b072fbf4d6
A swarm-ci-metrics host unit on a 5-minute timer lists every forge repo's Actions runs as the new read-only ci-metrics account and pushes each finished run's duration and queue wait over OTLP, stamped at the run's stop time. The first pass backfills from run 1. swarm-controller mints the account's token into bao and keeps a ci-metrics team with read on the Actions unit in every organisation. Closes #5376
36 lines
1.2 KiB
Nix
36 lines
1.2 KiB
Nix
# Glue: register the CI run poller as an OIDC client wherever authelia runs.
|
|
#
|
|
# ONE PAIRING PER FILE: that poller ← authelia, and nothing else.
|
|
# Without it authelia mints no secret, the publisher has nothing to copy into
|
|
# the store, and the poller's push is a 401.
|
|
#
|
|
# Gated on authelia being HERE, not on this host running the poller: a
|
|
# client is a row in THIS host's provider config, the split
|
|
# ./glue-ci-runner-otel-oidc-client.nix makes for the same reason.
|
|
{
|
|
lib,
|
|
config,
|
|
...
|
|
}:
|
|
let
|
|
hyperhiveCfg = config.services.hyperhive;
|
|
clientId = hyperhiveCfg.swarm.ci-metrics.clientId;
|
|
in
|
|
{
|
|
config = lib.mkIf hyperhiveCfg.deploy.authelia.enable {
|
|
services.hyperhive.swarm.authelia.oidc.clients = [
|
|
{
|
|
id = clientId;
|
|
description = "HyperHive CI run poller";
|
|
kind = "machine";
|
|
redirectUris = [ ];
|
|
# Its own id as its own permitted audience, the one the swarm
|
|
# collector's receiver for the poller checks.
|
|
audience = [ clientId ];
|
|
# The receiver verifies the token offline against `/jwks.json`;
|
|
# authelia's default opaque handle fails there.
|
|
accessTokenSignedResponseAlg = "RS256";
|
|
}
|
|
];
|
|
};
|
|
}
|