depot/docker-infrastructure
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

logging: make host-bound GitOps files reproducibly stageable

Browse Source 
The Portainer stack consumes its compose file from Git but bind-mounts runtime configuration from stable paths under /mnt/containers/logging. The stable host copy of docker-compose.yaml had consequently fallen behind the deployed Git revision even though the running stack and dashboard files were current.\n\nAdd a root-run staging/check helper that copies and byte-verifies Compose, Loki, Alloy, syslog-ng, Grafana provisioning, and both dashboards without touching credentials or persistent data. Document the workflow and the final source-restricted passive Agent 2 interfaces for all four Telemt hosts.\n\nValidated with bash -n and git diff --check. Unrelated .DS_Store changes remain untracked/uncommitted.
This commit is contained in:
pipistrello
2026-07-31 14:41:22 +03:00
parent 9bebace46d
commit f0889261b2
2 changed files with 69 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
logging/README.md
+13 -4
View File
@@ -31,7 +31,16 @@ and 601.
## Host files
The Git-backed compose file intentionally bind-mounts stable host paths.
Before deployment, the repository files must be copied to:
Before deployment, stage and verify every tracked runtime file with:
```bash
sudo logging/stage-host-files.sh
sudo logging/stage-host-files.sh --check
```
The script copies only non-secret configuration and dashboard files. Portainer
still supplies `GRAFANA_ADMIN_PASSWORD` and `ZABBIX_API_TOKEN` out of band.
The resulting layout is:
```text
/mnt/containers/logging/
@@ -128,9 +137,9 @@ Agent 2 `Hostname`; Grafana selects the **Visible name** shown below.
Import `zabbix-template-telemt-active.yaml`, link **Telemt proxy by active
agent** to all four hosts, and ensure each host is in the `Linux servers`
group. All four send active checks to `185.108.4.158`. Client 02 should have no
DEPOT passive-agent interface; its existing local Zabbix server continues to
perform the host's passive Linux checks independently.
group. All four send active checks to `185.108.4.158` and have source-restricted
passive Agent 2 interfaces on TCP `10050`. Client 02's existing local Zabbix
server continues to perform its original passive Linux checks independently.
The matching host-side collector is in `zabbix-agent/`. It enters only the
Telemt container network namespace for the control API, discards links and