victorialogs and victoriametrics: own the package for each auth responder they run

nix/host-modules/swarm-victorialogs.nix

@@ -152,6 +152,20 @@ in
     '';
   };
 
+  options.services.hyperhive.deploy.victorialogs.grafanaAuthPackage = lib.mkOption {
+    type = lib.types.package;
+    defaultText = lib.literalExpression "hyperhive.packages.\${system}.swarm-metrics-auth";
+    description = ''
+      The `swarm-metrics-auth` package, run as `swarm-logs-grafana-auth`: the
+      gateway's `auth_request` responder that checks the bearer Grafana's
+      logs datasource presents on `/select/logsql/` against the secret store.
+
+      ⚠️ Not folded into `authPackage` above: that one is `swarm-logs-auth`,
+      a different binary. Same split as
+      {option}`services.hyperhive.deploy.nats.authPackage`.
+    '';
+  };
+
   options.services.hyperhive.deploy.victorialogs.authBaoClientCertFile = lib.mkOption {
     type = lib.types.nullOr lib.types.str;
     default = null;
@@ -540,7 +554,7 @@ in
       ];
       serviceConfig = {
         ExecStart = lib.concatStringsSep " " [
-          "${deployCfg.victoriametrics.authPackage}/bin/swarm-metrics-auth"
+          "${deployCfg.victorialogs.grafanaAuthPackage}/bin/swarm-metrics-auth"
           "--socket ${grafanaAuthSocket}"
           "--store-cert-role swarm-logs-auth"
           "--store-path ${grafanaBearerStorePath}"

nix/host-modules/swarm-victoriametrics.nix

@@ -244,6 +244,21 @@ in
     '';
   };
 
+  options.services.hyperhive.deploy.victoriametrics.agentAuthPackage = lib.mkOption {
+    type = lib.types.package;
+    defaultText = lib.literalExpression "hyperhive.packages.\${system}.swarm-logs-auth";
+    description = ''
+      The `swarm-logs-auth` package, run as `swarm-metrics-agent-auth`: the
+      gateway's `auth_request` responder that checks an agent's
+      `swarm-agent.<agent>.<secret>` bearer on the read API against the
+      secret store.
+
+      ⚠️ Not folded into `authPackage` above: that one is
+      `swarm-metrics-auth`, a different binary. Same split as
+      {option}`services.hyperhive.deploy.nats.authPackage`.
+    '';
+  };
+
   options.services.hyperhive.deploy.victoriametrics.authBaoClientCertFile = lib.mkOption {
     type = lib.types.nullOr lib.types.str;
     default = null;
@@ -594,7 +609,7 @@ in
       ];
       serviceConfig = {
         ExecStart = lib.concatStringsSep " " [
-          "${deployCfg.victorialogs.authPackage}/bin/swarm-logs-auth"
+          "${deployCfg.victoriametrics.agentAuthPackage}/bin/swarm-logs-auth"
           "--socket ${agentAuthSocket}"
           "--store-cert-role swarm-metrics-auth"
           "--verdict-ttl ${toString deployCfg.victoriametrics.agentAuthVerdictTtl}"

nix/module-eval/core-toggle.nix

@@ -33,6 +33,12 @@ let
 
   bare = shared.bareWithController;
 
