vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

otel: agents reach their hive's collector by a swarm-wide name

Browse source 
Agents are handed `http://hive-collector.<swarm domain>:<port>` as their
otel endpoint instead of `http://<bridge IP>:<port>`. Every hive running
its collector contributes the name to `gateway.localNames`, so its own
dnsmasq answers it with its bridge IP, the way the queue's name already
works. The rendered meta flake then carries no hive-specific address,
which a swarm-level render needs (#4857, operator ruling 100744: "b").

hive-c0re's own exporter keeps the bridge address: on the host the name
may resolve to loopback through `gateway.localHostsEntry`, where the
receiver does not listen.

The name sits under the swarm domain and starts with `hive`, a fragment
no hive name may contain, so no hive's default domain can take it.
This commit is contained in:
atlas 2026-10-16 02:26:04 +02:00 • committed by mara
commit d4e20803ec
6 changed files with 58 additions and 13 deletions
Download patch file Download diff file Expand all files Collapse all files

25
nix/host-modules/otel.nix
View file

@ -203,6 +203,28 @@ in
'';
};
collector.host = lib.mkOption {
type = lib.types.str;
readOnly = true;
# Total on a null swarm domain, as in ./swarm-otel-service.nix: the
# required-domain assertion should be what an operator sees.
default = "hive-collector.${
if config.services.hyperhive.swarm.domain == null then
"invalid"
else
config.services.hyperhive.swarm.domain
}";
defaultText = lib.literalExpression ''"hive-collector.''${services.hyperhive.swarm.domain}"'';
description = ''
The name agents reach this hive's collector on. The same string on
every hive: each hive's own resolver answers it with its own bridge
IP, so an agent's build carries no hive-specific address.
No hive can claim this name as its domain:
`nix/reserved-hive-fragments.nix` forbids `hive` in any hive name.
'';
};
telemetryPort = lib.mkOption {
type = lib.types.port;
default = 8888;
@ -357,6 +379,9 @@ in
# the port on the bridge interface only.
services.hyperhive.network.exposeHostPorts = [ otel.collector.port ];
# The name agents dial, answered with the bridge IP the receiver binds.
services.hyperhive.gateway.localNames = [ otel.collector.host ];
# …and the receiver binds that bridge address, so the interface has
# to exist. `exposeHostPorts` is a firewall hole, not a demand.
services.hyperhive.network.enable = lib.mkDefault true;