vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

docs: swarm services publish Grafana's /metrics to the collector

Browse source 
The gateway no longer has a loopback-only vhost, so the TLS section
drops the paragraph that named `grafana-metrics` as its one instance.
This commit is contained in:
atlas 2026-10-14 19:17:48 +02:00 • committed by mara
commit 8abea789fd
2 changed files with 5 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

2
docs/networking/gateway.md
View file

@ -52,8 +52,6 @@ The gateway always terminates TLS. Which certificate it serves depends on what y
`tls.certDir` together with `tls.acme.enable` fails an assertion — pick one.
⚠️ One vhost class has no TLS: a vhost bound to loopback for a local consumer. `grafana-metrics` (`nix/host-modules/swarm-grafana.nix`) is the one in the tree: it listens on `127.0.0.1` only and serves `= /metrics` from grafana's unix socket for this host's collector. The published `grafana.<swarm>` vhost answers `/metrics` with 403. Everything with a routable name follows the table above.
### ACME / Let's Encrypt (`tls.acme`)
The simplest production path for a public domain:

5
docs/swarm/services.md
View file

@ -180,6 +180,11 @@ collector's authelia client: authelia refuses any other session or client
there. It refuses every other path, the store's write and admin
API included, with 403. The bare domain redirects to vmui.
The collector scrapes Grafana's own metrics at
`https://<swarm.grafana.domain>/metrics`, so a collector on a host without
Grafana still gets them. The gateway admits only the collector's client to
that path; any other session gets `deny`.
The collector scrapes the store's own metrics the same way, at
`https://<swarm.victoriametrics.domain>/metrics`, so a collector on a host
that doesn't run the store still gets them. On this name the gateway admits