+  # `lib.hasInfix` matches by regex, which refuses a needle that refers to a
+  # store path. Both sides lose their string context here.
+  hasStorePath =
+    needle: hay:
+    lib.hasInfix (builtins.unsafeDiscardStringContext needle) (builtins.unsafeDiscardStringContext hay);
+
   # The same stub with the central toggle (`deploy.hive-controller.enable`)
   # off. Paired with `bare` below to pin the defaults that do not read it:
   # each is asserted to hold the SAME literal in both, so a future edit
@@ -723,6 +729,7 @@ let
           agentArm = "\"~^Bearer swarm-agent\\.\" /__metrics_agent_auth;";
           bearerArm = "\"~^Bearer \" /__metrics_grafana_auth;";
           v = allLocal.services.hyperhive.deploy.victoriametrics;
+          logs = allLocal.services.hyperhive.deploy.victorialogs;
           reads = lib.filterAttrs (n: _: lib.hasPrefix "= /api/v1/" n || lib.hasPrefix "^~ /api/v1/" n) l;
         in
         reads ? "= /api/v1/query_range"
@@ -745,7 +752,9 @@ let
         && lib.hasInfix "internal;" l."= /__metrics_agent_auth".extraConfig
         && l."= /__metrics_agent_auth".proxyPass == "http://unix:/run/swarm-metrics-agent-auth/auth.sock:/"
         && lib.hasInfix "--socket /run/swarm-metrics-agent-auth/auth.sock" agentUnit.serviceConfig.ExecStart
-        && lib.hasInfix "/bin/swarm-logs-auth " agentUnit.serviceConfig.ExecStart
+        && hasStorePath "${v.agentAuthPackage}/bin/swarm-logs-auth " agentUnit.serviceConfig.ExecStart
+        && !(hasStorePath "${logs.authPackage}" agentUnit.serviceConfig.ExecStart)
+        && hasStorePath "${v.authPackage}/bin/swarm-metrics-auth " unit.serviceConfig.ExecStart
         && lib.hasInfix "--store-cert-role swarm-metrics-auth" agentUnit.serviceConfig.ExecStart
         && lib.hasInfix "--verdict-ttl ${toString v.agentAuthVerdictTtl}" agentUnit.serviceConfig.ExecStart
         && agentUnit.serviceConfig.LoadCredential == unit.serviceConfig.LoadCredential
@@ -880,6 +889,8 @@ let
           http = allLocal.services.nginx.appendHttpConfig;
           unit = allLocal.systemd.services.swarm-logs-auth;
           grafanaUnit = allLocal.systemd.services.swarm-logs-grafana-auth;
+          logs = allLocal.services.hyperhive.deploy.victorialogs;
+          metrics = allLocal.services.hyperhive.deploy.victoriametrics;
         in
         lib.hasInfix "map \$http_authorization \$swarm_logs_auth_target" http
         && lib.hasInfix "\"~^Bearer swarm-agent\\.\" /__swarm_logs_agent_auth;" http
@@ -894,7 +905,9 @@ let
         &&
           l."= /__swarm_logs_grafana_auth".proxyPass == "http://unix:/run/swarm-logs-grafana-auth/auth.sock:/"
         && lib.hasInfix "--socket /run/swarm-logs-grafana-auth/auth.sock" grafanaUnit.serviceConfig.ExecStart
-        && lib.hasInfix "swarm-metrics-auth" grafanaUnit.serviceConfig.ExecStart
+        && hasStorePath "${logs.grafanaAuthPackage}/bin/swarm-metrics-auth " grafanaUnit.serviceConfig.ExecStart
+        && !(hasStorePath "${metrics.authPackage}" grafanaUnit.serviceConfig.ExecStart)
+        && hasStorePath "${logs.authPackage}/bin/swarm-logs-auth " unit.serviceConfig.ExecStart
         && lib.hasInfix "--store-cert-role swarm-logs-auth" grafanaUnit.serviceConfig.ExecStart
         && l ? "= /__hive_authelia";
     }

nix/module-eval/shared.nix

@@ -31,6 +31,10 @@ let
     agent
     agentWith
     ;
+
+  # The four auth responder packages pinned to four distinct derivations, so
+  # a unit's ExecStart names which option it read. Nothing else reads them.
+  marker = name: pkgs.runCommand "auth-marker-${name}" { } "mkdir $out";
 in
 {
   agentBare = agent { };
@@ -41,7 +45,13 @@ in
 
   bareWithController = hiveWithController { };
 
-  allLocal = hiveWithController { deploy.singleHostSwarm = true; };
+  allLocal = hiveWithController {
+    deploy.singleHostSwarm = true;
+    deploy.victorialogs.authPackage = marker "logs";
+    deploy.victorialogs.grafanaAuthPackage = marker "logs-grafana";
+    deploy.victoriametrics.authPackage = marker "metrics";
+    deploy.victoriametrics.agentAuthPackage = marker "metrics-agent";
+  };
 
   autheliaOnly = hive { deploy.authelia.enable = true; };