vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

glue: otel scrape targets for authelia, grafana and nats move out of the services

Browse source 
Part of #3742.
This commit is contained in:
atlas 2026-10-13 08:33:28 +02:00 • committed by mara
commit c06aa78b63
9 changed files with 68 additions and 64 deletions
Download patch file Download diff file Expand all files Collapse all files

11
nix/module-eval/forge-placement.nix
View file

@ -137,6 +137,17 @@ let
&& !(lib.elem "forge.t.local" bare.services.hyperhive.gateway.localNames)
&& !(refusedOver bare "deploy.forgejo.sso.clientSecretFile");
}
{
name = "a host running the collector and authelia, grafana and nats scrapes all three on loopback";
ok =
let
t = servicesHere.services.hyperhive.swarm.otel.scrapeTargets;
port = n: toString servicesHere.services.hyperhive.swarm.${n}.metricsPort;
in
t.authelia == "127.0.0.1:${port "authelia"}"
&& t.grafana == "127.0.0.1:${port "grafana"}"
&& t.nats == "127.0.0.1:${port "nats"}";
}
{
name = "hosting the swarm's shared services runs the forge";
ok = runsForge servicesHere;

6
nix/module-eval/grafana.nix
View file

@ -109,6 +109,12 @@ let
&& lib.hasInfix option a.message
) m.assertions;
cases = [
{
name = "grafana declares no scrape target on a host with no collector";
ok =
!(grafanaOldPath.services.hyperhive.deploy.swarm-otel.enable)
&& !(grafanaOldPath.services.hyperhive.swarm.otel.scrapeTargets ? grafana);
}
{
# The socket's directory is its access control, so it must stay dedicated
# to this one socket. `readOnly` is what makes that inexpressible: a

7
nix/module-eval/nats-authelia.nix
View file

@ -99,6 +99,13 @@ let
autheliaColocated = shared.autheliaOnly;
cases = [
{
name = "authelia and nats declare no scrape target on a host with no collector";
ok =
!(autheliaOldPath.services.hyperhive.deploy.swarm-otel.enable)
&& !(autheliaOldPath.services.hyperhive.swarm.otel.scrapeTargets ? authelia)
&& !(autheliaOldPath.services.hyperhive.swarm.otel.scrapeTargets ? nats);
}
{
# The xkey and the responder's OIDC client secret are read only from
# the store, so a queue with no responder leaf cannot start. Refused at