technohim/docker-infrastructure
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

tailscale proxy: collect sanitized Telemt active IP list

Browse Source 
Telemt's Prometheus endpoint exposes only active-IP counts, while its loopback control API includes both the address list and sensitive proxy links. Add a root systemd timer that enters the Telemt container network namespace, filters the API response in memory, and publishes only username/address rows through the Zabbix agent key telemt.active_ips.list.\n\nThe collector refreshes every 30 seconds, writes atomically with root:zabbix 0640 permissions, and leaves the control API unexposed. Document the host installation and recommend one-day Zabbix history because client IP addresses are sensitive operational data.
This commit is contained in:
pipistrello
2026-07-27 10:57:25 +03:00
parent d40941dbde
commit 673d747abd
5 changed files with 102 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tailscale-proxy/zabbix/telemt-active-ips.conf
+2
View File
@@ -0,0 +1,2 @@
# Sanitized by zabbix-telemt-active-ips.service; contains no proxy secrets.
UserParameter=telemt.active_ips.list,cat /var/lib/zabbix/telemt-active-ips.txt