vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

forward the attic container's journal to the swarm collector

Browse source
This commit is contained in:
atlas 2026-10-27 15:22:55 +01:00
commit a572fb6a7f
3 changed files with 230 additions and 21 deletions
Download patch file Download diff file Expand all files Collapse all files

11
nix/module-eval/bao-grants.nix
View file

@ -1980,9 +1980,10 @@ let
}
{
# The cache's host units create each of its three secrets and read them
# back, and may not replace one: no `update`. The notification router's
# grant is the control that `grantsIn` reads a one-path grant too.
name = "the cache's grant is create and read on its signing key and its two tokens, and nothing else";
# back, and may not replace one: no `update`. Its container's journal
# forwarder reads its own client secret, read only. The notification
# router's grant is the control that `grantsIn` reads a one-path grant too.
name = "the cache's grant is create and read on its signing key and its two tokens, read on its forwarder client, and nothing else";
ok =
let
s = baoGrantHere.systemd.services.swarm-bao-attic-policy.script;
@ -1995,7 +1996,9 @@ let
(grantFor grants "secret/data/swarm/services/attic/jwt-secret").caps == caps
&& (grantFor grants "secret/data/swarm/services/attic/push-token").caps == caps
&& (grantFor grants "secret/data/swarm/services/attic/pull-token").caps == caps
&& lib.length grants == 3
&&
(grantFor grants "secret/data/swarm/services/swarm-attic-collector/oidc/client").caps == [ "read" ]
&& lib.length grants == 4
&& lib.length (grantsIn baoGrantHere.systemd.services.swarm-bao-notify-router-policy.script) == 1
&& lib.hasInfix "auth/cert/certs/swarm-attic" s
&& lib.hasInfix "allowed_common_names=swarm-attic" s

30
nix/module-eval/builder.nix
View file

@ -385,6 +385,36 @@ let
&& lib.hasInfix "--mode monolithic" atticUnit.serviceConfig.ExecStart
&& atticDeploy.retentionPeriod == "14 days";
}
{
# atticd's journal reaches the swarm collector through the container's own
# forwarder, under the cache's store leaf. The host with the switch forced
# off is the control that nothing of it renders there, and `atticHere`
# that the same lookups find it where the cache runs.
name = "the cache's container forwards its journal to the swarm collector as its own client, and only where the cache runs";
ok =
let
inner = atticHere.containers.swarm-attic;
f = inner.config.services.hyperhive.swarmJournalForwarder;
fetch = inner.config.systemd.services.swarm-journal-forwarder-oidc;
collector = inner.config.systemd.services.opentelemetry-collector;
in
f.enable
&& f.serviceName == "attic"
&& f.clientId == "swarm-attic-collector"
&& f.endpoint == "https://${atticHere.services.hyperhive.swarm.otel.domain}/swarm-attic"
&& f.store.secretPath == "secret/swarm/services/swarm-attic-collector/oidc/client"
&& f.store.clientCertFile == "/run/credentials/swarm-journal-forwarder-oidc.service/attic-bao-cert"
&& lib.elem "attic-bao-key" fetch.serviceConfig.LoadCredential
&& lib.elem "--load-credential=attic-bao-cert:/var/lib/swarm-bao-pki/attic.pem" inner.extraFlags
&& !(lib.elem "--link-journal=host" inner.extraFlags)
&& collector.enable
&&
atticHere.services.hyperhive.swarm.otel.serviceProducers.swarm-attic.clientId
== "swarm-attic-collector"
&& lib.hasInfix "services/swarm-attic-collector/oidc/client" atticHere.systemd.services.swarm-bao-attic-policy.script
&& !(atticExternal.containers ? swarm-attic)
&& atticExternal.services.hyperhive.swarm.otel.serviceProducers ? swarm-attic;
}
{
# attic checks its own tokens and a nix client cannot follow a login
# redirect, so the vhost carries no `auth_request`; the tokens ride in a

3
nix/module-eval/secret-publisher.nix
View file

@ -221,7 +221,7 @@ let
# The forwarders in the CI runner's, Grafana's, the log store's, the
# forge's, the homeserver's and authelia's containers read their secrets
# from these paths, and the metrics store's host reads its container's.
name = "the publisher carries the CI runner, Grafana, log store, forge, homeserver, metrics store and authelia forwarders' secrets";
name = "the publisher carries the CI runner, Grafana, log store, cache, forge, homeserver, metrics store and authelia forwarders' secrets";
ok =
lib.all
(
@ -238,6 +238,7 @@ let
"swarm-matrix-collector"
"swarm-victoriametrics-collector"
"swarm-authelia-collector"
"swarm-attic-collector"
];
}
{