vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

grafana: query the log store with the metrics bearer, by its swarm name

Browse source 
Grafana's VictoriaLogs datasource now targets https://logs.<swarm> and sends
the same static bearer as the metrics datasource. The log store's vhost routes
a 64-hex Authorization bearer to a second swarm-metrics-auth instance
(swarm-logs-grafana-auth, cert role swarm-logs-auth, which gains a read on the
bearer's store path). swarm-agent. tokens and everything else keep their routes.

Part of #3742 (DoD 3, logs).
This commit is contained in:
atlas 2026-10-16 01:32:24 +02:00 • committed by mara
commit eff5c43bdc
9 changed files with 200 additions and 52 deletions
Download patch file Download diff file Expand all files Collapse all files

18
nix/module-eval/grafana.nix
View file

@ -378,6 +378,24 @@ let
lib.any (e: lib.hasInfix "PRIORITY:*" e) counts
&& lib.any (e: lib.hasInfix "PRIORITY:\"\"" e) counts;
}
{
# The logs datasource reaches the store through its swarm name — a
# loopback URL works only where Grafana and the store share a host — and
# sends the metrics datasource's bearer, which the store's `/select/logsql/`
# route checks.
name = "the logs datasource targets the log store's swarm name and sends the metrics bearer";
ok =
let
datasources =
grafanaWithAuthelia.containers.swarm-grafana.config.services.grafana.provision.datasources.settings.datasources;
metrics = lib.findFirst (d: d.uid == "swarm-victoriametrics") null datasources;
logs = lib.findFirst (d: d.uid == "swarm-victorialogs") null datasources;
in
logs.url == "https://${grafanaWithAuthelia.services.hyperhive.swarm.victorialogs.domain}"
&& !(lib.hasInfix "127.0.0.1" logs.url)
&& logs.jsonData.httpHeaderName1 == "Authorization"
&& logs.secureJsonData.httpHeaderValue1 == metrics.secureJsonData.httpHeaderValue1;
}
{
# The reader's half of the same mapping. The collector writes a severity
# TEXT; nothing downstream reads it as a level unless the datasource is