7294707d7d
The metrics store's container now runs the journal forwarder the other service containers run, pushing to a receiver of its own on the swarm collector (serviceProducers swarm-victoriametrics) as a new machine OIDC client (swarm.victoriametrics.otel.clientId), registered by a glue file wherever authelia runs and published to the store by the secret publisher. The container keeps its loopback-only netns. The collector cannot dial a unix socket, so swarm-victoriametrics-egress-relay, a socket-activated systemd-socket-proxyd inside the container, takes its connections on 127.0.0.1:4380 and passes them to /run/swarm-victoriametrics-egress/egress.sock. The host's nginx listens there and sends /swarm-victoriametrics/ to the swarm collector and /api/oidc/token to authelia, both by name and verified, and refuses every other path. nginx gets ReadWritePaths on that directory and removes a stale socket before it starts. The container cannot reach the store, so the client secret is fetched on the host by swarm-victoriametrics-forwarder-oidc under swarm-metrics-auth's leaf, the shape swarm-bao-forwarder-oidc has, and bound into the container read-only. The forwarder module gains hostSecretFile for that: set, it renders no fetch unit. swarm-metrics-auth's policy gains one read stanza on the forwarder's client path. The container drops --link-journal=host, and the host collector stops reading it. Also lists the forge publisher's and matrix-ctl's leaves in the forwarder secrets row of docs/swarm/secrets.md, which the hive-forge/hive-matrix change missed.
91 lines
3 KiB
Nix
91 lines
3 KiB
Nix
# The full hyperhive host stack, pulled together in one place — this
|
|
# is what the flake exports as `nixosModules.default` (wrapped with
|
|
# the package/source wiring; see flake.nix). One import covers
|
|
# everything; `services.hyperhive.deploy.hive-controller.enable = true`
|
|
# runs a hive on this host.
|
|
#
|
|
# Every swarm needs the forge — hive-c0re mirrors every agent's applied
|
|
# config repo into it and it's the canonical store for the meta flake
|
|
# + `internal/*` repos — but only the host with `deploy.forgejo.enable`
|
|
# runs it (derived from `deploy.allSwarmServices`, see
|
|
# ./swarm-required-services.nix). hive-matrix is opt-in (off by default). All
|
|
# subsystems rely on `services.hyperhive.domain`, which is required
|
|
# (asserted in hive-network.nix) wherever this host runs a hive.
|
|
{
|
|
imports = [
|
|
./hyperhive.nix
|
|
./deploy.nix
|
|
./local-defaults.nix
|
|
./hive-c0re
|
|
./hive-forge
|
|
./hive-gateway
|
|
./hive-matrix-service.nix
|
|
./hive-matrix.nix
|
|
./hive-network.nix
|
|
./hive-priv.nix
|
|
./hive-tls.nix
|
|
./otel.nix
|
|
./glue-bao-readers-policy-order.nix
|
|
./glue-bao-readers-store-order.nix
|
|
./glue-bao-tls.nix
|
|
./glue-bao-ui-oidc-client.nix
|
|
./glue-controller-bao-identity.nix
|
|
./glue-controller-env.nix
|
|
./glue-controller-oidc-client.nix
|
|
./glue-forge-controller.nix
|
|
./glue-forge-oidc-client.nix
|
|
./glue-grafana-oidc-client.nix
|
|
./glue-hive-otel-authelia.nix
|
|
./glue-hive-tls-bao-identity.nix
|
|
./glue-logs-auth-bao-identity.nix
|
|
./glue-metrics-auth-bao-identity.nix
|
|
./glue-matrix-ctl-bao-identity.nix
|
|
./glue-matrix-oidc-client.nix
|
|
./glue-nats-auth-bao-identity.nix
|
|
./glue-nats-bao-identity.nix
|
|
./glue-nats-oidc-client.nix
|
|
./glue-nats-wireguard.nix
|
|
./glue-queue-agent-credential.nix
|
|
./glue-builder-oidc-client.nix
|
|
./glue-ci-runner-otel-oidc-client.nix
|
|
./glue-claude-login-oidc-client.nix
|
|
./glue-forge-otel-oidc-client.nix
|
|
./glue-grafana-otel-oidc-client.nix
|
|
./glue-matrix-otel-oidc-client.nix
|
|
./glue-review-classifier-oidc-client.nix
|
|
./glue-secret-publisher-authelia.nix
|
|
./glue-secret-publisher-bao-identity.nix
|
|
./glue-swarm-bao-otel-oidc-client.nix
|
|
./glue-swarm-otel-oidc-client.nix
|
|
./glue-victorialogs-otel-oidc-client.nix
|
|
./glue-victoriametrics-otel-oidc-client.nix
|
|
./swarm-authelia-service.nix
|
|
./swarm-authelia.nix
|
|
./swarm-bao-service.nix
|
|
./swarm-bao.nix
|
|
./swarm-builder.nix
|
|
./swarm-claude-login.nix
|
|
./swarm-ci-runner.nix
|
|
./swarm-review-classifier.nix
|
|
./swarm-secret-publisher.nix
|
|
./swarm-nats-service.nix
|
|
./swarm-nats.nix
|
|
./swarm-controller.nix
|
|
./swarm-grafana-service.nix
|
|
./swarm-grafana.nix
|
|
./swarm-otel-service.nix
|
|
./swarm-otel.nix
|
|
./swarm-snapshot-store.nix
|
|
./swarm-ui.nix
|
|
./swarm-victorialogs-service.nix
|
|
./swarm-victorialogs.nix
|
|
./swarm-victoriametrics-service.nix
|
|
./swarm-victoriametrics.nix
|
|
./swarm-wireguard.nix
|
|
./swarm.nix
|
|
./host-ca-removed.nix
|
|
./nats-callout-removed.nix
|
|
./swarm-peers-removed.nix
|
|
./swarm-required-services.nix
|
|
];
|
|
}
|