vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

Compare commits

base: vinzenz:541dd298206648212d8a02e22bc9f81f9a926e05
Branches Tags
vinzenz:main
..
compare: vinzenz:7aec2e339fdb0340a151b9ff5a664895a2f3237b
Branches Tags
vinzenz:main
1 changed files with 0 additions and 61 deletions
Download patch file Download diff file Expand all files Collapse all files

61
nix/host-modules/swarm-authelia.nix
View file

@ -43,7 +43,6 @@ let
swarmDomain = hyperhiveCfg.swarm.domain;
uiCfg = hyperhiveCfg.swarm.ui;
forgeCfg = hyperhiveCfg.swarm.forge;
otelCfg = hyperhiveCfg.swarm.otel;
# Group an account must hold to reach operator-only surfaces. Named
# here because this module writes the rule that enforces it and
@ -340,36 +339,6 @@ in
'';
};
metricsPort = lib.mkOption {
type = lib.types.port;
default = 9959;
description = ''
TCP port authelia serves its Prometheus metrics on, bound to
loopback. Upstream's default, kept so an operator reading
authelia's documentation finds what they expect.
A separate port from {option}`port` because it is a separate
listener with a different audience: the main one is proxied by
the gateway and reachable from the swarm, this one is scraped by
the collector on this host and by nothing else.
⚠️ Every swarm container shares the host network namespace, so
two services defaulting to the same port do not conflict at build
time — one simply loses at runtime, with nothing in any log. Check
a new value against the others before changing this.
::: {.note}
Loopback means this endpoint is only reachable by a collector on
the *same host*, so the scrape target is declared only when one is
enabled here. Run the swarm's collector elsewhere and authelia's
metrics are simply not collected — no error, and nothing in a log
to say so. Making them reachable across hosts is a different piece
of work: the endpoint would have to be published under a name,
with a certificate and an audience.
:::
'';
};
domain = lib.mkOption {
type = lib.types.str;
# Under the SWARM domain, like the forge and matrix: a swarm has one
@ -835,26 +804,6 @@ in
# bridge at that wrong answer.
services.hyperhive.gateway.localNames = [ cfg.domain ];
# Declared here rather than in the collector's module, per the option's
# own rule: an entry exists only where the service that named it runs.
#
# Gated on the collector's `enable` as well, and that second condition is
# what makes the loopback address honest. Both services default from
# `swarm.enableRequiredServices` — but `mkDefault` is an invitation to
# override, not a guarantee, so "they are on the same host" is a property
# of the auto-deployed topology rather than of the module. Without this
# gate, a host running authelia and no collector would declare a target
# nothing can read, and the absence would be silent: no error, no metrics,
# nothing to notice.
#
# It does not make authelia scrapeable from ANOTHER host — that needs the
# endpoint published under a name with a cert and an audience, which is a
# different piece of work. This only stops the config asserting a
# collection that is not happening.
services.hyperhive.swarm.otel.scrapeTargets = lib.mkIf otelCfg.enable {
authelia = "127.0.0.1:${toString cfg.metricsPort}";
};
# This swarm-ui quick-links entry, same guard as the vhost/DNS name
# above (only the host actually running the container claims it —
# see `services.hyperhive.swarm.controller.links`'s description for
@ -1161,16 +1110,6 @@ in
};
log.level = "info";
# Prometheus exposition for the swarm collector to scrape.
# Loopback only, like the main listener above and for a
# stronger reason: this endpoint has no authentication of its
# own, and it reports request volumes and outcomes for every
# SSO login on the swarm.
telemetry.metrics = {
enabled = true;
address = "tcp://127.0.0.1:${toString cfg.metricsPort}";
};
# `watch` is load-bearing, not a convenience: authelia reads
# this file once at startup, and `swarm-authelia-bridge` writes
# it to create agent identities while being unable to restart