vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

victorialogs and victoriametrics: own the package for each auth responder they run

Browse source
This commit is contained in:
atlas 2026-10-17 15:11:02 +02:00
commit 6f4b3562b7
6 changed files with 73 additions and 13 deletions
Download patch file Download diff file Expand all files Collapse all files

18
docs/swarm/services.md
View file

@ -1,6 +1,7 @@
| `deploy.victoriametrics.agentAuthRate` | Default `50r/s` per client address, for agent reads checked by `swarm-metrics-agent-auth`; over it and `agentAuthBurst`, the gateway answers 403. |
| `deploy.victoriametrics.agentAuthBurst` | Default `500` requests above `agentAuthRate` before the 403s start. |
| `deploy.victoriametrics.agentAuthVerdictTtl` | Default `60` seconds that `swarm-metrics-agent-auth` keeps granting an agent secret it verified. A replaced or deleted secret keeps working at the metrics store for up to that long. |
| `deploy.victoriametrics.agentAuthPackage` | The `swarm-logs-auth` build that runs as `swarm-metrics-agent-auth`. Set on its own: `deploy.victorialogs.authPackage` doesn't reach it. |
# Swarm-wide services
@ -269,14 +270,15 @@ Drilldown_ app is deliberately not installed: it only supports Loki, and
no setting here changes that, so Explore is the log browser for this
swarm.
| Option | When you'd touch it |
| ------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `deploy.victorialogs.retentionPeriod` | Default `30d`, far shorter than the metrics store's — logs are bulkier per unit of value and are typically read within days of ingestion. Raise it if you need to answer questions about last quarter. |
| `deploy.victorialogs.authRate` | Default `50r/s` per client address, for agent queries checked by `swarm-logs-auth`; over it and `authBurst`, the gateway answers 403. Agents on one host share the address; the default covers about a hundred cold-starting together. |
| `deploy.victorialogs.authBurst` | Default `500` requests above `authRate` before the 403s start. |
| `deploy.victorialogs.authVerdictTtl` | Default `60` seconds that `swarm-logs-auth` keeps granting an agent secret it verified, without asking the secret store. A replaced or deleted secret keeps working at the log store for up to that long. |
| `swarm.victorialogs.domain` | Only to rename it. |
| `swarm.victorialogs.port` | Only if something else on the services host already claims `9428`. |
| Option | When you'd touch it |
| ---------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `deploy.victorialogs.retentionPeriod` | Default `30d`, far shorter than the metrics store's — logs are bulkier per unit of value and are typically read within days of ingestion. Raise it if you need to answer questions about last quarter. |
| `deploy.victorialogs.authRate` | Default `50r/s` per client address, for agent queries checked by `swarm-logs-auth`; over it and `authBurst`, the gateway answers 403. Agents on one host share the address; the default covers about a hundred cold-starting together. |
| `deploy.victorialogs.authBurst` | Default `500` requests above `authRate` before the 403s start. |
| `deploy.victorialogs.authVerdictTtl` | Default `60` seconds that `swarm-logs-auth` keeps granting an agent secret it verified, without asking the secret store. A replaced or deleted secret keeps working at the log store for up to that long. |
| `deploy.victorialogs.grafanaAuthPackage` | The `swarm-metrics-auth` build that runs as `swarm-logs-grafana-auth`. Set on its own: `deploy.victoriametrics.authPackage` doesn't reach it. |
| `swarm.victorialogs.domain` | Only to rename it. |
| `swarm.victorialogs.port` | Only if something else on the services host already claims `9428`. |
It binds loopback and takes no credential of its own: the gateway vhost is
the only way in, and the collector is the only intended writer.

