d30cb7d122
The mint creates each client's secret in the swarm secret store and writes only the digest to disk. It mints only when the store answers and holds none. A new unit moves the plaintext files an earlier release left into the store and removes each once the store holds the same value. The bridge reads its secret from the store into /run before each start. The secret publisher unit and its path unit are gone.
66 lines
2.5 KiB
Nix
66 lines
2.5 KiB
Nix
# The swarm's log store as every hive sees it: the name it answers on and its
|
|
# port, identical on every host. What the host running it decides, and the
|
|
# container itself, are in ./swarm-victorialogs.nix.
|
|
{
|
|
lib,
|
|
config,
|
|
...
|
|
}:
|
|
let
|
|
hyperhiveCfg = config.services.hyperhive;
|
|
swarmDomain = hyperhiveCfg.swarm.domain;
|
|
|
|
# Total on a null swarm domain for the same reason every sibling module is:
|
|
# the required-domain assertion in hive-network.nix should be what an
|
|
# operator sees, not a coercion error from here.
|
|
domainBase = if swarmDomain == null then "invalid" else swarmDomain;
|
|
in
|
|
{
|
|
# What the store IS from any hive's point of view: the name it answers on and
|
|
# the port. `enable`, `package` and `retentionPeriod` are decisions of the
|
|
# host that runs it and live under `deploy.*`.
|
|
options.services.hyperhive.swarm.victorialogs = {
|
|
machine = lib.mkOption {
|
|
type = lib.types.str;
|
|
readOnly = true;
|
|
default = "swarm-victorialogs";
|
|
description = ''
|
|
Container name. Read-only: the name appears in host paths and in
|
|
`machinectl`, so it is a fact other modules may read rather than a
|
|
knob.
|
|
'';
|
|
};
|
|
|
|
otel.clientId = lib.mkOption {
|
|
type = lib.types.str;
|
|
readOnly = true;
|
|
default = "swarm-victorialogs-collector";
|
|
description = ''
|
|
OAuth2 client id the journal forwarder inside the log store's
|
|
container authenticates as, and the audience it asks its token for.
|
|
|
|
Read-only because three hosts have to agree on it: authelia
|
|
registers the client (`glue-victorialogs-otel-oidc-client.nix`),
|
|
the swarm collector admits it on the container's receiver
|
|
(`swarm.otel.serviceProducers`), and authelia's mint stores
|
|
its secret in the store.
|
|
'';
|
|
};
|
|
|
|
domain = lib.mkOption {
|
|
type = lib.types.str;
|
|
default = "logs.${domainBase}";
|
|
defaultText = lib.literalExpression ''"logs.''${services.hyperhive.swarm.domain}"'';
|
|
description = ''
|
|
Name the gateway serves this on, behind the same authelia
|
|
`auth_request` gate as the swarm UI's own vhost. A sibling of the
|
|
swarm's other service names, so the swarm-services sub-CA can
|
|
issue for it — see `hive-tls.nix` for why a service name being a
|
|
sibling rather than a child decides which CA may sign it, and
|
|
`swarm.nix`'s `serviceDomains'` for where this name has to be
|
|
registered for that to actually happen.
|
|
'';
|
|
};
|
|
|
|
};
|
|
}
|