vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

gateway: send nginx stub_status to VictoriaMetrics, add a gateway dashboard

Browse source 
The gateway nginx serves stub_status on a loopback server of its own,
127.0.0.1:8085 (services.hyperhive.gateway.statusPort). The hive-tier
collector reads it with the contrib nginx receiver, which the pinned
otelcol-contrib 0.151.0 ships, so no exporter daemon is added. The
receiver dials http:// only (a unix: or http+unix: endpoint fails with
"unsupported protocol scheme"), so the listener is loopback TCP with
allow 127.0.0.1 / deny all rather than a unix socket.

The new gateway dashboard plots nginx.requests, nginx.connections_current
by state, and nginx.connections_accepted against handled, per hive.

Part of #5342.
This commit is contained in:
atlas 2026-10-16 02:40:26 +02:00 • committed by mara
commit f70bbda7d7
8 changed files with 460 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

18
nix/host-modules/hive-gateway/default.nix
View file

@ -404,6 +404,24 @@ in
# `error` threshold and this changes where lines are filed, not
# which lines exist.
logError = "syslog:server=unix:/dev/log,nohostname,tag=nginx";
# Read by the hive collector's `nginx` receiver (../otel.nix). Its own
# loopback server, outside the vhost tree, so it never answers on the
# gateway's public listeners.
appendHttpConfig = ''
server {
listen 127.0.0.1:${toString cfg.statusPort};
access_log off;
location = /stub_status {
stub_status;
allow 127.0.0.1;
deny all;
}
location / {
return 404;
}
}
'';
};
# ⚠️ NO `SupplementaryGroups = [ "hive-core" ]` on nginx, and its

15
nix/host-modules/hive-gateway/options.nix
View file

@ -254,6 +254,21 @@ in
'';
};
statusPort = lib.mkOption {
type = lib.types.port;
default = 8085;
description = ''
Loopback TCP port nginx serves its `stub_status` counters on, at
`http://127.0.0.1:''${statusPort}/stub_status`. The hive's collector
({option}`services.hyperhive.otel.enable`) reads it with its `nginx`
receiver.
TCP rather than a unix socket because that receiver can only dial
`http://`. Anything on the host can read these counters; they are
connection and request totals, nothing per-client.
'';
};
tls = {
certDir = lib.mkOption {
type = lib.types.nullOr lib.types.path;