vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

victorialogs and victoriametrics: own the package for each auth responder they run

Browse source
This commit is contained in:
atlas 2026-10-17 15:11:02 +02:00
commit 6f4b3562b7
6 changed files with 73 additions and 13 deletions
Download patch file Download diff file Expand all files Collapse all files

18
docs/swarm/services.md
View file

@ -1,6 +1,7 @@
| `deploy.victoriametrics.agentAuthRate` | Default `50r/s` per client address, for agent reads checked by `swarm-metrics-agent-auth`; over it and `agentAuthBurst`, the gateway answers 403. | | `deploy.victoriametrics.agentAuthRate` | Default `50r/s` per client address, for agent reads checked by `swarm-metrics-agent-auth`; over it and `agentAuthBurst`, the gateway answers 403. |
| `deploy.victoriametrics.agentAuthBurst` | Default `500` requests above `agentAuthRate` before the 403s start. | | `deploy.victoriametrics.agentAuthBurst` | Default `500` requests above `agentAuthRate` before the 403s start. |
| `deploy.victoriametrics.agentAuthVerdictTtl` | Default `60` seconds that `swarm-metrics-agent-auth` keeps granting an agent secret it verified. A replaced or deleted secret keeps working at the metrics store for up to that long. | | `deploy.victoriametrics.agentAuthVerdictTtl` | Default `60` seconds that `swarm-metrics-agent-auth` keeps granting an agent secret it verified. A replaced or deleted secret keeps working at the metrics store for up to that long. |
| `deploy.victoriametrics.agentAuthPackage` | The `swarm-logs-auth` build that runs as `swarm-metrics-agent-auth`. Set on its own: `deploy.victorialogs.authPackage` doesn't reach it. |
# Swarm-wide services # Swarm-wide services
@ -269,14 +270,15 @@ Drilldown_ app is deliberately not installed: it only supports Loki, and
no setting here changes that, so Explore is the log browser for this no setting here changes that, so Explore is the log browser for this
swarm. swarm.
| Option | When you'd touch it | | Option | When you'd touch it |
| ------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | ---------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `deploy.victorialogs.retentionPeriod` | Default `30d`, far shorter than the metrics store's — logs are bulkier per unit of value and are typically read within days of ingestion. Raise it if you need to answer questions about last quarter. | | `deploy.victorialogs.retentionPeriod` | Default `30d`, far shorter than the metrics store's — logs are bulkier per unit of value and are typically read within days of ingestion. Raise it if you need to answer questions about last quarter. |
| `deploy.victorialogs.authRate` | Default `50r/s` per client address, for agent queries checked by `swarm-logs-auth`; over it and `authBurst`, the gateway answers 403. Agents on one host share the address; the default covers about a hundred cold-starting together. | | `deploy.victorialogs.authRate` | Default `50r/s` per client address, for agent queries checked by `swarm-logs-auth`; over it and `authBurst`, the gateway answers 403. Agents on one host share the address; the default covers about a hundred cold-starting together. |
| `deploy.victorialogs.authBurst` | Default `500` requests above `authRate` before the 403s start. | | `deploy.victorialogs.authBurst` | Default `500` requests above `authRate` before the 403s start. |
| `deploy.victorialogs.authVerdictTtl` | Default `60` seconds that `swarm-logs-auth` keeps granting an agent secret it verified, without asking the secret store. A replaced or deleted secret keeps working at the log store for up to that long. | | `deploy.victorialogs.authVerdictTtl` | Default `60` seconds that `swarm-logs-auth` keeps granting an agent secret it verified, without asking the secret store. A replaced or deleted secret keeps working at the log store for up to that long. |
| `swarm.victorialogs.domain` | Only to rename it. | | `deploy.victorialogs.grafanaAuthPackage` | The `swarm-metrics-auth` build that runs as `swarm-logs-grafana-auth`. Set on its own: `deploy.victoriametrics.authPackage` doesn't reach it. |
| `swarm.victorialogs.port` | Only if something else on the services host already claims `9428`. | | `swarm.victorialogs.domain` | Only to rename it. |
| `swarm.victorialogs.port` | Only if something else on the services host already claims `9428`. |
It binds loopback and takes no credential of its own: the gateway vhost is It binds loopback and takes no credential of its own: the gateway vhost is
the only way in, and the collector is the only intended writer. the only way in, and the collector is the only intended writer.