6
flake.nix
View file

@ -156,6 +156,12 @@
services.hyperhive.deploy.victoriametrics.authPackage =
lib.mkDefault
self.packages.${pkgs.stdenv.hostPlatform.system}.swarm-metrics-auth;
services.hyperhive.deploy.victorialogs.grafanaAuthPackage =
lib.mkDefault
self.packages.${pkgs.stdenv.hostPlatform.system}.swarm-metrics-auth;
services.hyperhive.deploy.victoriametrics.agentAuthPackage =
lib.mkDefault
self.packages.${pkgs.stdenv.hostPlatform.system}.swarm-logs-auth;
services.hyperhive.deploy.nats.authPackage =
lib.mkDefault
self.packages.${pkgs.stdenv.hostPlatform.system}.swarm-nats-auth;

16
nix/host-modules/swarm-victorialogs.nix
View file

@ -152,6 +152,20 @@ in
'';
};
options.services.hyperhive.deploy.victorialogs.grafanaAuthPackage = lib.mkOption {
type = lib.types.package;
defaultText = lib.literalExpression "hyperhive.packages.\${system}.swarm-metrics-auth";
description = ''
The `swarm-metrics-auth` package, run as `swarm-logs-grafana-auth`: the
gateway's `auth_request` responder that checks the bearer Grafana's
logs datasource presents on `/select/logsql/` against the secret store.
⚠️ Not folded into `authPackage` above: that one is `swarm-logs-auth`,
a different binary. Same split as
{option}`services.hyperhive.deploy.nats.authPackage`.
'';
};
options.services.hyperhive.deploy.victorialogs.authBaoClientCertFile = lib.mkOption {
type = lib.types.nullOr lib.types.str;
default = null;
@ -540,7 +554,7 @@ in
];
serviceConfig = {
ExecStart = lib.concatStringsSep " " [
"${deployCfg.victoriametrics.authPackage}/bin/swarm-metrics-auth"
"${deployCfg.victorialogs.grafanaAuthPackage}/bin/swarm-metrics-auth"
"--socket ${grafanaAuthSocket}"
"--store-cert-role swarm-logs-auth"
"--store-path ${grafanaBearerStorePath}"

17
nix/host-modules/swarm-victoriametrics.nix
View file

@ -244,6 +244,21 @@ in
'';
};
options.services.hyperhive.deploy.victoriametrics.agentAuthPackage = lib.mkOption {
type = lib.types.package;
defaultText = lib.literalExpression "hyperhive.packages.\${system}.swarm-logs-auth";
description = ''
The `swarm-logs-auth` package, run as `swarm-metrics-agent-auth`: the
gateway's `auth_request` responder that checks an agent's
`swarm-agent.<agent>.<secret>` bearer on the read API against the
secret store.
⚠️ Not folded into `authPackage` above: that one is
`swarm-metrics-auth`, a different binary. Same split as
{option}`services.hyperhive.deploy.nats.authPackage`.
'';
};
options.services.hyperhive.deploy.victoriametrics.authBaoClientCertFile = lib.mkOption {
type = lib.types.nullOr lib.types.str;
default = null;
@ -594,7 +609,7 @@ in
];
serviceConfig = {
ExecStart = lib.concatStringsSep " " [
"${deployCfg.victorialogs.authPackage}/bin/swarm-logs-auth"
"${deployCfg.victoriametrics.agentAuthPackage}/bin/swarm-logs-auth"
"--socket ${agentAuthSocket}"
"--store-cert-role swarm-metrics-auth"
"--verdict-ttl ${toString deployCfg.victoriametrics.agentAuthVerdictTtl}"

