vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(#3125): reshape the hive-to-swarm OTEL hop by domain

Browse source 
Drops swarm.otel.url (a loopback default an operator had to override on a
split host) in favor of swarm.otel.domain -- the same
gateway.localNames + nginx-vhost-through-the-gateway shape every other
swarm service (authelia, grafana, victoriametrics, ui) already uses. The
hive tier's exporter now reaches it as https://<domain> unconditionally,
resolved locally by dnsmasq on a co-located host and over the real network
otherwise, instead of a config knob nobody sets until they hit the silent
drop.

Costs CA trust on the hive tier: otel.nix wires
lib/hive-ca-trust.nix's trustBundle with hostUnit = true on the
opentelemetry-collector host unit, the same flag #3441/#3442 added for
swarm-controller and hive-c0re.

mara, #3125 comment 58363: "go c".
This commit is contained in:
atlas 2026-08-18 20:45:13 +02:00 • committed by mara
commit d2fb4bff79
5 changed files with 96 additions and 37 deletions
Download patch file Download diff file Expand all files Collapse all files

15
docs/observability.md
View file

@ -30,16 +30,11 @@ reach. That collector forwards to the swarm's
the single process holding the upstream credential and the only writer to the
swarm's store. No agent holds a copy, and neither does this hive.
⚠️ **On a hive that does not run the swarm's services, say where that swarm
collector is:**
```nix
services.hyperhive.swarm.otel.url = "http://services-host.example:4319";
```
Left unset it points at this host, where nothing is listening — the collector
starts, agents export happily, and the samples go nowhere. The service host
itself needs no such line.
The hive collector reaches the swarm collector by its gateway name
(`swarm.otel.domain`, default `otel.<swarm domain>`) — the same DNS-and-CA-trust
shape every hive-to-swarm-service hop uses, not a URL an operator has to point
anywhere. A hive that does not run the swarm's services still resolves that
name through the gateway; nothing here needs setting for the split-host case.
⚠️ **The collector is therefore in the path of all telemetry.** It runs on the
same host as the agents and restarts on failure, and telemetry is not the