nix/host-modules/swarm-bao.nix

@@ -1645,13 +1645,9 @@ in
       # collector (see `receivers.prometheus` below), which travels with the
       # store.
       #
-      # Logs are a different story from that move: `journaldUnits` above still
-      # names this store's units, but bao's journal now lives only inside the
-      # container (see the forwarder's own comment below) — nothing links it
-      # into the host tree any more, so the shared collector can never see
-      # these units. The list stays untouched for the sibling containers that
-      # still ride it; bao's own entries come out once delivery through the
-      # container's own collector is confirmed.
+      # Logs are untouched by that move: `journaldUnits` above still names this
+      # store's units for the shared collector, and the two are retired
+      # together once every sibling swarm container has a collector of its own.
 
       # ⚠️ The one nginx exception to this file's header, and it is one because
       # it never terminates. `ssl_preread` reads the SNI off the ClientHello
@@ -2413,6 +2409,9 @@ in
       containers.${cfg.machine} = {
         autoStart = true;
         ephemeral = false;
+        # Journal files on the host, not inside the container: nixpkgs hardcodes
+        # --link-journal=try-guest, and EXTRA_NSPAWN_FLAGS expands after it.
+        extraFlags = [ "--link-journal=host" ];
         # Shared host netns, like every sibling swarm container. Unlike them the
         # gateway is NOT the client here (see the no-vhost note at the top), so
         # sharing the netns is what lets the store bind the host's own addresses
@@ -2661,11 +2660,12 @@ in
             # is supposed to ship its own logs to the next hop rather than
             # leave a *different* container's collector to find them.
             #
-            # The journal lives inside this container now, the same shape as
-            # every agent container: nothing links it into the host's
-            # /var/log/journal tree, so `swarm.otel.journaldUnits` near the
-            # top of this file can no longer reach any of bao's units through
-            # the shared collector — see the comment there.
+            # That older shape is what `--link-journal=host` above and the
+            # `swarm.otel.journaldUnits` entry near the top of this file serve:
+            # the journal lands in the host tree, where the swarm collector —
+            # itself a container — reads it through a unit allowlist. Both stay
+            # for now, because every sibling swarm container still rides that
+            # collector; they come out once each of them has one of these.
             #
             # ⚠️ NO `units` allowlist here, and that is the point rather than a
             # simplification. A shared collector needs one because the journal
@@ -2730,20 +2730,17 @@ in
 
                 receivers.journald = {
                   # ⚠️ STATED, and it must stay stated: the receiver's own
-                  # default is the RUNTIME journal (`/run/log/journal`), which
-                  # in this container is empty — journald stores persistently
-                  # here, so every entry is under /var/log/journal. Dropping
-                  # this line leaves a collector that validates, starts,
-                  # reports healthy and forwards nothing.
+                  # default is the RUNTIME journal (`/run/log/journal`), and
+                  # every entry here is under /var/log/journal — which
+                  # `--link-journal=host` above makes the host's directory for
+                  # this machine id. Dropping this line leaves a collector that
+                  # validates, starts, reports healthy and forwards nothing.
                   directory = "/var/log/journal";
-                  # ⚠️ `--merge` stays from when this journal was host-linked
-                  # and `journalctl --follow` (unqualified) found no entry for
-                  # the current boot under that tree, crash-looping the
-                  # receiver every ~2s with "No journal boot entry found for
-                  # the specified boot (+0)". The journal is local now, so the
-                  # current boot has an entry here too — kept rather than
-                  # dropped so the first deploy changes exactly one thing;
-                  # revisit once delivery is confirmed.
+                  # ⚠️ `--merge`, and it is what makes this receiver read
+                  # anything at all: `journalctl --follow` scopes itself to the
+                  # current boot, which has no entry under the host's journal
+                  # tree — so every start died with "No journal boot entry found
+                  # for the specified boot (+0)" in a ~2s crash-loop.
                   merge = true;
                   storage = "file_storage";
                 };

nix/host-modules/swarm-otel.nix

@@ -202,21 +202,18 @@ let
   # because the receiver reads the path it is mounted at, and two spellings of
   # one path is a mount that succeeds and a receiver that finds nothing.
   #
-  # 🔑 Why the host's directory is enough to see a container — and why it is
-  # only enough because that container asks for it. nixpkgs hardcodes
+  # 🔑 Why the host's directory is enough to see every container — and why it
+  # is only enough because each container asks for it. nixpkgs hardcodes
   # `--link-journal=try-guest`, which puts the journal inside the container and
   # leaves the host with a symlink into that container's transient root: a
   # reader here cannot follow it, and it dangles the moment the container
-  # stops. Every container block except `swarm-bao` therefore sets
+  # stops. Every container block therefore sets
   # `extraFlags = [ "--link-journal=host" ]`, which the invocation expands
   # AFTER the hardcoded flag, so the files land here under their own
   # machine-id subdirectory and are bind-mounted into the guest instead.
   #
-  # ⚠️ Drop that flag from one of THOSE containers and this receiver silently
-  # stops seeing it — no error, just a unit that never appears in the store.
-  # `swarm-bao` is the one exception on purpose: its journal stays inside the
-  # container for its own collector instead (see `swarm-bao.nix`), so it was
-  # never one of the units this receiver could see either.
+  # ⚠️ Drop that flag from a container and this receiver silently stops seeing
+  # it — no error, just a unit that never appears in the store.
   hostJournalDir = "/var/log/journal";
 
   # Each store's OTLP route, by domain. One binding because the same string is

nix/module-eval/bao-otel-collector.nix

@@ -265,16 +265,6 @@ let
         in
         (j.merge or false) == true && j.directory == "/var/log/journal";
     }
-    {
-      # The empty-directory trap this receiver used to fall into: `host` mode
-      # bind-mounts a host directory journald never actually writes into, so
-      # `merge`/`directory` above would keep validating and starting while
-      # the receiver reads nothing — silently, same as every other failure
-      # mode here. Guards against re-adding the exact flag this was fixed by
-      # dropping.
-      name = "the store's container does not link its journal onto the host";
-      ok = !(lib.elem "--link-journal=host" (baoWithCollector.containers.swarm-bao.extraFlags or [ ]));
-    }
     {
       # The whole journal, which is what the shared collector's unit allowlist
       # is not. A `units` list here would render and deploy perfectly while