vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix(#1930): headersCredential str type (no nix-store copy) + route traces to otlp

Browse source
This commit is contained in:
damocles 2026-06-23 13:44:51 +02:00 • committed by mara
commit 9ee5a94d50
1 changed files with 14 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

19
nix/templates/harness-base.nix
View file

@ -207,17 +207,23 @@ in
};
headersCredential = lib.mkOption {
type = lib.types.nullOr lib.types.path;
# `str`, not `path`: a `path`-typed *relative* literal (e.g.
# `./otel-headers`) is hash-copied into the world-readable nix store
# at eval time, which would defeat the whole point of this option.
# Keep it a string and require an absolute runtime path so the secret
# is only ever read from disk by systemd at start, never nix-stored.
type = lib.types.nullOr lib.types.str;
default = null;
example = "/run/secrets/otel-headers";
description = ''
Path to an operator-provided secret file whose contents become
`OTEL_EXPORTER_OTLP_HEADERS` (e.g.
Absolute path to an operator-provided secret file whose contents
become `OTEL_EXPORTER_OTLP_HEADERS` (e.g.
`Authorization=Bearer <token>`). Loaded via systemd
`LoadCredential` into the unit-private credential store at
runtime, so the token is never copied into the nix store or
exposed in the process argv. Leave null if the endpoint needs no
auth header.
exposed in the process argv. Must be an absolute path (systemd
`LoadCredential` requires one). Leave null if the endpoint needs
no auth header.
'';
};
@ -1712,6 +1718,9 @@ in
CLAUDE_CODE_ENABLE_TELEMETRY = "1";
OTEL_METRICS_EXPORTER = "otlp";
OTEL_LOGS_EXPORTER = "otlp";
# Route traces to OTLP too so any spans Claude Code emits land
# at the configured collector rather than a default exporter.
OTEL_TRACES_EXPORTER = "otlp";
OTEL_EXPORTER_OTLP_PROTOCOL = otel.protocol;
OTEL_EXPORTER_OTLP_ENDPOINT = otel.endpoint;
};