66 lines
2.5 KiB
Nix
66 lines
2.5 KiB
Nix
# The swarm's log store as every hive sees it: the name it answers on and its
|
|
# port, identical on every host. What the host running it decides, and the
|
|
# container itself, are in ./swarm-victorialogs.nix.
|
|
{
|
|
lib,
|
|
config,
|
|
...
|
|
}:
|
|
let
|
|
hyperhiveCfg = config.services.hyperhive;
|
|
swarmDomain = hyperhiveCfg.swarm.domain;
|
|
|
|
# Total on a null swarm domain for the same reason every sibling module is:
|
|
# the required-domain assertion in hive-network.nix should be what an
|
|
# operator sees, not a coercion error from here.
|
|
domainBase = if swarmDomain == null then "invalid" else swarmDomain;
|
|
in
|
|
{
|
|
# What the store IS from any hive's point of view: the name it answers on and
|
|
# the port. `enable`, `package` and `retentionPeriod` are decisions of the
|
|
# host that runs it and live under `deploy.*`.
|
|
options.services.hyperhive.swarm.victorialogs = {
|
|
machine = lib.mkOption {
|
|
type = lib.types.str;
|
|
readOnly = true;
|
|
default = "swarm-victorialogs";
|
|
description = ''
|
|
Container name. Read-only: the name appears in host paths and in
|
|
`machinectl`, so it is a fact other modules may read rather than a
|
|
knob.
|
|
'';
|
|
};
|
|
|
|
otel.clientId = lib.mkOption {
|
|
type = lib.types.str;
|
|
readOnly = true;
|
|
default = "swarm-victorialogs-collector";
|
|
description = ''
|
|
OAuth2 client id the journal forwarder inside the log store's
|
|
container authenticates as, and the audience it asks its token for.
|
|
|
|
Read-only because three hosts have to agree on it: authelia
|
|
registers the client (`glue-victorialogs-otel-oidc-client.nix`),
|
|
the swarm collector admits it on the container's receiver
|
|
(`swarm.otel.serviceProducers`), and the secret publisher carries
|
|
its secret to the store.
|
|
'';
|
|
};
|
|
|
|
domain = lib.mkOption {
|
|
type = lib.types.str;
|
|
default = "logs.${domainBase}";
|
|
defaultText = lib.literalExpression ''"logs.''${services.hyperhive.swarm.domain}"'';
|
|
description = ''
|
|
Name the gateway serves this on, behind the same authelia
|
|
`auth_request` gate as the swarm UI's own vhost. A sibling of the
|
|
swarm's other service names, so the swarm-services sub-CA can
|
|
issue for it — see `hive-tls.nix` for why a service name being a
|
|
sibling rather than a child decides which CA may sign it, and
|
|
`swarm.nix`'s `serviceDomains'` for where this name has to be
|
|
registered for that to actually happen.
|
|
'';
|
|
};
|
|
|
|
};
|
|
}
|