217b3f1cea
The queue's metrics were scraped over loopback from the exporter, declared only where the queue and the collector share a host, so a collector on any other host had no job for it. Its target is now declared on every host as `https://<swarm.nats.domain>/metrics`, and the queue's host gets a gateway vhost on that name serving `= /metrics` from the exporter behind the collector's auth subrequest (`/__nats_metrics_authz`, the forge's shape). Every other path there is 403; the monitoring endpoint is never proxied. The rules derived from `publishedScrapeTargets` admit the collector's client and deny every other subject. The loopback entry, and with it `glue-otel-scrape-targets.nix`, is gone. In self-signed mode the vhost serves the queue's own `swarm-nats` leaf (issued for exactly that name, `server_flag` set), copied 0640 root:nginx by `swarm-nats-gateway-cert`; until the leaf exists that unit writes a throwaway pair, so nginx never starts on a missing file. The name stays out of `swarm.serviceDomains`, so a host whose only swarm service is the queue fronts no services name and its gateway neither waits for nor needs the swarm-services leaf: no services-issuer pair has to be placed on it. With ACME or an operator cert the vhost uses the gateway's own TLS, as every other name does. The queue's host now enables the gateway (`mkDefault`), as every other swarm service's host does. Fixes #5205
82 lines
2.7 KiB
Nix
82 lines
2.7 KiB
Nix
# The full hyperhive host stack, pulled together in one place — this
|
|
# is what the flake exports as `nixosModules.default` (wrapped with
|
|
# the package/source wiring; see flake.nix). One import covers
|
|
# everything; `services.hyperhive.deploy.hive-controller.enable = true`
|
|
# runs a hive on this host.
|
|
#
|
|
# Every swarm needs the forge — hive-c0re mirrors every agent's applied
|
|
# config repo into it and it's the canonical store for the meta flake
|
|
# + `internal/*` repos — but only the host with `deploy.forgejo.enable`
|
|
# runs it (derived from `deploy.allSwarmServices`, see
|
|
# ./swarm-required-services.nix). hive-matrix is opt-in (off by default). All
|
|
# subsystems rely on `services.hyperhive.domain`, which is required
|
|
# (asserted in hive-network.nix) wherever this host runs a hive.
|
|
{
|
|
imports = [
|
|
./hyperhive.nix
|
|
./deploy.nix
|
|
./local-defaults.nix
|
|
./hive-c0re
|
|
./hive-forge
|
|
./hive-gateway
|
|
./hive-matrix-service.nix
|
|
./hive-matrix.nix
|
|
./hive-network.nix
|
|
./hive-priv.nix
|
|
./hive-tls.nix
|
|
./otel.nix
|
|
./glue-bao-readers-policy-order.nix
|
|
./glue-bao-readers-store-order.nix
|
|
./glue-bao-tls.nix
|
|
./glue-bao-ui-oidc-client.nix
|
|
./glue-controller-bao-identity.nix
|
|
./glue-controller-env.nix
|
|
./glue-controller-oidc-client.nix
|
|
./glue-forge-controller.nix
|
|
./glue-forge-oidc-client.nix
|
|
./glue-grafana-oidc-client.nix
|
|
./glue-hive-otel-authelia.nix
|
|
./glue-hive-tls-bao-identity.nix
|
|
./glue-logs-auth-bao-identity.nix
|
|
./glue-matrix-ctl-bao-identity.nix
|
|
./glue-matrix-oidc-client.nix
|
|
./glue-nats-auth-bao-identity.nix
|
|
./glue-nats-bao-identity.nix
|
|
./glue-nats-oidc-client.nix
|
|
./glue-nats-wireguard.nix
|
|
./glue-queue-agent-credential.nix
|
|
./glue-builder-oidc-client.nix
|
|
./glue-review-classifier-oidc-client.nix
|
|
./glue-secret-publisher-authelia.nix
|
|
./glue-secret-publisher-bao-identity.nix
|
|
./glue-swarm-bao-otel-oidc-client.nix
|
|
./glue-swarm-otel-oidc-client.nix
|
|
./swarm-authelia-service.nix
|
|
./swarm-authelia.nix
|
|
./swarm-bao-service.nix
|
|
./swarm-bao.nix
|
|
./swarm-builder.nix
|
|
./swarm-ci-runner.nix
|
|
./swarm-review-classifier.nix
|
|
./swarm-secret-publisher.nix
|
|
./swarm-nats-service.nix
|
|
./swarm-nats.nix
|
|
./swarm-controller.nix
|
|
./swarm-grafana-service.nix
|
|
./swarm-grafana.nix
|
|
./swarm-otel-service.nix
|
|
./swarm-otel.nix
|
|
./swarm-snapshot-store.nix
|
|
./swarm-ui.nix
|
|
./swarm-victorialogs-service.nix
|
|
./swarm-victorialogs.nix
|
|
./swarm-victoriametrics-service.nix
|
|
./swarm-victoriametrics.nix
|
|
./swarm-wireguard.nix
|
|
./swarm.nix
|
|
./host-ca-removed.nix
|
|
./nats-callout-removed.nix
|
|
./swarm-peers-removed.nix
|
|
./swarm-required-services.nix
|
|
];
|
|
}
|