n: _: lib.hasPrefix "= /api/v1/" n || lib.hasPrefix "^~ /api/v1/" n) l; in reads ? "= /api/v1/query_range" @@ -745,7 +752,9 @@ let && lib.hasInfix "internal;" l."= /__metrics_agent_auth".extraConfig && l."= /__metrics_agent_auth".proxyPass == "http://unix:/run/swarm-metrics-agent-auth/auth.sock:/" && lib.hasInfix "--socket /run/swarm-metrics-agent-auth/auth.sock" agentUnit.serviceConfig.ExecStart - && lib.hasInfix "/bin/swarm-logs-auth " agentUnit.serviceConfig.ExecStart + && hasStorePath "${v.agentAuthPackage}/bin/swarm-logs-auth " agentUnit.serviceConfig.ExecStart + && !(hasStorePath "${logs.authPackage}" agentUnit.serviceConfig.ExecStart) + && hasStorePath "${v.authPackage}/bin/swarm-metrics-auth " unit.serviceConfig.ExecStart && lib.hasInfix "--store-cert-role swarm-metrics-auth" agentUnit.serviceConfig.ExecStart && lib.hasInfix "--verdict-ttl ${toString v.agentAuthVerdictTtl}" agentUnit.serviceConfig.ExecStart && agentUnit.serviceConfig.LoadCredential == unit.serviceConfig.LoadCredential @@ -880,6 +889,8 @@ let http = allLocal.services.nginx.appendHttpConfig; unit = allLocal.systemd.services.swarm-logs-auth; grafanaUnit = allLocal.systemd.services.swarm-logs-grafana-auth; + logs = allLocal.services.hyperhive.deploy.victorialogs; + metrics = allLocal.services.hyperhive.deploy.victoriametrics; in lib.hasInfix "map \$http_authorization \$swarm_logs_auth_target" http && lib.hasInfix "\"~^Bearer swarm-agent\\.\" /__swarm_logs_agent_auth;" http @@ -894,7 +905,9 @@ let && l."= /__swarm_logs_grafana_auth".proxyPass == "http://unix:/run/swarm-logs-grafana-auth/auth.sock:/" && lib.hasInfix "--socket /run/swarm-logs-grafana-auth/auth.sock" grafanaUnit.serviceConfig.ExecStart - && lib.hasInfix "swarm-metrics-auth" grafanaUnit.serviceConfig.ExecStart + && hasStorePath "${logs.grafanaAuthPackage}/bin/swarm-metrics-auth " grafanaUnit.serviceConfig.ExecStart + && !(hasStorePath "${metrics.authPackage}" grafanaUnit.serviceConfig.ExecStart) + && hasStorePath "${logs.authPackage}/bin/swarm-logs-auth " unit.serviceConfig.ExecStart && lib.hasInfix "--store-cert-role swarm-logs-auth" grafanaUnit.serviceConfig.ExecStart && l ? "= /__hive_authelia"; } diff --git a/nix/module-eval/shared.nix b/nix/module-eval/shared.nix index af9ae198..66452fca 100644 --- a/nix/module-eval/shared.nix +++ b/nix/module-eval/shared.nix @@ -31,6 +31,10 @@ let agent agentWith ; + + # The four auth responder packages pinned to four distinct derivations, so + # a unit's ExecStart names which option it read. Nothing else reads them. + marker = name: pkgs.runCommand "auth-marker-${name}" { } "mkdir $out"; in { agentBare = agent { }; @@ -41,7 +45,13 @@ in bareWithController = hiveWithController { }; - allLocal = hiveWithController { deploy.singleHostSwarm = true; }; + allLocal = hiveWithController { + deploy.singleHostSwarm = true; + deploy.victorialogs.authPackage = marker "logs"; + deploy.victorialogs.grafanaAuthPackage = marker "logs-grafana"; + deploy.victoriametrics.authPackage = marker "metrics"; + deploy.victoriametrics.agentAuthPackage = marker "metrics-agent"; + }; autheliaOnly = hive { deploy.authelia.enable = true; };