vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

keep each hive's otel oidc secret on /run, not /var/lib

Browse source
This commit is contained in:
atlas 2026-10-25 11:05:47 +01:00 • committed by mara
commit 96405621d7
7 changed files with 106 additions and 18 deletions
Download patch file Download diff file Expand all files Collapse all files

39
nix/module-eval/hive-otel.nix
View file

@ -26,10 +26,11 @@ let
# This hive's own collector, which is a HOST service — unlike the swarm
# tier's, which lives in a container and is read through `otelSettings`.
# The IdP is here too, with a hand-named secret file: the collector's wait
# for that file exists beside authelia's container.
# The IdP is here too, with its secret file named at the path the fetch
# unit used to write: the collector's wait for that file exists beside
# authelia's container.
hiveOtel = hiveWithController {
otel.clientSecretFile = "/var/lib/hive-otel-oidc/client.secret";
otel.clientSecretFile = "/var/lib/hive-otel-oidc/hive-h1.secret";
deploy.authelia.enable = true;
};
@ -239,6 +240,28 @@ let
&& builtins.elem "opentelemetry-collector.service" u.wantedBy
&& builtins.elem "opentelemetry-collector.service" u.before;
}
{
# The secret lives on tmpfs: an empty placeholder gives `LoadCredential`
# a source before the first fetch, and the copy the fetch used to leave
# on persistent disk is removed. The fixture naming that old path as
# its secret keeps it, and is warned that nothing refreshes it.
name = "the hive collector's fetched secret is an empty file on /run and the legacy file is removed";
ok =
let
run = "/run/hive-otel-oidc/hive-h1.secret";
legacy = "/var/lib/hive-otel-oidc/hive-h1.secret";
rules = m: m.systemd.tmpfiles.rules;
warned = m: lib.any (w: lib.hasInfix "swarm-bao-hive-otel-oidc.service used to write" w) m.warnings;
in
hiveOtelLeaf.services.hyperhive.otel.clientSecretFile == run
&& builtins.elem "d /run/hive-otel-oidc 0700 root root -" (rules hiveOtelLeaf)
&& builtins.elem "f ${run} 0400 root root -" (rules hiveOtelLeaf)
&& builtins.elem "r ${legacy}" (rules hiveOtelLeaf)
&& !(warned hiveOtelLeaf)
&& !(builtins.elem "r ${legacy}" (rules hiveOtel))
&& !(builtins.elem "f ${run} 0400 root root -" (rules hiveOtel))
&& warned hiveOtel;
}
{
# `LoadCredential` copies the file at the collector's start, so a value
# landed later reaches it only through a restart. Retries every 30s
@ -253,7 +276,7 @@ let
u.serviceConfig.Restart == "on-failure"
&& u.serviceConfig.RestartSec == 30
&& toString u.unitConfig.StartLimitBurst == "2880"
&& lib.hasInfix "refresh_unit opentelemetry-collector.service /var/lib/hive-otel-oidc/hive-h1.secret" s
&& lib.hasInfix "refresh_unit opentelemetry-collector.service /run/hive-otel-oidc/hive-h1.secret" s
&& lib.hasInfix "ActiveEnterTimestamp" s
&& lib.hasInfix ''if [ "$written_us" -le "$started_us" ]; then'' s;
}
@ -337,20 +360,20 @@ let
ok =
let
waitsFor =
machine:
file: machine:
let
c = machine.systemd.services.opentelemetry-collector;
w = machine.systemd.services.hive-otel-client-secret;
in
builtins.elem "hive-otel-client-secret.service" c.requires
&& builtins.elem "hive-otel-client-secret.service" c.after
&& lib.hasInfix "/var/lib/hive-otel-oidc/client.secret" w.script;
&& lib.hasInfix file w.script;
in
!(hiveOtel.systemd.services ? swarm-bao-hive-otel-oidc)
&& !(baoWithHiveOtel.systemd.services ? swarm-bao-hive-otel-oidc)
&& builtins.elem "swarm-client.secret:/var/lib/hive-otel-oidc/client.secret" baoWithHiveOtel.systemd.services.opentelemetry-collector.serviceConfig.LoadCredential
&& waitsFor hiveOtel
&& waitsFor baoWithHiveOtel;
&& waitsFor "/var/lib/hive-otel-oidc/hive-h1.secret" hiveOtel
&& waitsFor "/var/lib/hive-otel-oidc/client.secret" baoWithHiveOtel;
}
{
# ../host-modules/glue-hive-otel-authelia.nix orders the wait after