From d045653a7b5c54868af3e5372345993edeba24d1 Mon Sep 17 00:00:00 2001 From: Anton Afanasyeu Date: Mon, 6 Jul 2026 17:05:55 +0200 Subject: [PATCH] fix(monitoring): drop deprecated artc0 from cast04 scrape targets MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit artc0 VM is off; remove node_exporter target and relabel rules from Prometheus. Point Grafana auth-proxy whitelist and alert-notifier shortener API at cast01–03 cluster instead of 10.7.16.128. Co-authored-by: Cursor --- monitoring/README.md | 10 ++++------ monitoring/cast04/alert-notifier.env | 2 +- monitoring/cast04/alert-notifier.py | 2 +- monitoring/cast04/grafana.ini | 4 ++-- monitoring/cast04/prometheus.yml | 5 ----- 5 files changed, 8 insertions(+), 15 deletions(-) diff --git a/monitoring/README.md b/monitoring/README.md index 3cbdd72..f0be5a1 100644 --- a/monitoring/README.md +++ b/monitoring/README.md @@ -14,8 +14,7 @@ | cast04 | 10.7.16.239 | Monitoring host | Prometheus + Grafana + Alertmanager + blackbox + node | | cast01 | 10.7.16.236 | App + Gitea + PostgreSQL | node + postgres_exporter | | cast02 | 10.7.16.237 | App | node_exporter | -| cast03 | 10.7.16.238 | App | node_exporter | -| artc0 | 10.7.16.128 | BE + MariaDB + Docker | node + mysqld_exporter (Docker) | +| cast03 | 10.7.16.238 | App + MariaDB replica | node_exporter | ## Access @@ -37,13 +36,12 @@ | `/var/lib/grafana/provisioning/` | Auto-provisioned datasource + dashboards dir | | `/etc/conf.d/grafana` | Grafana runtime overrides (bind address, provisioning path) | -## Config files (on artc0/BE) +## Config files (on cast01–03 BE) | File | Purpose | |------|---------| -| `/etc/nginx/conf.d/apps.conf` | BE nginx — includes monitoring proxy location | -| `/var/www/.../api/grafana-auth-check.php` | PHP session → X-WEBAUTH-USER auth bridge | -| `/etc/mysqld-exporter.cnf` | MariaDB exporter credentials | +| `/etc/nginx/conf.d/androidcast.conf` | BE nginx — Grafana/Alertmanager proxy + auth_request | +| `/var/www/ac/composed/backend/public/api/grafana-auth-check.php` | PHP session → X-WEBAUTH-USER auth bridge | ## Services management (cast04) diff --git a/monitoring/cast04/alert-notifier.env b/monitoring/cast04/alert-notifier.env index 5ae932e..def2dd7 100644 --- a/monitoring/cast04/alert-notifier.env +++ b/monitoring/cast04/alert-notifier.env @@ -2,7 +2,7 @@ # Keep this file readable only by the service user (chmod 600). # ── URL shortener ────────────────────────────────────────────────────────── -SHORTENER_INTERNAL=http://10.7.16.128 +SHORTENER_INTERNAL=http://10.7.16.236 SHORTENER_HOST_HDR=s.f0xx.org SHORTENER_BEARER=3b7031ef38d9a5cb33f6b2e789c27fe8ae32c743f6aa8df7 SHORTENER_TTL=86400 diff --git a/monitoring/cast04/alert-notifier.py b/monitoring/cast04/alert-notifier.py index 438eb41..6056180 100644 --- a/monitoring/cast04/alert-notifier.py +++ b/monitoring/cast04/alert-notifier.py @@ -27,7 +27,7 @@ import sys import pathlib # ── Config defaults (overridden by .env file) ─────────────────────────────── -SHORTENER_INTERNAL = os.environ.get('SHORTENER_INTERNAL', 'http://10.7.16.128') +SHORTENER_INTERNAL = os.environ.get('SHORTENER_INTERNAL', 'http://10.7.16.236') SHORTENER_HOST_HDR = os.environ.get('SHORTENER_HOST_HDR', 's.f0xx.org') SHORTENER_BEARER = os.environ.get('SHORTENER_BEARER', '') SHORTENER_TTL = int(os.environ.get('SHORTENER_TTL', '86400')) # 1 day default diff --git a/monitoring/cast04/grafana.ini b/monitoring/cast04/grafana.ini index c506dc6..d5156fe 100644 --- a/monitoring/cast04/grafana.ini +++ b/monitoring/cast04/grafana.ini @@ -53,8 +53,8 @@ enabled = true header_name = X-WEBAUTH-USER header_property = username auto_sign_up = true -# Only trust the header from artc0 nginx (10.7.16.128): -whitelist = 10.7.16.128 +# Trust X-WEBAUTH-USER only from cluster BE nginx (cast01–03): +whitelist = 10.7.16.236,10.7.16.237,10.7.16.238 # Sync roles from header (optional, set X-WEBAUTH-ROLE in nginx if needed): # headers = Role:X-WEBAUTH-ROLE diff --git a/monitoring/cast04/prometheus.yml b/monitoring/cast04/prometheus.yml index e1715e0..1be3133 100644 --- a/monitoring/cast04/prometheus.yml +++ b/monitoring/cast04/prometheus.yml @@ -27,7 +27,6 @@ scrape_configs: - '10.7.16.237:9100' # cast02 - '10.7.16.238:9100' # cast03 - '10.7.16.239:9100' # cast04 (self) - - '10.7.16.128:9100' # artc0 (legacy, monitoring only) labels: env: 'production' relabel_configs: @@ -47,10 +46,6 @@ scrape_configs: regex: '(10\.7\.16\.239):.*' target_label: instance replacement: 'cast04' - - source_labels: [__address__] - regex: '(10\.7\.16\.128):.*' - target_label: instance - replacement: 'artc0' # ── blackbox_exporter — internal HTTP probes (no TLS issues) ──────────────── - job_name: 'blackbox_http'