vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

Compare commits

base: vinzenz:c4edb78aa27f9cd5083bfea19662a9a9ad025355
Branches Tags
vinzenz:main
..
compare: vinzenz:92e1909caf3bcbf2cff62fc3a368d1c66d883e6d
Branches Tags
vinzenz:main
3 changed files with 27 additions and 43 deletions
Download patch file Download diff file Expand all files Collapse all files

47
nix/host-modules/swarm-bao.nix
View file

@ -1645,13 +1645,9 @@ in
# collector (see `receivers.prometheus` below), which travels with the # collector (see `receivers.prometheus` below), which travels with the
# store. # store.
# #
# Logs are a different story from that move: `journaldUnits` above still # Logs are untouched by that move: `journaldUnits` above still names this
# names this store's units, but bao's journal now lives only inside the # store's units for the shared collector, and the two are retired
# container (see the forwarder's own comment below) — nothing links it # together once every sibling swarm container has a collector of its own.
# into the host tree any more, so the shared collector can never see
# these units. The list stays untouched for the sibling containers that
# still ride it; bao's own entries come out once delivery through the
# container's own collector is confirmed.
# ⚠️ The one nginx exception to this file's header, and it is one because # ⚠️ The one nginx exception to this file's header, and it is one because
# it never terminates. `ssl_preread` reads the SNI off the ClientHello # it never terminates. `ssl_preread` reads the SNI off the ClientHello
@ -2413,6 +2409,9 @@ in
containers.${cfg.machine} = { containers.${cfg.machine} = {
autoStart = true; autoStart = true;
ephemeral = false; ephemeral = false;
# Journal files on the host, not inside the container: nixpkgs hardcodes
# --link-journal=try-guest, and EXTRA_NSPAWN_FLAGS expands after it.
extraFlags = [ "--link-journal=host" ];
# Shared host netns, like every sibling swarm container. Unlike them the # Shared host netns, like every sibling swarm container. Unlike them the
# gateway is NOT the client here (see the no-vhost note at the top), so # gateway is NOT the client here (see the no-vhost note at the top), so
# sharing the netns is what lets the store bind the host's own addresses # sharing the netns is what lets the store bind the host's own addresses
@ -2661,11 +2660,12 @@ in
# is supposed to ship its own logs to the next hop rather than # is supposed to ship its own logs to the next hop rather than
# leave a *different* container's collector to find them. # leave a *different* container's collector to find them.
# #
# The journal lives inside this container now, the same shape as # That older shape is what `--link-journal=host` above and the
# every agent container: nothing links it into the host's # `swarm.otel.journaldUnits` entry near the top of this file serve:
# /var/log/journal tree, so `swarm.otel.journaldUnits` near the # the journal lands in the host tree, where the swarm collector —
# top of this file can no longer reach any of bao's units through # itself a container — reads it through a unit allowlist. Both stay
# the shared collector — see the comment there. # for now, because every sibling swarm container still rides that
# collector; they come out once each of them has one of these.
# #
# ⚠️ NO `units` allowlist here, and that is the point rather than a # ⚠️ NO `units` allowlist here, and that is the point rather than a
# simplification. A shared collector needs one because the journal # simplification. A shared collector needs one because the journal
@ -2730,20 +2730,17 @@ in
receivers.journald = { receivers.journald = {
# ⚠️ STATED, and it must stay stated: the receiver's own # ⚠️ STATED, and it must stay stated: the receiver's own
# default is the RUNTIME journal (`/run/log/journal`), which # default is the RUNTIME journal (`/run/log/journal`), and
# in this container is empty — journald stores persistently # every entry here is under /var/log/journal — which
# here, so every entry is under /var/log/journal. Dropping # `--link-journal=host` above makes the host's directory for
# this line leaves a collector that validates, starts, # this machine id. Dropping this line leaves a collector that
# reports healthy and forwards nothing. # validates, starts, reports healthy and forwards nothing.
directory = "/var/log/journal"; directory = "/var/log/journal";
# ⚠️ `--merge` stays from when this journal was host-linked # ⚠️ `--merge`, and it is what makes this receiver read
# and `journalctl --follow` (unqualified) found no entry for # anything at all: `journalctl --follow` scopes itself to the
# the current boot under that tree, crash-looping the # current boot, which has no entry under the host's journal
# receiver every ~2s with "No journal boot entry found for # tree — so every start died with "No journal boot entry found
# the specified boot (+0)". The journal is local now, so the # for the specified boot (+0)" in a ~2s crash-loop.
# current boot has an entry here too — kept rather than
# dropped so the first deploy changes exactly one thing;
# revisit once delivery is confirmed.
merge = true; merge = true;
storage = "file_storage"; storage = "file_storage";
}; };

