vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

add swarm-metrics, an agent CLI for the metrics store

Browse source 
swarm-metrics reads the swarm's VictoriaMetrics from inside an agent
container: query, query-range, series, labels and label-values, each one
GET against the store's Prometheus read API through the gateway, printing
the store's JSON. It authenticates the way swarm-logs does, with the
agent's own queue secret read from bao under the agent's leaf, sent as
a swarm-agent bearer.

On the metrics store's host the read API's auth map gains an agent arm
ahead of the Grafana one. It routes to swarm-metrics-agent-auth, a
swarm-logs-auth instance logged in under the existing swarm-metrics-auth
leaf, whose bao grant now includes swarm/agents/+/queue read. The check is
rate-limited per address like the log store's
(deploy.victoriametrics.agentAuth{Rate,Burst,VerdictTtl}).

nix/agent-modules/metrics.nix installs the wrapped binary when the hive
forwards HIVE_AGENT_METRICS_URL (from swarm.victoriametrics.domain) and a
store address, the same gate as swarm-logs. Adds the base:swarm-metrics
skill and the CLI reference with its freshness check.

Fixes #5395
This commit is contained in:
atlas 2026-10-17 00:55:46 +02:00 • committed by mara
commit e92f118bda
30 changed files with 1417 additions and 88 deletions
Download patch file Download diff file Expand all files Collapse all files

1
nix/agent-modules/default.nix
View file

@ -48,6 +48,7 @@ in
./matrix.nix
./mcp.nix
./memory-cap.nix
./metrics.nix
./network.nix
./otel.nix
./otel-removed.nix

66
nix/agent-modules/metrics.nix Normal file
View file

@ -0,0 +1,66 @@
# `swarm-metrics` on this agent's PATH, configured for this swarm's metrics
# store. The sibling of ./logs.nix, in the same shape for the same reasons:
# the binary defaults nothing (see `swarm-metrics/README.md`), so it is
# installed wrapped, and it is gated on the secret store's address as well as
# on the store URL, because the identity it presents is the agent's own queue
# secret read from that store.
{
lib,
pkgs,
config,
...
}:
let
cfg = config.services.hyperhive.agent.metrics;
baoCfg = config.services.hyperhive.agent.bao;
configured = cfg.url != null && baoCfg.addr != null;
# The coordinates ./logs.nix gives `swarm-logs`. Paths and a name only: a
# value in `--set` lands in the world-readable nix store.
wrapperEnv = {
HIVE_AGENT_METRICS_URL = cfg.url;
HIVE_AGENT_NAME = config.services.hyperhive.agent.user.name;
BAO_ADDR = baoCfg.addr;
BAO_CLIENT_CERT = baoCfg.clientCertFile;
BAO_CLIENT_KEY = baoCfg.clientKeyFile;
BAO_CACERT = "/run/credentials/hive-agent.service/hive-agent-bao-server-ca";
};
swarmMetricsConfigured = pkgs.symlinkJoin {
name = "swarm-metrics-configured";
paths = [ config.services.hyperhive.agent.packages.swarm-metrics ];
nativeBuildInputs = [ pkgs.makeWrapper ];
postBuild = ''
wrapProgram $out/bin/swarm-metrics ${
lib.concatStringsSep " " (
lib.mapAttrsToList (name: value: "--set ${name} ${lib.escapeShellArg value}") wrapperEnv
)
}
'';
};
in
{
options.services.hyperhive.agent.metrics = {
url = lib.mkOption {
type = lib.types.nullOr lib.types.str;
default = null;
example = "https://metrics.example.com";
description = ''
The swarm metrics store's gateway origin, as this container reaches
it. `swarm-metrics` appends the read API's paths (`/api/v1/query`,
...) to it.
Set by the generated meta flake from the host's own
{option}`services.hyperhive.swarm.victoriametrics.domain`.
`null` means this hive has not been given the metrics store's address
for its agents, and `swarm-metrics` is then not installed at all.
Not defaulted: a guessed address resolves cleanly to the wrong place.
'';
};
};
config = lib.mkIf configured {
environment.systemPackages = [ swarmMetricsConfigured ];
};
}