depot/docker-infrastructure
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

logging: make host-bound GitOps files reproducibly stageable

Browse Source 
The Portainer stack consumes its compose file from Git but bind-mounts runtime configuration from stable paths under /mnt/containers/logging. The stable host copy of docker-compose.yaml had consequently fallen behind the deployed Git revision even though the running stack and dashboard files were current.\n\nAdd a root-run staging/check helper that copies and byte-verifies Compose, Loki, Alloy, syslog-ng, Grafana provisioning, and both dashboards without touching credentials or persistent data. Document the workflow and the final source-restricted passive Agent 2 interfaces for all four Telemt hosts.\n\nValidated with bash -n and git diff --check. Unrelated .DS_Store changes remain untracked/uncommitted.
This commit is contained in:
pipistrello
2026-07-31 14:41:22 +03:00
parent 9bebace46d
commit f0889261b2
2 changed files with 69 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
logging/README.md
+13 -4
View File
@@ -31,7 +31,16 @@ and 601.
## Host files
The Git-backed compose file intentionally bind-mounts stable host paths.
Before deployment, the repository files must be copied to:
Before deployment, stage and verify every tracked runtime file with:
```bash
sudo logging/stage-host-files.sh
sudo logging/stage-host-files.sh --check
```
The script copies only non-secret configuration and dashboard files. Portainer
still supplies `GRAFANA_ADMIN_PASSWORD` and `ZABBIX_API_TOKEN` out of band.
The resulting layout is:
```text
/mnt/containers/logging/
@@ -128,9 +137,9 @@ Agent 2 `Hostname`; Grafana selects the **Visible name** shown below.
Import `zabbix-template-telemt-active.yaml`, link **Telemt proxy by active
agent** to all four hosts, and ensure each host is in the `Linux servers`
group. All four send active checks to `185.108.4.158`. Client 02 should have no
DEPOT passive-agent interface; its existing local Zabbix server continues to
perform the host's passive Linux checks independently.
group. All four send active checks to `185.108.4.158` and have source-restricted
passive Agent 2 interfaces on TCP `10050`. Client 02's existing local Zabbix
server continues to perform its original passive Linux checks independently.
The matching host-side collector is in `zabbix-agent/`. It enters only the
Telemt container network namespace for the control API, discards links and
logging/stage-host-files.sh
Executable
+56
View File
@@ -0,0 +1,56 @@
#!/usr/bin/env bash
set -euo pipefail
mode="stage"
if [[ "${1:-}" == "--check" ]]; then
mode="check"
shift
fi
target_root="${1:-/mnt/containers/logging}"
source_root="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
mappings=(
"docker-compose.yaml:docker-compose.yaml"
"alloy-config.alloy:alloy-config/config.alloy"
"loki-config.yaml:loki-config/config.yaml"
"syslog-ng.conf:syslog-ng-config/syslog-ng.conf"
"grafana-provisioning/dashboards/dashboards.yaml:grafana-config/provisioning/dashboards/dashboards.yaml"
"grafana-provisioning/datasources/loki.yaml:grafana-config/provisioning/datasources/loki.yaml"
"grafana-provisioning/datasources/zabbix.yaml:grafana-config/provisioning/datasources/zabbix.yaml"
"grafana-dashboards/mikrotik-loki-logs.json:grafana-config/dashboards/mikrotik-loki-logs.json"
"grafana-dashboards/telemt-proxy-fleet.json:grafana-config/dashboards/telemt-proxy-fleet.json"
)
if [[ "${mode}" == "stage" ]]; then
install -d -m 0755 \
"${target_root}/alloy-config" \
"${target_root}/loki-config" \
"${target_root}/syslog-ng-config" \
"${target_root}/grafana-config/provisioning/dashboards" \
"${target_root}/grafana-config/provisioning/datasources" \
"${target_root}/grafana-config/dashboards"
install -d -o 0 -g 0 -m 0755 "${target_root}/alloy-data"
install -d -o 472 -g 0 -m 0755 "${target_root}/grafana-data"
install -d -o 10001 -g 10001 -m 0755 "${target_root}/loki-data"
fi
failed=0
for mapping in "${mappings[@]}"; do
source_file="${source_root}/${mapping%%:*}"
target_file="${target_root}/${mapping#*:}"
if [[ "${mode}" == "stage" ]]; then
install -o root -g root -m 0644 "${source_file}" "${target_file}"
fi
if cmp -s "${source_file}" "${target_file}"; then
printf 'OK %s\n' "${target_file}"
else
printf 'DIFF %s\n' "${target_file}" >&2
failed=1
fi
done
exit "${failed}"