6aab2ebb65
The metrics vhost forwarded the store's read API (query, series, labels,
export, vmui, ...) with no credential, so anything that could reach
metrics.<swarm> could read every hive's and agent's metrics. mara ruled on
checked by an auth_request responder, and operators use their authelia
session.
- swarm-metrics-auth (new crate): auth_request responder on the metrics
store's host. Compares the presented bearer, in constant time, with the
one stored at swarm/services/<grafana client id>/metrics/bearer, read
under its own bao leaf and cached for 60s. Static user, the post-#5264
swarm-logs-auth unit shape.
- swarm-bao-grafana-metrics-bearer: on Grafana's host, creates that bearer
in bao if absent (create without update, Grafana's existing leaf) and
writes "Bearer <value>" into the container; the datasource sends it as
its Authorization header via $__file{}.
- The vhost: read locations take auth_request through a map (a bearer goes
to swarm-metrics-auth, anything else to authelia, no login redirect);
vmui takes an authelia session with the login redirect; forceSSL like
the logs vhost. The authelia subrequest location is renamed from
/__metrics_push_authz to /__metrics_authelia since it now serves reads.
- Authelia: the collector keeps every path; everyone else is refused the
collector's push and /metrics paths; group admins is admitted to the
rest; then deny.
- bao: a swarm-metrics-auth cert role and policy (read on the one leaf),
its leaf minted by glue-bao-tls, the CN reserved as a hive name, and
Grafana's grant gains create on the bearer leaf.
Fixes #3596
75 lines
2.8 KiB
Nix
75 lines
2.8 KiB
Nix
# Glue: where the store and one of its readers share a host, the reader waits
|
|
# for the store's container and requires `swarm-bao-pki`, which mints the leaf
|
|
# the reader logs in with.
|
|
#
|
|
# ONE PAIRING PER FILE — the store's container and PKI unit ← the readers that
|
|
# log in to it, and nothing else. The waits on the store's policy units are
|
|
# ./glue-bao-readers-policy-order.nix's.
|
|
#
|
|
# ⚠️ Gated on BOTH the store and that reader being here. Off the store's host
|
|
# neither unit exists, and `Requires=` on an absent unit fails the job, so
|
|
# there the reader's own start timeout bounds the attempt instead. On the
|
|
# store's host without the reader, setting `systemd.services.<reader>.after`
|
|
# would define a unit with no ExecStart, so each gate below restates the one
|
|
# the reader's own module puts on it. A reader whose gate changes must change
|
|
# here too.
|
|
{
|
|
lib,
|
|
config,
|
|
...
|
|
}:
|
|
let
|
|
hyperhiveCfg = config.services.hyperhive;
|
|
deployCfg = hyperhiveCfg.deploy;
|
|
baoDeploy = deployCfg.bao;
|
|
baoCfg = hyperhiveCfg.swarm.bao;
|
|
otel = hyperhiveCfg.otel;
|
|
|
|
havePair = cert: key: cert != null && key != null;
|
|
|
|
# Reader unit → the gate its own module defines it under.
|
|
readersHere = {
|
|
# ./hive-forge/default.nix
|
|
swarm-bao-forge-oidc = deployCfg.forgejo.enable;
|
|
swarm-bao-forge-publisher = deployCfg.forgejo.enable;
|
|
# ./hive-matrix.nix
|
|
swarm-bao-matrix-oidc = deployCfg.matrix.enable;
|
|
# ./otel.nix: `fetches`, the collector loading the file this unit writes
|
|
# under the hive's own leaf.
|
|
swarm-bao-hive-otel-oidc =
|
|
otel.enable
|
|
&& hyperhiveCfg.hiveName != null
|
|
&& havePair baoDeploy.clientCertFile baoDeploy.clientKeyFile
|
|
&&
|
|
otel.clientSecretFile
|
|
== "/var/lib/hive-otel-oidc/${hyperhiveCfg.swarm.authelia.hiveClientPrefix}${toString hyperhiveCfg.hiveName}.secret";
|
|
# ./swarm-grafana.nix
|
|
swarm-bao-grafana-oidc = deployCfg.grafana.enable;
|
|
swarm-bao-grafana-admin = deployCfg.grafana.enable;
|
|
swarm-bao-grafana-metrics-bearer = deployCfg.grafana.enable;
|
|
# ./swarm-nats.nix
|
|
swarm-bao-nats-callout-xkey = deployCfg.nats.enable;
|
|
# ./swarm-ci-runner.nix
|
|
swarm-bao-ci-runner = deployCfg.ci-runner.enable;
|
|
# ./swarm-otel.nix
|
|
swarm-bao-otel-oidc =
|
|
deployCfg.swarm-otel.enable
|
|
&& havePair baoDeploy.otelOidcClientCertFile baoDeploy.otelOidcClientKeyFile;
|
|
};
|
|
|
|
orderAfterStore =
|
|
reader: here:
|
|
lib.mkIf (baoDeploy.enable && here) {
|
|
systemd.services.${reader} = {
|
|
after = [
|
|
"swarm-bao-pki.service"
|
|
"container@${baoCfg.machine}.service"
|
|
];
|
|
wants = [ "container@${baoCfg.machine}.service" ];
|
|
requires = [ "swarm-bao-pki.service" ];
|
|
};
|
|
};
|
|
in
|
|
{
|
|
config = lib.mkMerge (lib.mapAttrsToList orderAfterStore readersHere);
|
|
}
|