| Filename | Latest commit message | Latest commit date |
|---|---|---|
08faa0970e
The swarm collector accepted OTLP from anyone who could reach it, and took the `hive` resource attribute from the payload. So any writer on the swarm network could attribute metrics to any hive, and nothing downstream could tell. The label now comes from which receiver accepted the sample: one receiver per hive, each behind an `oidc` extension verifying a token minted for that hive's audience, each feeding a pipeline whose `resource` processor upserts a constant. A sender cannot influence it, because the only input is which authenticated port the bytes arrived on. That multiplicity is forced rather than preferred. A processor cannot read the token's claims — `from_context` reads request metadata, and asking it for an auth claim yields nothing, silently, with a healthy startup — and one receiver holding several credentials never reveals which one matched. The per-hive ports are internal: a hive reaches its receiver as a path under this collector's existing gateway name, so nginx (rendered from this same evaluation) is the only thing that names a port. Fronting each hive with its own vhost would need a certificate, a DNS name and a gateway entry per hive to express routing the gateway already does. Turning this on removes the unauthenticated receiver. While an open port still accepts samples the per-hive receivers are decoration, so this is the switch itself rather than a hardening layer beside it; a swarm that wants the open receiver says so. `hive-ca-trust.nix` grows `bundlePathFor`, because a consumer taking its own CA argument has to name the bundle rather than just have `SSL_CERT_FILE` exported at it. |
||
| .. | ||
| hive-ca-trust.nix | ||