From 229fddfc89974aec70739eb8241a7c6b603547a7 Mon Sep 17 00:00:00 2001 From: pipistrello Date: Mon, 27 Jul 2026 09:38:11 +0300 Subject: [PATCH] tailscale-proxy: expose Telemt metrics to client-02 Zabbix Publish Telemt's container metrics port 9090 as 192.168.0.35:9092 because Cockpit already owns host port 9090. Bind the application listener to 0.0.0.0 inside the container and restrict Telemt's metrics whitelist to the client-02 Zabbix server at 192.168.0.34/32.\n\nDocument the Zabbix template macro URL and the Telemt 3.4.25 loopback-binding gotcha. The live endpoint returned HTTP 200 with 40,235 bytes from the Zabbix server; Telemt remained healthy and rebuilt its Telegram DC connections in six seconds. --- tailscale-proxy/README.md | 9 +++++++++ tailscale-proxy/docker-compose.yaml | 4 +++- tailscale-proxy/telemt/telemt.toml.example | 6 ++++++ 3 files changed, 18 insertions(+), 1 deletion(-) diff --git a/tailscale-proxy/README.md b/tailscale-proxy/README.md index 88dd2eb..e457533 100644 --- a/tailscale-proxy/README.md +++ b/tailscale-proxy/README.md @@ -39,3 +39,12 @@ configuration files must already exist on the host before deployment. Full build record and rationale (userspace vs TUN dead-ends, SOCKS5-vs-HTTP, monitoring) is in ops-knowledge: `diagnostics/2026-07-23-02-tekhnohim-docker-tailscale-exit-proxy-stack.md`. + +## Telemt monitoring + +Telemt exports Prometheus metrics on container port `9090`, published as +`http://192.168.0.35:9092/metrics` because host port `9090` is reserved by +Cockpit. The Telemt application whitelist permits only the client-02 Zabbix +server (`192.168.0.34/32`). In Zabbix, import Telemt's upstream +`tools/zbx_telemt_template.yaml`, link it to the Docker host, and set +`{$TELEMT_URL}` to the URL above. diff --git a/tailscale-proxy/docker-compose.yaml b/tailscale-proxy/docker-compose.yaml index 4b9d058..1b9c971 100644 --- a/tailscale-proxy/docker-compose.yaml +++ b/tailscale-proxy/docker-compose.yaml @@ -54,9 +54,11 @@ services: - "/mnt/containers/tailscale-proxy/telemt/telemt.toml:/app/config.toml:ro,z" ports: - "192.168.0.35:1080:1080" + # Host :9090 belongs to Cockpit; expose Telemt metrics on :9092 instead. + - "192.168.0.35:9092:9090" # Stays on json-file: telemt's tracing logs don't ship cleanly over the # syslog driver, and `docker logs ts-lan-telemt` is worth keeping for this - # critical service. Observe it there (or wire its Prometheus metrics later). + # critical service. Prometheus metrics are scraped by Zabbix on :9092. networks: [proxynet] networks: diff --git a/tailscale-proxy/telemt/telemt.toml.example b/tailscale-proxy/telemt/telemt.toml.example index 7c0e5cf..1645eea 100644 --- a/tailscale-proxy/telemt/telemt.toml.example +++ b/tailscale-proxy/telemt/telemt.toml.example @@ -22,6 +22,12 @@ tls = true # ee / FakeTLS [server] port = 1080 +# Host TCP :9090 is Cockpit, so compose maps host 192.168.0.35:9092 to this +# container port. Explicit 0.0.0.0 is required because metrics_port alone binds +# Telemt 3.4.25 to container loopback. Only the client-02 Zabbix server may scrape. +metrics_port = 9090 +metrics_listen = "0.0.0.0:9090" +metrics_whitelist = ["192.168.0.34/32"] [censorship] tls_domain = "www.google.com" # SNI presented in the Fake-TLS handshake; tunable