6b1e825c0a
The swarm collector's journald receiver read only the units listed in `services.hyperhive.swarm.otel.journaldUnits`. A unit nobody listed never reached the store, and a misspelt entry shipped nothing without an error. The list existed to keep an operator's desktop session out of a store every swarm operator can read, but the receiver can only match positively, so the only way to express "not user sessions" was to name every service instead. The receiver now reads the whole host journal, and a new `filter/exclude-user-sessions` processor in the `logs/<swarm>` pipeline drops records whose `_SYSTEMD_SLICE` is `user-<uid>.slice` (session scopes and `user@<uid>.service`). The per-hive `logs/<hive>` pipelines carry agent-container journals only and get no filter. `journaldUnits` is removed with `mkRemovedOptionModule`, together with its non-empty assertion and the entry each host module added. The four module-eval membership checks go with it, replaced by one structural case in swarm-otel-core. Closes #3646
59 lines
2.3 KiB
Nix
59 lines
2.3 KiB
Nix
# The hive's dnsmasq resolver. Split out of ./default.nix because it has
|
|
# its own enable: a host can need hive names to resolve without serving a
|
|
# single vhost. Option declared in ./options.nix, config rendered by
|
|
# ./dnsmasq.nix.
|
|
{
|
|
lib,
|
|
config,
|
|
...
|
|
}:
|
|
let
|
|
cfg = config.services.hyperhive.gateway;
|
|
networkCfg = config.services.hyperhive.network;
|
|
hyperhiveDomain = config.services.hyperhive.domain;
|
|
in
|
|
{
|
|
config = lib.mkIf cfg.dns.enable {
|
|
# dnsmasq is a host service alongside nginx, so it reads the host's
|
|
# /etc/resolv.conf directly and picks up network changes as they
|
|
# happen — no copy to keep in sync.
|
|
services.dnsmasq = import ./dnsmasq.nix {
|
|
inherit
|
|
lib
|
|
cfg
|
|
networkCfg
|
|
hyperhiveDomain
|
|
;
|
|
};
|
|
|
|
# dnsmasq binds the bridge interface and answers with the bridge
|
|
# address, so the resolver is itself a consumer one layer down.
|
|
services.hyperhive.network.enable = lib.mkDefault true;
|
|
|
|
# The host asks the hive's own resolver, at the BRIDGE IP.
|
|
#
|
|
# Every container inherits a COPY of this host's `/etc/resolv.conf`
|
|
# at start (`nixos-containers.nix`: `cp --remove-destination`, one
|
|
# shot, not a bind-mount) — so whatever address is written here is
|
|
# the address every container will try, in its own netns.
|
|
#
|
|
# 🚨 That is why this is the bridge IP and not `127.0.0.1`, and the
|
|
# distinction is load-bearing rather than stylistic:
|
|
#
|
|
# value host host-netns containers bridged containers
|
|
# 127.0.0.1 ok ok THEIR OWN loopback
|
|
# bridge IP ok ok ok
|
|
#
|
|
# dnsmasq binds both `lo` and the bridge (./dnsmasq.nix), so the
|
|
# bridge IP is reachable from the host too — it is the only value
|
|
# correct on both sides of a netns boundary. `resolveLocalQueries`
|
|
# publishes loopback by default, hence both overrides here; the
|
|
# flag stays on for its `resolv-file` plumbing, which is what keeps
|
|
# dnsmasq's own upstreams out of the file we are pointing at it.
|
|
#
|
|
# Cost, stated because it is real: the host's DNS now depends on
|
|
# dnsmasq being up. Every container already did.
|
|
networking.nameservers = lib.mkForce [ networkCfg.bridgeIp ];
|
|
networking.resolvconf.useLocalResolver = lib.mkForce false;
|
|
};
|
|
}
|