depot/docker-infrastructure
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

logging: add 02-tekhnohim proxy to Telemt fleet

Browse Source 
Extend the provisioned Telegram proxy fleet selector with visible host name 02-tekhnohim-docker while retaining the existing Agent 2 technical identity Fedora Kirochnaya.\n\nMake the collector read Prometheus metrics from 127.0.0.1:9090 inside the Telemt network namespace. This avoids dependence on host port 9092 and preserves the existing source-restricted metrics publication.\n\nValidated the dashboard with jq, the collector with bash -n, and the deployed Agent 2 keys on Client 02. The unrelated .DS_Store changes remain unstaged.
This commit is contained in:
pipistrello
2026-07-31 14:18:36 +03:00
parent 1fb6899b1f
commit 9bebace46d
3 changed files with 27 additions and 22 deletions
Download Patch File Download Diff File Expand all files Collapse all files
logging/README.md
+14 -12
View File
@@ -112,23 +112,25 @@ entries.
## Telemt / Zabbix monitoring ## Telemt / Zabbix monitoring
The Zabbix server is `10.0.0.11` internally. The DEPOT router at `10.0.0.1` The Zabbix server is `10.0.0.11` internally. The DEPOT router at `10.0.0.1`
publishes TCP `185.108.4.158:10051` only for the three proxy-host egress publishes TCP `185.108.4.158:10051` only for the four proxy-host egress
addresses, allowing Zabbix Agent 2 active checks without exposing the trapper addresses, allowing Zabbix Agent 2 active checks without exposing the trapper
to the whole internet. to the whole internet.
Create the following Zabbix hosts with these exact technical **Host name** Create the following Zabbix hosts. The technical **Host name** must match the
values (visible names may be friendlier): Agent 2 `Hostname`; Grafana selects the **Visible name** shown below.
| Client | Zabbix Host name | | Client | Zabbix Host name | Visible name |
|---|---| |---|---|---|
| 00-xserver | `00-xserver-fedora-xxx` | | 00-xserver | `00-xserver-fedora-xxx` | `00-xserver-fedora-xxx` |
| 11-nevafud | `11-nevafud-fedora` | | 02-tekhnohim | `Fedora Kirochnaya` | `02-tekhnohim-docker` |
| 19-nutrilent | `19-nutrilent-docker` | | 11-nevafud | `11-nevafud-fedora` | `11-nevafud-fedora` |
| 19-nutrilent | `19-nutrilent-docker` | `19-nutrilent-docker` |
Import `zabbix-template-telemt-active.yaml`, link **Telemt proxy by active Import `zabbix-template-telemt-active.yaml`, link **Telemt proxy by active
agent** to all three hosts, and ensure each host is in the `Linux servers` agent** to all four hosts, and ensure each host is in the `Linux servers`
group. Do not add a passive-agent interface: these hosts are behind NAT and group. All four send active checks to `185.108.4.158`. Client 02 should have no
send active checks to `185.108.4.158`. DEPOT passive-agent interface; its existing local Zabbix server continues to
perform the host's passive Linux checks independently.
The matching host-side collector is in `zabbix-agent/`. It enters only the The matching host-side collector is in `zabbix-agent/`. It enters only the
Telemt container network namespace for the control API, discards links and Telemt container network namespace for the control API, discards links and
@@ -144,7 +146,7 @@ curl -fsS http://127.0.0.1:3000/api/health
``` ```
The provisioned **Network / Telegram proxy fleet** dashboard selects one of The provisioned **Network / Telegram proxy fleet** dashboard selects one of
the three exact host names above and mirrors the Telemt section of the the four visible host names above and mirrors the Telemt section of the
client-02 dashboard: current IP count, active/total connections, IP list, client-02 dashboard: current IP count, active/total connections, IP list,
traffic, and uptime. traffic, and uptime.
logging/grafana-dashboards/telemt-proxy-fleet.json
+6 -1
View File
@@ -44,9 +44,14 @@
"selected": false, "selected": false,
"text": "19-nutrilent-docker", "text": "19-nutrilent-docker",
"value": "19-nutrilent-docker" "value": "19-nutrilent-docker"
},
{
"selected": false,
"text": "02-tekhnohim-docker",
"value": "02-tekhnohim-docker"
} }
], ],
"query": "00-xserver-fedora-xxx,11-nevafud-fedora,19-nutrilent-docker", "query": "00-xserver-fedora-xxx,11-nevafud-fedora,19-nutrilent-docker,02-tekhnohim-docker",
"queryValue": "", "queryValue": "",
"skipUrlSync": false, "skipUrlSync": false,
"type": "custom" "type": "custom"
logging/zabbix-agent/zabbix-telemt-collector
+6 -8
View File
@@ -14,11 +14,6 @@ if [[ -z "${container_pid}" || "${container_pid}" == "0" ]]; then
exit 1 exit 1
fi fi
host_ip="$(ip -4 route get 1.1.1.1 | awk '{for (i=1; i<=NF; i++) if ($i == "src") {print $(i+1); exit}}')"
if [[ -z "${host_ip}" ]]; then
exit 1
fi
json_tmp="$(mktemp "${output_dir}/.telemt-active-ips.json.XXXXXX")" json_tmp="$(mktemp "${output_dir}/.telemt-active-ips.json.XXXXXX")"
text_tmp="$(mktemp "${output_dir}/.telemt-active-ips.txt.XXXXXX")" text_tmp="$(mktemp "${output_dir}/.telemt-active-ips.txt.XXXXXX")"
metrics_tmp="$(mktemp "${output_dir}/.telemt-metrics.prom.XXXXXX")" metrics_tmp="$(mktemp "${output_dir}/.telemt-metrics.prom.XXXXXX")"
@@ -53,10 +48,13 @@ nsenter -t "${container_pid}" -n \
' "${json_tmp}" ' "${json_tmp}"
} > "${text_tmp}" } > "${text_tmp}"
# Cache Prometheus output locally. Zabbix active checks read the cache, so the # Cache Prometheus output from inside Telemt's network namespace. This avoids
# central server does not need a route to each private Docker host. # depending on the host-published metrics port or its source allowlist. Zabbix
# active checks read the cache, so the central server still needs no route to
# the private Docker host.
nsenter -t "${container_pid}" -n \
curl --fail --silent --show-error --max-time 5 \ curl --fail --silent --show-error --max-time 5 \
"http://${host_ip}:9092/metrics" > "${metrics_tmp}" http://127.0.0.1:9090/metrics > "${metrics_tmp}"
chown root:zabbix "${json_tmp}" "${text_tmp}" "${metrics_tmp}" chown root:zabbix "${json_tmp}" "${text_tmp}" "${metrics_tmp}"
chmod 0640 "${json_tmp}" "${text_tmp}" "${metrics_tmp}" chmod 0640 "${json_tmp}" "${text_tmp}" "${metrics_tmp}"