6
flake.nix
View file

@ -156,6 +156,12 @@
services.hyperhive.deploy.victoriametrics.authPackage = services.hyperhive.deploy.victoriametrics.authPackage =
lib.mkDefault lib.mkDefault
self.packages.${pkgs.stdenv.hostPlatform.system}.swarm-metrics-auth; self.packages.${pkgs.stdenv.hostPlatform.system}.swarm-metrics-auth;
services.hyperhive.deploy.victorialogs.grafanaAuthPackage =
lib.mkDefault
self.packages.${pkgs.stdenv.hostPlatform.system}.swarm-metrics-auth;
services.hyperhive.deploy.victoriametrics.agentAuthPackage =
lib.mkDefault
self.packages.${pkgs.stdenv.hostPlatform.system}.swarm-logs-auth;
services.hyperhive.deploy.nats.authPackage = services.hyperhive.deploy.nats.authPackage =
lib.mkDefault lib.mkDefault
self.packages.${pkgs.stdenv.hostPlatform.system}.swarm-nats-auth; self.packages.${pkgs.stdenv.hostPlatform.system}.swarm-nats-auth;

16
nix/host-modules/swarm-victorialogs.nix
View file

@ -152,6 +152,20 @@ in
''; '';
}; };
options.services.hyperhive.deploy.victorialogs.grafanaAuthPackage = lib.mkOption {
type = lib.types.package;
defaultText = lib.literalExpression "hyperhive.packages.\${system}.swarm-metrics-auth";
description = ''
The `swarm-metrics-auth` package, run as `swarm-logs-grafana-auth`: the
gateway's `auth_request` responder that checks the bearer Grafana's
logs datasource presents on `/select/logsql/` against the secret store.
⚠️ Not folded into `authPackage` above: that one is `swarm-logs-auth`,
a different binary. Same split as
{option}`services.hyperhive.deploy.nats.authPackage`.
'';
};
options.services.hyperhive.deploy.victorialogs.authBaoClientCertFile = lib.mkOption { options.services.hyperhive.deploy.victorialogs.authBaoClientCertFile = lib.mkOption {
type = lib.types.nullOr lib.types.str; type = lib.types.nullOr lib.types.str;
default = null; default = null;
@ -540,7 +554,7 @@ in
]; ];
serviceConfig = { serviceConfig = {
ExecStart = lib.concatStringsSep " " [ ExecStart = lib.concatStringsSep " " [
"${deployCfg.victoriametrics.authPackage}/bin/swarm-metrics-auth" "${deployCfg.victorialogs.grafanaAuthPackage}/bin/swarm-metrics-auth"
"--socket ${grafanaAuthSocket}" "--socket ${grafanaAuthSocket}"
"--store-cert-role swarm-logs-auth" "--store-cert-role swarm-logs-auth"
"--store-path ${grafanaBearerStorePath}" "--store-path ${grafanaBearerStorePath}"

