From b66a09f65bd46a4bc1cd098dd4c7caafa03a420d Mon Sep 17 00:00:00 2001 From: atlas Date: Fri, 16 Oct 2026 02:36:33 +0200 Subject: [PATCH] otel: finish the agent collector name in option and network docs The otel enable description and the exposeHostPorts example in network.md still described agents dialing a bridge address. Rewrap the two long lines the earlier edit left. --- docs/networking/network.md | 14 ++++++++------ docs/scheduler/observability.md | 11 ++++++----- nix/host-modules/otel.nix | 6 ++++-- 3 files changed, 18 insertions(+), 13 deletions(-) diff --git a/docs/networking/network.md b/docs/networking/network.md index 3fd990d8..e6546918 100644 --- a/docs/networking/network.md +++ b/docs/networking/network.md @@ -119,10 +119,10 @@ plus whatever swarm-service names this host contributes via (matrix) when this host runs those services, `auth.` when it runs authelia, and `hive-collector.` on every hive with `otel.enable` — answering each with the bridge IP (where nginx -is reachable, and where the hive's own collector listens). Note forge and matrix are swarm-domain names, not -sub-domains of ``: a swarm runs one forge and one -homeserver, so their names belong to the swarm rather than to whichever -hive happens to host them. dnsmasq forwards everything else to the host's +is reachable, and where the hive's own collector listens). Note forge and +matrix are swarm-domain names, not sub-domains of ``: a swarm +runs one forge and one homeserver, so their names belong to the swarm rather +than to whichever hive happens to host them. dnsmasq forwards everything else to the host's own resolvers: it runs on the host and reads the host's `/etc/resolv.conf` directly. Containers don't need to know the upstream — they query the bridge IP and dnsmasq does the right thing @@ -188,8 +188,10 @@ that `otel.endpoint` is the _upstream_, which no agent ever dials. See `services.hyperhive.network.exposeHostPorts = [ 4318 ];` opens each listed TCP port `P` on the bridge-interface `allowedTCPPorts`, so an -agent can connect to `:P` (point the collector endpoint at -`http://:4318`, default `http://10.42.0.1:4318`). +agent can connect to `:P` (for a dev OTLP collector, point its +endpoint at `http://:4318`, default `http://10.42.0.1:4318`). +The hive's own collector needs none of this: agents dial it by +`otel.collector.host`. diff --git a/docs/scheduler/observability.md b/docs/scheduler/observability.md index 52ed90ce..c57328cb 100644 --- a/docs/scheduler/observability.md +++ b/docs/scheduler/observability.md @@ -41,11 +41,12 @@ destination in its own right. With both, telemetry goes to both. See **Telemetry leaves a hive exactly one way: through the collector that `enable` starts on the host.** Agents never talk to `endpoint` themselves — -they export unauthenticated to a bridge address only their own containers can -reach. They dial it as `http://hive-collector.:`, -a name identical on every hive, which each hive's own dnsmasq -answers with its bridge IP, so an agent's build carries no hive-specific -address. The otel module opens that port on the bridge itself. That collector forwards to the swarm's +they export unauthenticated to a collector address only their own containers +can reach. They dial it as +`http://hive-collector.:`, a name identical on +every hive, which each hive's own dnsmasq answers with its bridge IP, so an +agent's build carries no hive-specific address. The otel module opens that +port on the bridge itself. That collector forwards to the swarm's ([`swarm/services.md`](../swarm/services.md#telemetry-collector-otel)), the single process holding the upstream credential and the only writer to the swarm's stores. No agent holds a copy, and neither does the hive. diff --git a/nix/host-modules/otel.nix b/nix/host-modules/otel.nix index 0550ede6..df609ea0 100644 --- a/nix/host-modules/otel.nix +++ b/nix/host-modules/otel.nix @@ -67,8 +67,10 @@ in Enabling this also runs this hive's collector on the host: there is exactly one way telemetry leaves this hive, and it is through that - collector. Agents export unauthenticated to a bridge address only - their own containers can reach. + collector. Agents export unauthenticated to + {option}`services.hyperhive.otel.collector.host`, a name this hive's + resolver answers with a bridge address only its own containers can + reach. That collector forwards to the swarm's ({option}`services.hyperhive.deploy.swarm-otel.enable`), which holds the