vlagent: init at 1.25.0

[Shawn8901]

Adds vlagent to nixpkgs which is an agent to collect logs from compatible sources and forward them to a victorialogs instance.

With vlagent one can protect a victorialogs instance with basic auth and insert logs via non accessible endpoints from localhost to vlagent without any authentication.

That results in having a quite easy setup without tinkering with mTLS.

The pattern to build vlagent is similar to what is done for vmagent.

Requires #423260 to be merged before and i am planning to rebase this branch after merge.

I am already creating it as draft to gather some early feedback on the PR.

Things done

• Built on platform(s)
  • x86_64-linux
  • aarch64-linux
  • x86_64-darwin
  • aarch64-darwin
• For non-Linux: Is sandboxing enabled in nix.conf? (See Nix manual)
  • sandbox = relaxed
  • sandbox = true
• Tested, as applicable:
  • NixOS test(s) (look inside nixos/tests)
  • and/or package tests
  • or, for functions and "core" functionality, tests in lib/tests or pkgs/test
  • made sure NixOS tests are linked to the relevant packages
• Tested compilation of all packages that depend on this change using nix-shell -p nixpkgs-review --run "nixpkgs-review rev HEAD". Note: all changes have to be committed, also see nixpkgs-review usage
• Tested basic functionality of all binary files (usually in ./result/bin/)
• Nixpkgs 25.11 Release Notes (or backporting 25.05 Nixpkgs Release notes)
  • (Package updates) Added a release notes entry if the change is major or breaking
• NixOS 25.11 Release Notes (or backporting 25.05 NixOS Release notes)
  • (Module updates) Added a release notes entry if the change is significant
  • (Module addition) Added a release notes entry if adding a new NixOS module
• Fits CONTRIBUTING.md, pkgs/README.md, maintainers/README.md and other contributing documentation in corresponding paths.

---

Add a 👍 reaction to pull requests you find important.

[Shawn8901]

@sinavir fyi as you have requested vlagent in #423260 (comment)

[NyCodeGHG]

I'm not sure if an extra test is worth it for the remote write, I don't have a strong opinion but it could be moved into the other test with subtests so that it tests both scenarios, otherwise looks good to me

[Shawn8901]

yeah i can combine the two scenarios and write one from server machine and keep the remote one, ill take a look.

I was first thinking about that, but dropped initially that idea as it might then be hard to tell wether vlagent, journald upload or victorialogs is broken.
But on the other hand you are right that it might not be worth to keep it as two separat tests.

edit: ah okay i remember again another reason i have choosen 2 tests.
I wanted to include basic auth into the testing, as that is the main reason i am interested into vlagent.
But you can not insert data with systemd-journald-upload in case the victorialogs instance has basic auth enabled.
So i would kinda prefer to keep 2 tests, as i find both upload scenarios are something that we should test for.

[Shawn8901]

Drafting, seems to have broken something on the latest changes, have to analyse it.

[Shawn8901]

So i fixed it again. I hopefully found an acceptable inbetween solution.

I am now using escapeShellArgs for the "well-defined" parts and add escapeSystemdExecArgs or all extra arguments.

[sinavir]

Looks nice to me, I think maybe one could add maxDiskUsagePerUrl options because it is useful in my opinion but since we have extraArgs, it is just a suggestion

[nixos-discourse]

This pull request has been mentioned on NixOS Discourse. There might be relevant details there:

https://discourse.nixos.org/t/prs-ready-for-review/3032/5704

[nixos-discourse]

This pull request has been mentioned on NixOS Discourse. There might be relevant details there:

https://discourse.nixos.org/t/prs-ready-for-review/3032/5731

[nixos-discourse]

This pull request has been mentioned on NixOS Discourse. There might be relevant details there:

https://discourse.nixos.org/t/prs-ready-for-review/3032/5770