ac/ac-deploy
1
0
Fork 0
mirror of git://f0xx.org/ac/ac-deploy synced 2026-07-29 00:58:20 +03:00
Code Issues Packages Projects Releases Wiki Activity

fix(monitoring): drop deprecated artc0 from cast04 scrape targets

Browse Source 
artc0 VM is off; remove node_exporter target and relabel rules from
Prometheus. Point Grafana auth-proxy whitelist and alert-notifier
shortener API at cast01–03 cluster instead of 10.7.16.128.

Co-authored-by: Cursor <cursoragent@cursor.com>
This commit is contained in:
Anton Afanasyeu
2026-07-06 17:05:55 +02:00
parent c23ad5efdc
commit d045653a7b
5 changed files with 8 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
monitoring/README.md
View File

@@ -14,8 +14,7 @@
| cast04 | 10.7.16.239 | Monitoring host | Prometheus + Grafana + Alertmanager + blackbox + node |
| cast01 | 10.7.16.236 | App + Gitea + PostgreSQL | node + postgres_exporter |
| cast02 | 10.7.16.237 | App | node_exporter |
| cast03 | 10.7.16.238 | App | node_exporter |
| artc0 | 10.7.16.128 | BE + MariaDB + Docker | node + mysqld_exporter (Docker) |
| cast03 | 10.7.16.238 | App + MariaDB replica | node_exporter |
## Access
@@ -37,13 +36,12 @@
| `/var/lib/grafana/provisioning/` | Auto-provisioned datasource + dashboards dir |
| `/etc/conf.d/grafana` | Grafana runtime overrides (bind address, provisioning path) |
## Config files (on artc0/BE)
## Config files (on cast01–03 BE)
| File | Purpose |
|------|---------|
| `/etc/nginx/conf.d/apps.conf` | BE nginx — includes monitoring proxy location |
| `/var/www/.../api/grafana-auth-check.php` | PHP session → X-WEBAUTH-USER auth bridge |
| `/etc/mysqld-exporter.cnf` | MariaDB exporter credentials |
| `/etc/nginx/conf.d/androidcast.conf` | BE nginx — Grafana/Alertmanager proxy + auth_request |
| `/var/www/ac/composed/backend/public/api/grafana-auth-check.php` | PHP session → X-WEBAUTH-USER auth bridge |
## Services management (cast04)

2
monitoring/cast04/alert-notifier.env
View File

@@ -2,7 +2,7 @@
# Keep this file readable only by the service user (chmod 600).
# ── URL shortener ──────────────────────────────────────────────────────────
SHORTENER_INTERNAL=http://10.7.16.128
SHORTENER_INTERNAL=http://10.7.16.236
SHORTENER_HOST_HDR=s.f0xx.org
SHORTENER_BEARER=3b7031ef38d9a5cb33f6b2e789c27fe8ae32c743f6aa8df7
SHORTENER_TTL=86400

2
monitoring/cast04/alert-notifier.py
View File

@@ -27,7 +27,7 @@ import sys
import pathlib
# ── Config defaults (overridden by .env file) ───────────────────────────────
SHORTENER_INTERNAL = os.environ.get('SHORTENER_INTERNAL', 'http://10.7.16.128')
SHORTENER_INTERNAL = os.environ.get('SHORTENER_INTERNAL', 'http://10.7.16.236')
SHORTENER_HOST_HDR = os.environ.get('SHORTENER_HOST_HDR', 's.f0xx.org')
SHORTENER_BEARER = os.environ.get('SHORTENER_BEARER', '')
SHORTENER_TTL = int(os.environ.get('SHORTENER_TTL', '86400')) # 1 day default

4
monitoring/cast04/grafana.ini
View File

@@ -53,8 +53,8 @@ enabled = true
header_name = X-WEBAUTH-USER
header_property = username
auto_sign_up = true
# Only trust the header from artc0 nginx (10.7.16.128):
whitelist = 10.7.16.128
# Trust X-WEBAUTH-USER only from cluster BE nginx (cast01–03):
whitelist = 10.7.16.236,10.7.16.237,10.7.16.238
# Sync roles from header (optional, set X-WEBAUTH-ROLE in nginx if needed):
# headers = Role:X-WEBAUTH-ROLE

5
monitoring/cast04/prometheus.yml
View File

@@ -27,7 +27,6 @@ scrape_configs:
- '10.7.16.237:9100' # cast02
- '10.7.16.238:9100' # cast03
- '10.7.16.239:9100' # cast04 (self)
- '10.7.16.128:9100' # artc0 (legacy, monitoring only)
labels:
env: 'production'
relabel_configs:
@@ -47,10 +46,6 @@ scrape_configs:
regex: '(10\.7\.16\.239):.*'
target_label: instance
replacement: 'cast04'
- source_labels: [__address__]
regex: '(10\.7\.16\.128):.*'
target_label: instance
replacement: 'artc0'
# ── blackbox_exporter — internal HTTP probes (no TLS issues) ────────────────
- job_name: 'blackbox_http'