7294707d7d
The metrics store's container now runs the journal forwarder the other service containers run, pushing to a receiver of its own on the swarm collector (serviceProducers swarm-victoriametrics) as a new machine OIDC client (swarm.victoriametrics.otel.clientId), registered by a glue file wherever authelia runs and published to the store by the secret publisher. The container keeps its loopback-only netns. The collector cannot dial a unix socket, so swarm-victoriametrics-egress-relay, a socket-activated systemd-socket-proxyd inside the container, takes its connections on 127.0.0.1:4380 and passes them to /run/swarm-victoriametrics-egress/egress.sock. The host's nginx listens there and sends /swarm-victoriametrics/ to the swarm collector and /api/oidc/token to authelia, both by name and verified, and refuses every other path. nginx gets ReadWritePaths on that directory and removes a stale socket before it starts. The container cannot reach the store, so the client secret is fetched on the host by swarm-victoriametrics-forwarder-oidc under swarm-metrics-auth's leaf, the shape swarm-bao-forwarder-oidc has, and bound into the container read-only. The forwarder module gains hostSecretFile for that: set, it renders no fetch unit. swarm-metrics-auth's policy gains one read stanza on the forwarder's client path. The container drops --link-journal=host, and the host collector stops reading it. Also lists the forge publisher's and matrix-ctl's leaves in the forwarder secrets row of docs/swarm/secrets.md, which the hive-forge/hive-matrix change missed.
37 lines
1.3 KiB
Nix
37 lines
1.3 KiB
Nix
# Glue: register the metrics store container's journal forwarder as an OIDC
|
|
# client wherever authelia runs.
|
|
#
|
|
# ONE PAIRING PER FILE: that forwarder ← authelia, and nothing else.
|
|
# Without it authelia mints no secret, the publisher has nothing to copy into
|
|
# the store, and the forwarder's export is a 401.
|
|
#
|
|
# Gated on authelia being HERE, not on this host running the metrics store: a
|
|
# client is a row in THIS host's provider config, the split
|
|
# ./glue-swarm-bao-otel-oidc-client.nix makes for the same reason.
|
|
{
|
|
lib,
|
|
config,
|
|
...
|
|
}:
|
|
let
|
|
hyperhiveCfg = config.services.hyperhive;
|
|
clientId = hyperhiveCfg.swarm.victoriametrics.otel.clientId;
|
|
in
|
|
{
|
|
config = lib.mkIf hyperhiveCfg.deploy.authelia.enable {
|
|
services.hyperhive.swarm.authelia.oidc.clients = [
|
|
{
|
|
id = clientId;
|
|
description = "HyperHive metrics store journal forwarder";
|
|
kind = "machine";
|
|
redirectUris = [ ];
|
|
# Its own id as its own permitted audience, the one the swarm
|
|
# collector's receiver for this container checks.
|
|
audience = [ clientId ];
|
|
# The receiver verifies the token offline against `/jwks.json`;
|
|
# authelia's default opaque handle fails there.
|
|
accessTokenSignedResponseAlg = "RS256";
|
|
}
|
|
];
|
|
};
|
|
}
|