vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

deploy squid on every hive host, with exporter, journal forwarding and self-check

Browse source
This commit is contained in:
atlas 2026-10-27 15:09:00 +01:00 • committed by mara
commit a2cf6fe8bb
1 changed files with 589 additions and 9 deletions
Download patch file Download diff file Expand all files Collapse all files

66
nix/module-eval/hive-otel.nix
View file

@ -421,6 +421,72 @@ let
&& hiveOtelSettings.extensions ? file_storage
&& builtins.elem "file_storage" hiveOtelSettings.service.extensions;
}
{
# Squid rides this fixture because its journal and metrics reach the
# swarm through this collector. The allow-list of journal units must stay
# exactly the three named: hive-c0re's (control: the list is not just
# squid's), squid's and its self-check's.
name = "the hive collector forwards the journal of squid, its self-check and hive-c0re and no other unit";
ok =
lib.sort builtins.lessThan hiveOtelSettings.receivers.journald.units == [
"hive-c0re.service"
"squid-selfcheck.service"
"squid.service"
];
}
{
name = "the hive collector scrapes the squid exporter on loopback";
ok =
let
j = hiveScrapeJob "squid";
in
j != null
&& j.static_configs == [ { targets = [ "127.0.0.1:9301" ]; } ]
&& lib.hasInfix "-listen 127.0.0.1:9301" hiveOtel.systemd.services.squid-exporter.serviceConfig.ExecStart;
}
{
# Control for the absence checks: the bridge listener is there, so the
# absences below are not a misspelled lookup.
name = "squid listens on the bridge IP only, without a second listener or ssl_bump";
ok =
let
conf = hiveOtel.services.squid.configText;
lines = lib.splitString "\n" conf;
in
builtins.elem "http_port ${hiveOtel.services.hyperhive.network.bridgeIp}:3128" lines
&& lib.length (lib.filter (l: lib.hasPrefix "http_port " l) lines) == 1
&& !(lib.hasInfix "ssl_bump" conf)
&& !(lib.hasInfix "ssl-bump" conf)
&& !(lib.hasInfix "localnet" conf);
}
{
# First match wins, so a destination deny after the allow is dead.
name = "squid denies loopback, link-local and bridge destinations before any destination allow";
ok =
let
lines = lib.splitString "\n" hiveOtel.services.squid.configText;
at = l: lib.lists.findFirstIndex (x: x == l) null lines;
allow = at "http_access allow allowed_dst";
in
allow != null
&& at "http_access deny to_localhost" != null
&& at "http_access deny to_localhost" < allow
&& at "http_access deny to_linklocal" != null
&& at "http_access deny to_linklocal" < allow
&& at "http_access deny to_bridge" != null
&& at "http_access deny to_bridge" < allow
&& builtins.elem "cache deny all" lines
&& lib.last (lib.filter (l: l != "") lines) == "http_access deny all";
}
{
name = "squid's port is open on the bridge interface and on no other";
ok =
let
fw = hiveOtel.networking.firewall;
in
builtins.elem 3128 fw.interfaces.${hiveOtel.services.hyperhive.network.bridgeName}.allowedTCPPorts
&& !(builtins.elem 3128 fw.allowedTCPPorts);
}
];
in
runGroup "hive-otel" cases