DEPOT logging: add Telemt fleet monitoring via Zabbix

Install and persist Grafana Zabbix plugin 6.5.0, provision the internal Zabbix datasource, and add a fleet dashboard modeled on client 02 Telemt panels.

Add an active-agent Zabbix 7 template plus a 30-second sanitized collector for active IP count/list, connections, traffic, and uptime. Active checks avoid inbound polling of client-private Docker hosts.

The exact Zabbix host names and required ZABBIX_API_TOKEN Portainer variable are documented. Compose validation passed on 10.0.0.6; the live plugin registered successfully under Grafana 13.1.0.

logging/README.md

@@ -5,18 +5,24 @@ part of the manual `mktxp-stack`:
 
 - `loki` stores syslog in the persistent host path
   `/mnt/containers/logging/loki-data`;
-- `alloy` replaces the `syslog-ng` -> `promtail` relay;
-- `grafana` provides the existing MikroTik Loki dashboard.
+- `syslog-ng` accepts and normalizes the fleet's mixed/raw syslog formats;
+- `alloy` replaces Promtail and sends normalized RFC5424 to Loki;
+- `grafana` provides the MikroTik Loki dashboard and a Telemt fleet dashboard
+  backed by the internal DEPOT Zabbix server.
 
-The retired stack's `mktxp`, Prometheus, Promtail, and syslog-ng services are
-not part of this stack.
+The retired stack's `mktxp`, Prometheus, and Promtail services are not part of
+this stack. syslog-ng remains because real DEPOT RouterOS traffic includes raw
+messages that Alloy's strict RFC3164 parser rejects.
 
 ## Portainer settings
 
 - Repository: `https://git.it-depot.ru/depot/docker-infrastructure`
 - Branch: `master`
 - Compose path: `logging/docker-compose.yaml`
-- Required environment variable: `GRAFANA_ADMIN_PASSWORD`
+- Required environment variables:
+  - `GRAFANA_ADMIN_PASSWORD`
+  - `ZABBIX_API_TOKEN` — token for a read-only Zabbix API user; it is passed
+    into Grafana's provisioned datasource and must not be committed.
 
 Do not deploy the new stack before completing the cutover below: the current
 containers still own names `loki` and `grafana` and host ports 3000, 3100, 514,
@@ -33,12 +39,14 @@ Before deployment, the repository files must be copied to:
 ├── alloy-data/
 ├── grafana-config/
 │   ├── dashboards/mikrotik-loki-logs.json
+│   ├── dashboards/telemt-proxy-fleet.json
 │   └── provisioning/
 │       ├── dashboards/dashboards.yaml
-│       └── datasources/loki.yaml
+│       └── datasources/{loki,zabbix}.yaml
 ├── grafana-data/
 ├── loki-config/config.yaml
-└── loki-data/
+├── loki-data/
+└── syslog-ng-config/syslog-ng.conf
 ```
 
 SELinux is enforcing. The compose mounts use `:Z`; do not remove those flags.
@@ -47,10 +55,11 @@ Loki `10001:10001`, Grafana `472:0`, and Alloy `0:0`.
 
 ## Cutover
 
-The live Loki history is inside the old container at `/tmp/loki`. A stopped,
-consistent rescue copy from 2026-07-30 is pre-seeded in the new host path, but
-it must be refreshed from the stopped live container immediately before the
-old stack is removed:
+The live Loki history is inside the old container at `/tmp/loki`. Do not merge
+a newer WAL over an older rescue WAL: the resulting non-contiguous segment
+sequence makes Loki fail with `segments are not sequential`. Instead, move the
+seed aside and copy the stopped container's complete data directory as one
+generation:
 
 ```bash
 cd /mnt/containers/mktxp/mktxp-stack
@@ -59,8 +68,10 @@ cd /mnt/containers/mktxp/mktxp-stack
 curl -fsS http://127.0.0.1:3100/ready
 docker compose stop
 
-# The stopped Loki container still contains the newest WAL/chunks.
-docker cp -a loki:/tmp/loki/. /mnt/containers/logging/loki-data/
+# Preserve the seed separately; never overlay WAL generations.
+mv /mnt/containers/logging/loki-data \
+  /mnt/containers/logging/loki-data-rescue-seed-2026-07-30
+docker cp -a loki:/tmp/loki /mnt/containers/logging/loki-data
 chown -R 10001:10001 /mnt/containers/logging/loki-data
 
 # Removes containers and the old network, but NOT the old named Grafana and
@@ -98,6 +109,45 @@ In Grafana, the provisioned **Network / Mikrotik Loki Logs** dashboard should
 list existing `routerboard` values and show both pre-cutover and post-cutover
 entries.
 
+## Telemt / Zabbix monitoring
+
+The Zabbix server is `10.0.0.11` internally. The DEPOT router at `10.0.0.1`
+publishes TCP `185.108.4.158:10051` only for the three proxy-host egress
+addresses, allowing Zabbix Agent 2 active checks without exposing the trapper
+to the whole internet.
+
+Create the following Zabbix hosts with these exact technical **Host name**
+values (visible names may be friendlier):
+
+| Client | Zabbix Host name |
+|---|---|
+| 00-xserver | `00-xserver-fedora-xxx` |
+| 11-nevafud | `11-nevafud-fedora` |
+| 19-nutrilent | `19-nutrilent-docker` |
+
+Import `zabbix-template-telemt-active.yaml`, link **Telemt proxy by active
+agent** to all three hosts, and ensure each host is in the `Linux servers`
+group. Do not add a passive-agent interface: these hosts are behind NAT and
+send active checks to `185.108.4.158`.
+
+The matching host-side collector is in `zabbix-agent/`. It enters only the
+Telemt container network namespace for the control API, discards links and
+secrets, caches the active-IP list and Prometheus values, and exposes
+read-only Agent 2 keys. The active-IP list retains one day of history; the
+numeric count and other counters retain 31 days.
+
+After redeploying Grafana with a valid `ZABBIX_API_TOKEN`, verify:
+
+```bash
+docker exec grafana grafana cli plugins ls
+curl -fsS http://127.0.0.1:3000/api/health
+```
+
+The provisioned **Network / Telegram proxy fleet** dashboard selects one of
+the three exact host names above and mirrors the Telemt section of the
+client-02 dashboard: current IP count, active/total connections, IP list,
+traffic, and uptime.
+
 ## Rollback
 
 Remove the new Portainer stack, then recreate the old stack with its Loki data