17
nix/host-modules/swarm-victoriametrics.nix
View file

@ -244,6 +244,21 @@ in
''; '';
}; };
options.services.hyperhive.deploy.victoriametrics.agentAuthPackage = lib.mkOption {
type = lib.types.package;
defaultText = lib.literalExpression "hyperhive.packages.\${system}.swarm-logs-auth";
description = ''
The `swarm-logs-auth` package, run as `swarm-metrics-agent-auth`: the
gateway's `auth_request` responder that checks an agent's
`swarm-agent.<agent>.<secret>` bearer on the read API against the
secret store.
⚠️ Not folded into `authPackage` above: that one is
`swarm-metrics-auth`, a different binary. Same split as
{option}`services.hyperhive.deploy.nats.authPackage`.
'';
};
options.services.hyperhive.deploy.victoriametrics.authBaoClientCertFile = lib.mkOption { options.services.hyperhive.deploy.victoriametrics.authBaoClientCertFile = lib.mkOption {
type = lib.types.nullOr lib.types.str; type = lib.types.nullOr lib.types.str;
default = null; default = null;
@ -594,7 +609,7 @@ in
]; ];
serviceConfig = { serviceConfig = {
ExecStart = lib.concatStringsSep " " [ ExecStart = lib.concatStringsSep " " [
"${deployCfg.victorialogs.authPackage}/bin/swarm-logs-auth" "${deployCfg.victoriametrics.agentAuthPackage}/bin/swarm-logs-auth"
"--socket ${agentAuthSocket}" "--socket ${agentAuthSocket}"
"--store-cert-role swarm-metrics-auth" "--store-cert-role swarm-metrics-auth"
"--verdict-ttl ${toString deployCfg.victoriametrics.agentAuthVerdictTtl}" "--verdict-ttl ${toString deployCfg.victoriametrics.agentAuthVerdictTtl}"

17
nix/module-eval/core-toggle.nix
View file

@ -33,6 +33,12 @@ let
bare = shared.bareWithController; bare = shared.bareWithController;
# `lib.hasInfix` matches by regex, which refuses a needle that refers to a
# store path. Both sides lose their string context here.
hasStorePath =
needle: hay:
lib.hasInfix (builtins.unsafeDiscardStringContext needle) (builtins.unsafeDiscardStringContext hay);
# The same stub with the central toggle (`deploy.hive-controller.enable`) # The same stub with the central toggle (`deploy.hive-controller.enable`)
# off. Paired with `bare` below to pin the defaults that do not read it: # off. Paired with `bare` below to pin the defaults that do not read it:
# each is asserted to hold the SAME literal in both, so a future edit # each is asserted to hold the SAME literal in both, so a future edit
@ -723,6 +729,7 @@ let
agentArm = "\"~^Bearer swarm-agent\\.\" /__metrics_agent_auth;"; agentArm = "\"~^Bearer swarm-agent\\.\" /__metrics_agent_auth;";
bearerArm = "\"~^Bearer \" /__metrics_grafana_auth;"; bearerArm = "\"~^Bearer \" /__metrics_grafana_auth;";
v = allLocal.services.hyperhive.deploy.victoriametrics; v = allLocal.services.hyperhive.deploy.victoriametrics;
logs = allLocal.services.hyperhive.deploy.victorialogs;
reads = lib.filterAttrs (n: _: lib.hasPrefix "= /api/v1/" n || lib.hasPrefix "^~ /api/v1/" n) l; reads = lib.filterAttrs (n: _: lib.hasPrefix "= /api/v1/" n || lib.hasPrefix "^~ /api/v1/" n) l;
in in
reads ? "= /api/v1/query_range" reads ? "= /api/v1/query_range"
@ -745,7 +752,9 @@ let
&& lib.hasInfix "internal;" l."= /__metrics_agent_auth".extraConfig && lib.hasInfix "internal;" l."= /__metrics_agent_auth".extraConfig
&& l."= /__metrics_agent_auth".proxyPass == "http://unix:/run/swarm-metrics-agent-auth/auth.sock:/" && l."= /__metrics_agent_auth".proxyPass == "http://unix:/run/swarm-metrics-agent-auth/auth.sock:/"
&& lib.hasInfix "--socket /run/swarm-metrics-agent-auth/auth.sock" agentUnit.serviceConfig.ExecStart && lib.hasInfix "--socket /run/swarm-metrics-agent-auth/auth.sock" agentUnit.serviceConfig.ExecStart
