vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

victorialogs and victoriametrics: own the package for each auth responder they run

Browse source
This commit is contained in:
atlas 2026-10-17 15:11:02 +02:00
commit 6f4b3562b7
6 changed files with 73 additions and 13 deletions
Download patch file Download diff file Expand all files Collapse all files

16
nix/host-modules/swarm-victorialogs.nix
View file

@ -152,6 +152,20 @@ in
'';
};
options.services.hyperhive.deploy.victorialogs.grafanaAuthPackage = lib.mkOption {
type = lib.types.package;
defaultText = lib.literalExpression "hyperhive.packages.\${system}.swarm-metrics-auth";
description = ''
The `swarm-metrics-auth` package, run as `swarm-logs-grafana-auth`: the
gateway's `auth_request` responder that checks the bearer Grafana's
logs datasource presents on `/select/logsql/` against the secret store.
⚠️ Not folded into `authPackage` above: that one is `swarm-logs-auth`,
a different binary. Same split as
{option}`services.hyperhive.deploy.nats.authPackage`.
'';
};
options.services.hyperhive.deploy.victorialogs.authBaoClientCertFile = lib.mkOption {
type = lib.types.nullOr lib.types.str;
default = null;
@ -540,7 +554,7 @@ in
];
serviceConfig = {
ExecStart = lib.concatStringsSep " " [
"${deployCfg.victoriametrics.authPackage}/bin/swarm-metrics-auth"
"${deployCfg.victorialogs.grafanaAuthPackage}/bin/swarm-metrics-auth"
"--socket ${grafanaAuthSocket}"
"--store-cert-role swarm-logs-auth"
"--store-path ${grafanaBearerStorePath}"

17
nix/host-modules/swarm-victoriametrics.nix
View file

@ -244,6 +244,21 @@ in
'';
};
options.services.hyperhive.deploy.victoriametrics.agentAuthPackage = lib.mkOption {
type = lib.types.package;
defaultText = lib.literalExpression "hyperhive.packages.\${system}.swarm-logs-auth";
description = ''
The `swarm-logs-auth` package, run as `swarm-metrics-agent-auth`: the
gateway's `auth_request` responder that checks an agent's
`swarm-agent.<agent>.<secret>` bearer on the read API against the
secret store.
⚠️ Not folded into `authPackage` above: that one is
`swarm-metrics-auth`, a different binary. Same split as
{option}`services.hyperhive.deploy.nats.authPackage`.
'';
};
options.services.hyperhive.deploy.victoriametrics.authBaoClientCertFile = lib.mkOption {
type = lib.types.nullOr lib.types.str;
default = null;
@ -594,7 +609,7 @@ in
];
serviceConfig = {
ExecStart = lib.concatStringsSep " " [
"${deployCfg.victorialogs.authPackage}/bin/swarm-logs-auth"
"${deployCfg.victoriametrics.agentAuthPackage}/bin/swarm-logs-auth"
"--socket ${agentAuthSocket}"
"--store-cert-role swarm-metrics-auth"
"--verdict-ttl ${toString deployCfg.victoriametrics.agentAuthVerdictTtl}"