13
nix/host-modules/swarm-otel.nix
View file

@ -202,21 +202,18 @@ let
# because the receiver reads the path it is mounted at, and two spellings of # because the receiver reads the path it is mounted at, and two spellings of
# one path is a mount that succeeds and a receiver that finds nothing. # one path is a mount that succeeds and a receiver that finds nothing.
# #
# 🔑 Why the host's directory is enough to see a container — and why it is # 🔑 Why the host's directory is enough to see every container — and why it
# only enough because that container asks for it. nixpkgs hardcodes # is only enough because each container asks for it. nixpkgs hardcodes
# `--link-journal=try-guest`, which puts the journal inside the container and # `--link-journal=try-guest`, which puts the journal inside the container and
# leaves the host with a symlink into that container's transient root: a # leaves the host with a symlink into that container's transient root: a
# reader here cannot follow it, and it dangles the moment the container # reader here cannot follow it, and it dangles the moment the container
# stops. Every container block except `swarm-bao` therefore sets # stops. Every container block therefore sets
# `extraFlags = [ "--link-journal=host" ]`, which the invocation expands # `extraFlags = [ "--link-journal=host" ]`, which the invocation expands
# AFTER the hardcoded flag, so the files land here under their own # AFTER the hardcoded flag, so the files land here under their own
# machine-id subdirectory and are bind-mounted into the guest instead. # machine-id subdirectory and are bind-mounted into the guest instead.
# #
# ⚠️ Drop that flag from one of THOSE containers and this receiver silently # ⚠️ Drop that flag from a container and this receiver silently stops seeing
# stops seeing it — no error, just a unit that never appears in the store. # it — no error, just a unit that never appears in the store.
# `swarm-bao` is the one exception on purpose: its journal stays inside the
# container for its own collector instead (see `swarm-bao.nix`), so it was
# never one of the units this receiver could see either.
hostJournalDir = "/var/log/journal"; hostJournalDir = "/var/log/journal";
# Each store's OTLP route, by domain. One binding because the same string is # Each store's OTLP route, by domain. One binding because the same string is

10
nix/module-eval/bao-otel-collector.nix
View file

@ -265,16 +265,6 @@ let
in in
(j.merge or false) == true && j.directory == "/var/log/journal"; (j.merge or false) == true && j.directory == "/var/log/journal";
} }
{
# The empty-directory trap this receiver used to fall into: `host` mode
# bind-mounts a host directory journald never actually writes into, so
# `merge`/`directory` above would keep validating and starting while
# the receiver reads nothing — silently, same as every other failure
# mode here. Guards against re-adding the exact flag this was fixed by
# dropping.
name = "the store's container does not link its journal onto the host";
ok = !(lib.elem "--link-journal=host" (baoWithCollector.containers.swarm-bao.extraFlags or [ ]));
}
{ {
# The whole journal, which is what the shared collector's unit allowlist # The whole journal, which is what the shared collector's unit allowlist
# is not. A `units` list here would render and deploy perfectly while # is not. A `units` list here would render and deploy perfectly while