anubis: Support Prometheus metrics server. HEAD main

1 files changed, 26 insertions, 3 deletions

diff --git a/guix/forge/anubis.scm b/guix/forge/anubis.scm
index 6863d40..369daa6 100644
--- a/guix/forge/anubis.scm
+++ b/guix/forge/anubis.scm
@@ -23,6 +23,7 @@
   #:use-module (gnu services)
   #:use-module (gnu services shepherd)
   #:use-module (gnu system file-systems)
+  #:use-module (gnu build linux-container)
   #:use-module (guix build-system gnu)
   #:use-module (guix download)
   #:use-module (guix gexp)
@@ -30,10 +31,12 @@
   #:use-module ((guix licenses) #:prefix license:)
   #:use-module (guix packages)
   #:use-module (guix records)
+  #:use-module (forge socket)
   #:use-module (ice-9 match)
   #:export (anubis-configuration
             anubis-configuration?
             anubis-configuration-package
+            anubis-configuration-metrics-socket
             anubis-service-type
             %anubis-unix-socket))
 
@@ -93,7 +96,9 @@ internet from the endless storm of requests that flood in from AI companies.")
   anubis-configuration make-anubis-configuration
   anubis-configuration?
   (package anubis-configuration-package
-           (default anubis-ai-firewall)))
+           (default anubis-ai-firewall))
+  (metrics-socket anubis-configuration-metrics-socket
+                  (default #f)))
 
 ;; TODO: Do not hard-code.
 (define %anubis-unix-socket
@@ -109,7 +114,7 @@ internet from the endless storm of requests that flood in from AI companies.")
 
 (define anubis-shepherd-service
   (match-lambda
-    (($ <anubis-configuration> package)
+    (($ <anubis-configuration> package metrics-socket)
      (shepherd-service
        (documentation "Run the Anubis AI firewall.")
        (provision '(anubis))
@@ -121,9 +126,27 @@ internet from the endless storm of requests that flood in from AI companies.")
                           #:mappings (list (file-system-mapping
                                              (source (dirname %anubis-unix-socket))
                                              (target source)
-                                             (writable? #t))))
+                                             (writable? #t)))
+                          ;; Run anubis in its own network namespace unless the
+                          ;; metrics server is enabled and we need to expose a
+                          ;; TCP socket to the outside world.
+                          #:namespaces (if metrics-socket
+                                           (delq 'net %namespaces)
+                                           %namespaces))
                        "-bind" #$%anubis-unix-socket
                        "-bind-network" "unix"
+                       #$@(cond
+                           ((not metrics-socket)
+                            (list))
+                           ((forge-ip-socket? metrics-socket)
+                            (list "-metrics-bind"
+                                  (string-append (forge-ip-socket-ip metrics-socket)
+                                                 ":"
+                                                 (number->string (forge-ip-socket-port metrics-socket)))
+                                  "-metrics-bind-network" "tcp"))
+                           (else
+                            (leave (G_ "Invalid metrics socket ~s; only <forge-ip-socket> is supported.~%")
+                                   metrics-socket)))
                        "-target" " ")
                  #:user "nginx"
                  #:group "nginx"