victorialogs and victoriametrics: own the package for each auth responder they run

docs/swarm/services.md

@@ -1,6 +1,7 @@
 | `deploy.victoriametrics.agentAuthRate` | Default `50r/s` per client address, for agent reads checked by `swarm-metrics-agent-auth`; over it and `agentAuthBurst`, the gateway answers 403. |
 | `deploy.victoriametrics.agentAuthBurst` | Default `500` requests above `agentAuthRate` before the 403s start. |
 | `deploy.victoriametrics.agentAuthVerdictTtl` | Default `60` seconds that `swarm-metrics-agent-auth` keeps granting an agent secret it verified. A replaced or deleted secret keeps working at the metrics store for up to that long. |
+| `deploy.victoriametrics.agentAuthPackage` | The `swarm-logs-auth` build that runs as `swarm-metrics-agent-auth`. Set on its own: `deploy.victorialogs.authPackage` doesn't reach it. |
 
 # Swarm-wide services
 
@@ -270,11 +271,12 @@ no setting here changes that, so Explore is the log browser for this
 swarm.
 
 | Option                                   | When you'd touch it                                                                                                                                                                                                                    |
-| ------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| ---------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
 | `deploy.victorialogs.retentionPeriod`    | Default `30d`, far shorter than the metrics store's — logs are bulkier per unit of value and are typically read within days of ingestion. Raise it if you need to answer questions about last quarter.                                 |
 | `deploy.victorialogs.authRate`           | Default `50r/s` per client address, for agent queries checked by `swarm-logs-auth`; over it and `authBurst`, the gateway answers 403. Agents on one host share the address; the default covers about a hundred cold-starting together. |
 | `deploy.victorialogs.authBurst`          | Default `500` requests above `authRate` before the 403s start.                                                                                                                                                                         |
 | `deploy.victorialogs.authVerdictTtl`     | Default `60` seconds that `swarm-logs-auth` keeps granting an agent secret it verified, without asking the secret store. A replaced or deleted secret keeps working at the log store for up to that long.                              |
+| `deploy.victorialogs.grafanaAuthPackage` | The `swarm-metrics-auth` build that runs as `swarm-logs-grafana-auth`. Set on its own: `deploy.victoriametrics.authPackage` doesn't reach it.                                                                                          |
 | `swarm.victorialogs.domain`              | Only to rename it.                                                                                                                                                                                                                     |
 | `swarm.victorialogs.port`                | Only if something else on the services host already claims `9428`.                                                                                                                                                                     |
 

flake.nix

@@ -156,6 +156,12 @@
               services.hyperhive.deploy.victoriametrics.authPackage =
                 lib.mkDefault
                   self.packages.${pkgs.stdenv.hostPlatform.system}.swarm-metrics-auth;
+              services.hyperhive.deploy.victorialogs.grafanaAuthPackage =
+                lib.mkDefault
+                  self.packages.${pkgs.stdenv.hostPlatform.system}.swarm-metrics-auth;
+              services.hyperhive.deploy.victoriametrics.agentAuthPackage =
+                lib.mkDefault
+                  self.packages.${pkgs.stdenv.hostPlatform.system}.swarm-logs-auth;
               services.hyperhive.deploy.nats.authPackage =
                 lib.mkDefault
                   self.packages.${pkgs.stdenv.hostPlatform.system}.swarm-nats-auth;

nix/host-modules/swarm-victorialogs.nix

@@ -152,6 +152,20 @@ in
     '';
   };
 
+  options.services.hyperhive.deploy.victorialogs.grafanaAuthPackage = lib.mkOption {
+    type = lib.types.package;
+    defaultText = lib.literalExpression "hyperhive.packages.\${system}.swarm-metrics-auth";
+    description = ''
+      The `swarm-metrics-auth` package, run as `swarm-logs-grafana-auth`: the
+      gateway's `auth_request` responder that checks the bearer Grafana's
+      logs datasource presents on `/select/logsql/` against the secret store.
+
+      ⚠️ Not folded into `authPackage` above: that one is `swarm-logs-auth`,
+      a different binary. Same split as
+      {option}`services.hyperhive.deploy.nats.authPackage`.
+    '';
+  };
+
   options.services.hyperhive.deploy.victorialogs.authBaoClientCertFile = lib.mkOption {
     type = lib.types.nullOr lib.types.str;
     default = null;
@@ -540,7 +554,7 @@ in
       ];
       serviceConfig = {
         ExecStart = lib.concatStringsSep " " [
-          "${deployCfg.victoriametrics.authPackage}/bin/swarm-metrics-auth"
+          "${deployCfg.victorialogs.grafanaAuthPackage}/bin/swarm-metrics-auth"
           "--socket ${grafanaAuthSocket}"
           "--store-cert-role swarm-logs-auth"
           "--store-path ${grafanaBearerStorePath}"

nix/host-modules/swarm-victoriametrics.nix

@@ -244,6 +244,21 @@ in
     '';
   };
 
+  options.services.hyperhive.deploy.victoriametrics.agentAuthPackage = lib.mkOption {
+    type = lib.types.package;
+    defaultText = lib.literalExpression "hyperhive.packages.\${system}.swarm-logs-auth";
+    description = ''
+      The `swarm-logs-auth` package, run as `swarm-metrics-agent-auth`: the
+      gateway's `auth_request` responder that checks an agent's
+      `swarm-agent.<agent>.<secret>` bearer on the read API against the
+      secret store.
+
+      ⚠️ Not folded into `authPackage` above: that one is
+      `swarm-metrics-auth`, a different binary. Same split as
+      {option}`services.hyperhive.deploy.nats.authPackage`.
+    '';
+  };
+
   options.services.hyperhive.deploy.victoriametrics.authBaoClientCertFile = lib.mkOption {
     type = lib.types.nullOr lib.types.str;
     default = null;
@@ -594,7 +609,7 @@ in
       ];
       serviceConfig = {
         ExecStart = lib.concatStringsSep " " [
-          "${deployCfg.victorialogs.authPackage}/bin/swarm-logs-auth"
+          "${deployCfg.victoriametrics.agentAuthPackage}/bin/swarm-logs-auth"
           "--socket ${agentAuthSocket}"
           "--store-cert-role swarm-metrics-auth"
           "--verdict-ttl ${toString deployCfg.victoriametrics.agentAuthVerdictTtl}"

nix/module-eval/core-toggle.nix

@@ -33,6 +33,12 @@ let
 
   bare = shared.bareWithController;
 