17
nix/module-eval/core-toggle.nix
View file

@ -33,6 +33,12 @@ let
bare = shared.bareWithController;
# `lib.hasInfix` matches by regex, which refuses a needle that refers to a
# store path. Both sides lose their string context here.
hasStorePath =
needle: hay:
lib.hasInfix (builtins.unsafeDiscardStringContext needle) (builtins.unsafeDiscardStringContext hay);
# The same stub with the central toggle (`deploy.hive-controller.enable`)
# off. Paired with `bare` below to pin the defaults that do not read it:
# each is asserted to hold the SAME literal in both, so a future edit
@ -723,6 +729,7 @@ let
agentArm = "\"~^Bearer swarm-agent\\.\" /__metrics_agent_auth;";
bearerArm = "\"~^Bearer \" /__metrics_grafana_auth;";
v = allLocal.services.hyperhive.deploy.victoriametrics;
logs = allLocal.services.hyperhive.deploy.victorialogs;
reads = lib.filterAttrs (n: _: lib.hasPrefix "= /api/v1/" n || lib.hasPrefix "^~ /api/v1/" n) l;
in
reads ? "= /api/v1/query_range"
@ -745,7 +752,9 @@ let
&& lib.hasInfix "internal;" l."= /__metrics_agent_auth".extraConfig
&& l."= /__metrics_agent_auth".proxyPass == "http://unix:/run/swarm-metrics-agent-auth/auth.sock:/"
&& lib.hasInfix "--socket /run/swarm-metrics-agent-auth/auth.sock" agentUnit.serviceConfig.ExecStart
&& lib.hasInfix "/bin/swarm-logs-auth " agentUnit.serviceConfig.ExecStart
&& hasStorePath "${v.agentAuthPackage}/bin/swarm-logs-auth " agentUnit.serviceConfig.ExecStart
&& !(hasStorePath "${logs.authPackage}" agentUnit.serviceConfig.ExecStart)
&& hasStorePath "${v.authPackage}/bin/swarm-metrics-auth " unit.serviceConfig.ExecStart
&& lib.hasInfix "--store-cert-role swarm-metrics-auth" agentUnit.serviceConfig.ExecStart
&& lib.hasInfix "--verdict-ttl ${toString v.agentAuthVerdictTtl}" agentUnit.serviceConfig.ExecStart
&& agentUnit.serviceConfig.LoadCredential == unit.serviceConfig.LoadCredential
@ -880,6 +889,8 @@ let
http = allLocal.services.nginx.appendHttpConfig;
unit = allLocal.systemd.services.swarm-logs-auth;
grafanaUnit = allLocal.systemd.services.swarm-logs-grafana-auth;
logs = allLocal.services.hyperhive.deploy.victorialogs;
metrics = allLocal.services.hyperhive.deploy.victoriametrics;
in
lib.hasInfix "map \$http_authorization \$swarm_logs_auth_target" http
&& lib.hasInfix "\"~^Bearer swarm-agent\\.\" /__swarm_logs_agent_auth;" http
@ -894,7 +905,9 @@ let
&&
l."= /__swarm_logs_grafana_auth".proxyPass == "http://unix:/run/swarm-logs-grafana-auth/auth.sock:/"
&& lib.hasInfix "--socket /run/swarm-logs-grafana-auth/auth.sock" grafanaUnit.serviceConfig.ExecStart
&& lib.hasInfix "swarm-metrics-auth" grafanaUnit.serviceConfig.ExecStart
&& hasStorePath "${logs.grafanaAuthPackage}/bin/swarm-metrics-auth " grafanaUnit.serviceConfig.ExecStart
&& !(hasStorePath "${metrics.authPackage}" grafanaUnit.serviceConfig.ExecStart)
&& hasStorePath "${logs.authPackage}/bin/swarm-logs-auth " unit.serviceConfig.ExecStart
&& lib.hasInfix "--store-cert-role swarm-logs-auth" grafanaUnit.serviceConfig.ExecStart
&& l ? "= /__hive_authelia";
}

12
nix/module-eval/shared.nix
View file

@ -31,6 +31,10 @@ let
agent
agentWith
;
# The four auth responder packages pinned to four distinct derivations, so
# a unit's ExecStart names which option it read. Nothing else reads them.
marker = name: pkgs.runCommand "auth-marker-${name}" { } "mkdir $out";
in
{
agentBare = agent { };
@ -41,7 +45,13 @@ in
bareWithController = hiveWithController { };
allLocal = hiveWithController { deploy.singleHostSwarm = true; };
allLocal = hiveWithController {
deploy.singleHostSwarm = true;
deploy.victorialogs.authPackage = marker "logs";
deploy.victorialogs.grafanaAuthPackage = marker "logs-grafana";
deploy.victoriametrics.authPackage = marker "metrics";
deploy.victoriametrics.agentAuthPackage = marker "metrics-agent";
};
autheliaOnly = hive { deploy.authelia.enable = true; };