swarm-otel: run in its own network namespace, receivers on unix sockets

Refs #4815

nix/module-eval/nats-authelia.nix

@@ -795,7 +795,7 @@ let
           otel = h.services.hyperhive.swarm.otel;
           s = h.containers.swarm-otel.config.services.opentelemetry-collector.settings;
           clientOf = svc: h.services.hyperhive.swarm.${svc.name}.clientId;
-          ports = map (svc: otel.serviceProducers.${svc.machine}.port) forwarderServices;
+          socks = map (svc: s.receivers."otlp/${svc.machine}".protocols.http.endpoint) forwarderServices;
         in
         !h.services.hyperhive.deploy.builder.enable
         && lib.all (
@@ -806,9 +806,9 @@ let
           && lib.elem "otlp/${svc.machine}" s.service.pipelines."logs/${otel.producerName}".receivers
           && h.services.nginx.virtualHosts.${otel.domain}.locations ? "/${svc.machine}/"
         ) forwarderServices
-        # Their receivers and the queue's on the collector's host, none sharing a port.
+        # Their receivers and the queue's on the collector's host, none sharing a socket.
         &&
-          lib.length (lib.unique (ports ++ [ otel.serviceProducers.swarm-nats.port ]))
+          lib.length (lib.unique (socks ++ [ s.receivers."otlp/swarm-nats".protocols.http.endpoint ]))
           == lib.length forwarderServices + 1;
     }
     {
@@ -837,7 +837,9 @@ let
           h = shared.baoWithCollector;
           otel = h.services.hyperhive.swarm.otel;
           s = h.containers.swarm-otel.config.services.opentelemetry-collector.settings;
-          ports = map (p: p.port) (lib.attrValues otel.serviceProducers);
+          socks = map (n: s.receivers."otlp/${n}".protocols.http.endpoint) (
+            lib.attrNames otel.serviceProducers
+          );
         in
         lib.all (
           svc:
@@ -847,7 +849,7 @@ let
           && lib.elem "otlp/${svc.machine}" s.service.pipelines."logs/${otel.producerName}".receivers
           && h.services.nginx.virtualHosts.${otel.domain}.locations ? "/${svc.machine}/"
         ) ownClientForwarders
-        && lib.length (lib.unique ports) == lib.length ports;
+        && lib.length (lib.unique socks) == lib.length socks;
     }
     {
       # Grafana's forwarder is a second client beside its browser login, which

nix/module-eval/swarm-services-switch.nix

@@ -170,9 +170,10 @@ let
     lib.filter (l: swarmServiceLinkDomains ? ${l.label}) cfg.services.hyperhive.swarm.controller.links;
 
   # Every service container at once: the services-only host plus the CI
-  # runner. The CI runner, the review classifier, the builder, the claude login
-  # minter, the metrics store, the homeserver, authelia and Grafana are the eight
-  # containers on a netns of their own.
+  # runner. The CI runner, the review classifier, the notification router, the
+  # builder, the claude login minter, the metrics store, the homeserver,
+  # authelia, Grafana and the collector are the ten containers on a netns of
+  # their own.
   serviceContainersWithCi = hive {
     deploy.hive-controller.enable = false;
     deploy.allSwarmServices = true;
@@ -792,6 +793,62 @@ let
         && lib.all (lib.hasPrefix "http://unix:${sock}:") forwarded
         && c.bindMounts.${dir}.hostPath == dir;
     }
+    {
+      # On the bridge by DHCP, with every receiver on a socket: the hive's, the
+      # swarm tier's and each service forwarder's. Every gateway location that
+      # forwards goes through one of them, and each receiver's socket is the
+      # one its location names. The three kinds are named so an empty filter
+      # can't pass.
+      name = "the swarm collector runs on a netns of its own and the gateway reaches every receiver over a socket";
+      ok =
+        let
+          host = serviceContainersWithCi;
+          net = host.services.hyperhive.network;
+          c = host.containers.swarm-otel;
+          otel = host.services.hyperhive.swarm.otel;
+          dir = "/run/swarm-otel";
+          sock = n: "${dir}/${n}.sock";
+          locs = host.services.nginx.virtualHosts.${otel.domain}.locations;
+          forwarded = lib.filter (p: p != null) (map (l: l.proxyPass) (lib.attrValues locs));
+          inner = c.config;
+          s = inner.services.opentelemetry-collector.settings;
+          unit = inner.systemd.services.opentelemetry-collector.serviceConfig;
+          nginxGid = host.ids.gids.nginx;
+          receivers = lib.filterAttrs (n: _: lib.hasPrefix "otlp/" n) s.receivers;
+          onSocket =
+            owner:
+            let
+              r = s.receivers."otlp/${owner}".protocols.http;
+            in
+            r.transport == "unix"
+            && r.endpoint == sock owner
+            && locs."/${owner}/".proxyPass == "http://unix:${sock owner}:/";
+        in
+        c.privateNetwork
+        && c.hostBridge == net.bridgeName
+        && c.hostAddress == null
+        && c.localAddress == null
+        && inner.networking.interfaces.eth0.useDHCP
+        && inner.networking.firewall.enable
+        && onSocket "h1"
+        && onSocket otel.producerName
+        && onSocket "swarm-grafana"
+        && lib.all (n: (receivers.${n}.protocols.http.transport or null) == "unix") (
+          lib.attrNames receivers
+        )
+        &&
+          lib.length (lib.attrNames receivers)
+          == lib.length (lib.attrNames host.services.hyperhive.swarm.hives)
+          + 1
+          + lib.length (lib.attrNames otel.serviceProducers)
+        && forwarded != [ ]
+        && lib.all (lib.hasPrefix "http://unix:${dir}/") forwarded
+        && c.bindMounts.${dir}.hostPath == dir
+        && builtins.elem "d ${dir} 2770 root ${toString nginxGid} - -" host.systemd.tmpfiles.rules
+        && inner.users.groups.gateway-nginx.gid == nginxGid
+        && lib.elem "gateway-nginx" unit.SupplementaryGroups
+        && unit.UMask == "0007";
+    }
     {
       # The DynamicUser layout keeps the history under /var/lib/private; the
       # static user's StateDirectory is the plain path. The move runs as its