&& lib.hasInfix "/bin/swarm-logs-auth " agentUnit.serviceConfig.ExecStart && hasStorePath "${v.agentAuthPackage}/bin/swarm-logs-auth " agentUnit.serviceConfig.ExecStart
&& !(hasStorePath "${logs.authPackage}" agentUnit.serviceConfig.ExecStart)
&& hasStorePath "${v.authPackage}/bin/swarm-metrics-auth " unit.serviceConfig.ExecStart
&& lib.hasInfix "--store-cert-role swarm-metrics-auth" agentUnit.serviceConfig.ExecStart && lib.hasInfix "--store-cert-role swarm-metrics-auth" agentUnit.serviceConfig.ExecStart
&& lib.hasInfix "--verdict-ttl ${toString v.agentAuthVerdictTtl}" agentUnit.serviceConfig.ExecStart && lib.hasInfix "--verdict-ttl ${toString v.agentAuthVerdictTtl}" agentUnit.serviceConfig.ExecStart
&& agentUnit.serviceConfig.LoadCredential == unit.serviceConfig.LoadCredential && agentUnit.serviceConfig.LoadCredential == unit.serviceConfig.LoadCredential
@ -880,6 +889,8 @@ let
http = allLocal.services.nginx.appendHttpConfig; http = allLocal.services.nginx.appendHttpConfig;
unit = allLocal.systemd.services.swarm-logs-auth; unit = allLocal.systemd.services.swarm-logs-auth;
grafanaUnit = allLocal.systemd.services.swarm-logs-grafana-auth; grafanaUnit = allLocal.systemd.services.swarm-logs-grafana-auth;
logs = allLocal.services.hyperhive.deploy.victorialogs;
metrics = allLocal.services.hyperhive.deploy.victoriametrics;
in in
lib.hasInfix "map \$http_authorization \$swarm_logs_auth_target" http lib.hasInfix "map \$http_authorization \$swarm_logs_auth_target" http
&& lib.hasInfix "\"~^Bearer swarm-agent\\.\" /__swarm_logs_agent_auth;" http && lib.hasInfix "\"~^Bearer swarm-agent\\.\" /__swarm_logs_agent_auth;" http
@ -894,7 +905,9 @@ let
&& &&
l."= /__swarm_logs_grafana_auth".proxyPass == "http://unix:/run/swarm-logs-grafana-auth/auth.sock:/" l."= /__swarm_logs_grafana_auth".proxyPass == "http://unix:/run/swarm-logs-grafana-auth/auth.sock:/"
&& lib.hasInfix "--socket /run/swarm-logs-grafana-auth/auth.sock" grafanaUnit.serviceConfig.ExecStart && lib.hasInfix "--socket /run/swarm-logs-grafana-auth/auth.sock" grafanaUnit.serviceConfig.ExecStart
&& lib.hasInfix "swarm-metrics-auth" grafanaUnit.serviceConfig.ExecStart && hasStorePath "${logs.grafanaAuthPackage}/bin/swarm-metrics-auth " grafanaUnit.serviceConfig.ExecStart
&& !(hasStorePath "${metrics.authPackage}" grafanaUnit.serviceConfig.ExecStart)
&& hasStorePath "${logs.authPackage}/bin/swarm-logs-auth " unit.serviceConfig.ExecStart
&& lib.hasInfix "--store-cert-role swarm-logs-auth" grafanaUnit.serviceConfig.ExecStart && lib.hasInfix "--store-cert-role swarm-logs-auth" grafanaUnit.serviceConfig.ExecStart
&& l ? "= /__hive_authelia"; && l ? "= /__hive_authelia";
} }

12
nix/module-eval/shared.nix
View file

@ -31,6 +31,10 @@ let
agent agent
agentWith agentWith
; ;
# The four auth responder packages pinned to four distinct derivations, so
# a unit's ExecStart names which option it read. Nothing else reads them.
marker = name: pkgs.runCommand "auth-marker-${name}" { } "mkdir $out";
in in
{ {
agentBare = agent { }; agentBare = agent { };
@ -41,7 +45,13 @@ in
bareWithController = hiveWithController { }; bareWithController = hiveWithController { };
allLocal = hiveWithController { deploy.singleHostSwarm = true; }; allLocal = hiveWithController {
deploy.singleHostSwarm = true;
deploy.victorialogs.authPackage = marker "logs";
deploy.victorialogs.grafanaAuthPackage = marker "logs-grafana";
deploy.victoriametrics.authPackage = marker "metrics";
deploy.victoriametrics.agentAuthPackage = marker "metrics-agent";
};
autheliaOnly = hive { deploy.authelia.enable = true; }; autheliaOnly = hive { deploy.authelia.enable = true; };