e92f118bda
swarm-metrics reads the swarm's VictoriaMetrics from inside an agent
container: query, query-range, series, labels and label-values, each one
GET against the store's Prometheus read API through the gateway, printing
the store's JSON. It authenticates the way swarm-logs does, with the
agent's own queue secret read from bao under the agent's leaf, sent as
a swarm-agent bearer.
On the metrics store's host the read API's auth map gains an agent arm
ahead of the Grafana one. It routes to swarm-metrics-agent-auth, a
swarm-logs-auth instance logged in under the existing swarm-metrics-auth
leaf, whose bao grant now includes swarm/agents/+/queue read. The check is
rate-limited per address like the log store's
(deploy.victoriametrics.agentAuth{Rate,Burst,VerdictTtl}).
nix/agent-modules/metrics.nix installs the wrapped binary when the hive
forwards HIVE_AGENT_METRICS_URL (from swarm.victoriametrics.domain) and a
store address, the same gate as swarm-logs. Adds the base:swarm-metrics
skill and the CLI reference with its freshness check.
Fixes #5395
32 lines
1.2 KiB
Nix
32 lines
1.2 KiB
Nix
# Glue: point the metrics store's auth responders (Grafana's and the agents')
|
|
# at the bao leaf minted for them.
|
|
#
|
|
# ONE PAIRING PER FILE — the swarm-metrics-auth principal ← bao, and nothing
|
|
# else. Deleting this leaves a metrics store with no responder identity unless
|
|
# the operator names one, which ./swarm-victoriametrics.nix refuses at eval.
|
|
#
|
|
# ⚠️ The minting is NOT here. ./glue-bao-tls.nix holds the CA and signs the
|
|
# leaf. What belongs here is the pairing: which paths the responder presents.
|
|
#
|
|
# ⚠️ Gated on the store running on this host, the only place the leaf is
|
|
# minted. A metrics-store host without the store gets no default here; the
|
|
# operator places the responder's leaf and names it.
|
|
#
|
|
# Everything is `mkDefault`. An operator naming their own paths wins.
|
|
{
|
|
lib,
|
|
config,
|
|
...
|
|
}:
|
|
let
|
|
deployCfg = config.services.hyperhive.deploy;
|
|
pkiDir = import ./lib/bao-pki-dir.nix;
|
|
in
|
|
{
|
|
config = lib.mkIf (deployCfg.victoriametrics.enable && deployCfg.bao.enable) {
|
|
services.hyperhive.deploy.victoriametrics = {
|
|
authBaoClientCertFile = lib.mkDefault "${pkiDir}/metrics-auth.pem";
|
|
authBaoClientKeyFile = lib.mkDefault "${pkiDir}/metrics-auth-key.pem";
|
|
};
|
|
};
|
|
}
|