tailscale proxy: collect sanitized Telemt active IP list

Telemt's Prometheus endpoint exposes only active-IP counts, while its loopback control API includes both the address list and sensitive proxy links. Add a root systemd timer that enters the Telemt container network namespace, filters the API response in memory, and publishes only username/address rows through the Zabbix agent key telemt.active_ips.list.\n\nThe collector refreshes every 30 seconds, writes atomically with root:zabbix 0640 permissions, and leaves the control API unexposed. Document the host installation and recommend one-day Zabbix history because client IP addresses are sensitive operational data.
2026-07-27 10:57:25 +03:00
parent d40941dbde
commit 673d747abd
5 changed files with 102 additions and 0 deletions
@@ -0,0 +1,12 @@
+[Unit]
+Description=Refresh sanitized Telemt active IP addresses for Zabbix
+
+[Timer]
+OnBootSec=30s
+OnUnitActiveSec=30s
+AccuracySec=2s
+Unit=zabbix-telemt-active-ips.service
+Persistent=true
+
+[Install]
+WantedBy=timers.target