fix(monitoring): drop deprecated artc0 from cast04 scrape targets

artc0 VM is off; remove node_exporter target and relabel rules from
Prometheus. Point Grafana auth-proxy whitelist and alert-notifier
shortener API at cast01–03 cluster instead of 10.7.16.128.

Co-authored-by: Cursor <cursoragent@cursor.com>

monitoring/cast04/alert-notifier.env

@@ -2,7 +2,7 @@
 # Keep this file readable only by the service user (chmod 600).
 
 # ── URL shortener ──────────────────────────────────────────────────────────
-SHORTENER_INTERNAL=http://10.7.16.128
+SHORTENER_INTERNAL=http://10.7.16.236
 SHORTENER_HOST_HDR=s.f0xx.org
 SHORTENER_BEARER=3b7031ef38d9a5cb33f6b2e789c27fe8ae32c743f6aa8df7
 SHORTENER_TTL=86400

monitoring/cast04/alert-notifier.py

@@ -27,7 +27,7 @@ import sys
 import pathlib
 
 # ── Config defaults (overridden by .env file) ───────────────────────────────
-SHORTENER_INTERNAL = os.environ.get('SHORTENER_INTERNAL', 'http://10.7.16.128')
+SHORTENER_INTERNAL = os.environ.get('SHORTENER_INTERNAL', 'http://10.7.16.236')
 SHORTENER_HOST_HDR = os.environ.get('SHORTENER_HOST_HDR', 's.f0xx.org')
 SHORTENER_BEARER   = os.environ.get('SHORTENER_BEARER',   '')
 SHORTENER_TTL      = int(os.environ.get('SHORTENER_TTL',  '86400'))   # 1 day default

monitoring/cast04/grafana.ini

@@ -53,8 +53,8 @@ enabled = true
 header_name = X-WEBAUTH-USER
 header_property = username
 auto_sign_up = true
-# Only trust the header from artc0 nginx (10.7.16.128):
-whitelist = 10.7.16.128
+# Trust X-WEBAUTH-USER only from cluster BE nginx (cast01–03):
+whitelist = 10.7.16.236,10.7.16.237,10.7.16.238
 # Sync roles from header (optional, set X-WEBAUTH-ROLE in nginx if needed):
 # headers = Role:X-WEBAUTH-ROLE
 

monitoring/cast04/prometheus.yml

@@ -27,7 +27,6 @@ scrape_configs:
           - '10.7.16.237:9100'   # cast02
           - '10.7.16.238:9100'   # cast03
           - '10.7.16.239:9100'   # cast04 (self)
-          - '10.7.16.128:9100'   # artc0 (legacy, monitoring only)
         labels:
           env: 'production'
     relabel_configs:
@@ -47,10 +46,6 @@ scrape_configs:
         regex: '(10\.7\.16\.239):.*'
         target_label: instance
         replacement: 'cast04'
-      - source_labels: [__address__]
-        regex: '(10\.7\.16\.128):.*'
-        target_label: instance
-        replacement: 'artc0'
 
   # ── blackbox_exporter — internal HTTP probes (no TLS issues) ────────────────
   - job_name: 'blackbox_http'