+  # `lib.hasInfix` matches by regex, which refuses a needle that refers to a
+  # store path. Both sides lose their string context here.
+  hasStorePath =
+    needle: hay:
+    lib.hasInfix (builtins.unsafeDiscardStringContext needle) (builtins.unsafeDiscardStringContext hay);
+
   # The same stub with the central toggle (`deploy.hive-controller.enable`)
   # off. Paired with `bare` below to pin the defaults that do not read it:
   # each is asserted to hold the SAME literal in both, so a future edit
@@ -723,6 +729,7 @@ let
           agentArm = "\"~^Bearer swarm-agent\\.\" /__metrics_agent_auth;";
           bearerArm = "\"~^Bearer \" /__metrics_grafana_auth;";
           v = allLocal.services.hyperhive.deploy.victoriametrics;
+          logs = allLocal.services.hyperhive.deploy.victorialogs;
           reads = lib.filterAttrs (n: _: lib.hasPrefix "= /api/v1/" n || lib.hasPrefix "^~ /api/v1/" n) l;
         in
         reads ? "= /api/v1/query_range"
@@ -745,7 +752,9 @@ let
         && lib.hasInfix "internal;" l."= /__metrics_agent_auth".extraConfig
         && l."= /__metrics_agent_auth".proxyPass == "http://unix:/run/swarm-metrics-agent-auth/auth.sock:/"
         && lib.hasInfix "--socket /run/swarm-metrics-agent-auth/auth.sock" agentUnit.serviceConfig.ExecStart
-        && lib.hasInfix "/bin/swarm-logs-auth " agentUnit.serviceConfig.ExecStart
+        && hasStorePath "${v.agentAuthPackage}/bin/swarm-logs-auth " agentUnit.serviceConfig.ExecStart
+        && !(hasStorePath "${logs.authPackage}" agentUnit.serviceConfig.ExecStart)
+        && hasStorePath "${v.authPackage}/bin/swarm-metrics-auth " unit.serviceConfig.ExecStart
         && lib.hasInfix "--store-cert-role swarm-metrics-auth" agentUnit.serviceConfig.ExecStart
         && lib.hasInfix "--verdict-ttl ${toString v.agentAuthVerdictTtl}" agentUnit.serviceConfig.ExecStart
         && agentUnit.serviceConfig.LoadCredential == unit.serviceConfig.LoadCredential
@@ -880,6 +889,8 @@ let
           http = allLocal.services.nginx.appendHttpConfig;
           unit = allLocal.systemd.services.swarm-logs-auth;
           grafanaUnit = allLocal.systemd.services.swarm-logs-grafana-auth;
+          logs = allLocal.services.hyperhive.deploy.victorialogs;
+          metrics = allLocal.services.hyperhive.deploy.victoriametrics;
         in
         lib.hasInfix "map \$http_authorization \$swarm_logs_auth_target" http
         && lib.hasInfix "\"~^Bearer swarm-agent\\.\" /__swarm_logs_agent_auth;" http
@@ -894,7 +905,9 @@ let
         &&
           l."= /__swarm_logs_grafana_auth".proxyPass == "http://unix:/run/swarm-logs-grafana-auth/auth.sock:/"
         && lib.hasInfix "--socket /run/swarm-logs-grafana-auth/auth.sock" grafanaUnit.serviceConfig.ExecStart
-        && lib.hasInfix "swarm-metrics-auth" grafanaUnit.serviceConfig.ExecStart
+        && hasStorePath "${logs.grafanaAuthPackage}/bin/swarm-metrics-auth " grafanaUnit.serviceConfig.ExecStart
+        && !(hasStorePath "${metrics.authPackage}" grafanaUnit.serviceConfig.ExecStart)
+        && hasStorePath "${logs.authPackage}/bin/swarm-logs-auth " unit.serviceConfig.ExecStart
         && lib.hasInfix "--store-cert-role swarm-logs-auth" grafanaUnit.serviceConfig.ExecStart
         && l ? "= /__hive_authelia";
     }

nix/module-eval/shared.nix

@@ -31,6 +31,10 @@ let
     agent
     agentWith
     ;
+
+  # The four auth responder packages pinned to four distinct derivations, so
+  # a unit's ExecStart names which option it read. Nothing else reads them.
+  marker = name: pkgs.runCommand "auth-marker-${name}" { } "mkdir $out";
 in
 {
   agentBare = agent { };
@@ -41,7 +45,13 @@ in
 
   bareWithController = hiveWithController { };
 
-  allLocal = hiveWithController { deploy.singleHostSwarm = true; };
+  allLocal = hiveWithController {
+    deploy.singleHostSwarm = true;
+    deploy.victorialogs.authPackage = marker "logs";
+    deploy.victorialogs.grafanaAuthPackage = marker "logs-grafana";
+    deploy.victoriametrics.authPackage = marker "metrics";
+    deploy.victoriametrics.agentAuthPackage = marker "metrics-agent";
+  };
 
   autheliaOnly = hive { deploy.authelia.enable = true; };