vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

victorialogs and victoriametrics: own the package for each auth responder they run

Browse source
This commit is contained in:
atlas 2026-10-17 15:11:02 +02:00
commit 6f4b3562b7
6 changed files with 73 additions and 13 deletions
Download patch file Download diff file Expand all files Collapse all files

17
nix/host-modules/swarm-victoriametrics.nix
View file

@ -244,6 +244,21 @@ in
'';
};
options.services.hyperhive.deploy.victoriametrics.agentAuthPackage = lib.mkOption {
type = lib.types.package;
defaultText = lib.literalExpression "hyperhive.packages.\${system}.swarm-logs-auth";
description = ''
The `swarm-logs-auth` package, run as `swarm-metrics-agent-auth`: the
gateway's `auth_request` responder that checks an agent's
`swarm-agent.<agent>.<secret>` bearer on the read API against the
secret store.
⚠️ Not folded into `authPackage` above: that one is
`swarm-metrics-auth`, a different binary. Same split as
{option}`services.hyperhive.deploy.nats.authPackage`.
'';
};
options.services.hyperhive.deploy.victoriametrics.authBaoClientCertFile = lib.mkOption {
type = lib.types.nullOr lib.types.str;
default = null;
@ -594,7 +609,7 @@ in
];
serviceConfig = {
ExecStart = lib.concatStringsSep " " [
"${deployCfg.victorialogs.authPackage}/bin/swarm-logs-auth"
"${deployCfg.victoriametrics.agentAuthPackage}/bin/swarm-logs-auth"
"--socket ${agentAuthSocket}"
"--store-cert-role swarm-metrics-auth"
"--verdict-ttl ${toString deployCfg.victoriametrics.agentAuthVerdictTtl}"