commit 923af25499dfa02734b708497e2375046995a4ac · krasovs.ky/homelab

+66

butane/fcos.yml.tftpl

···

       163
        
                 # all keys on machine, reaching the limit.

     

       164
        
                 MaxAuthTries 10

     

       165
        
       

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       166
        
       systemd:

     

       167
        
         units:

     

       168
        
           - name: install-additional-software.service

     
···

       286
        
       

     

       287
        
               [Install]

     

       288
        
               WantedBy=remote-fs.target

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       289
        
       

     

       290
        
       kernel_arguments:

     

       291
        
         should_exist:

···

       163
        
                 # all keys on machine, reaching the limit.

     

       164
        
                 MaxAuthTries 10

     

       165
        
       

     

       166
       +
           # Firewall configuration

     

       167
       +
           - path: /etc/sysconfig/nftables.conf

     

       168
       +
             overwrite: true

     

       169
       +
             mode: 0644

     

       170
       +
             contents:

     

       171
       +
               inline: |

     

       172
       +
                 include "/etc/nftables/main.nft"

     

       173
       +
       

     

       174
       +
           - path: /etc/nftables/main.nft

     

       175
       +
             overwrite: true

     

       176
       +
             mode: 0644

     

       177
       +
             contents:

     

       178
       +
               inline: |

     

       179
       +
                 #!/usr/sbin/nft -f

     

       180
       +
       

     

       181
       +
                 flush ruleset

     

       182
       +
       

     

       183
       +
                 table inet filter {

     

       184
       +
                 	chain input {

     

       185
       +
                 		type filter hook input priority filter; policy drop;

     

       186
       +
       

     

       187
       +
                 		# allow established/related connections

     

       188
       +
                 		ct state {established, related} accept

     

       189
       +
       

     

       190
       +
                 		# early drop of invalid connections

     

       191
       +
                 		ct state invalid drop

     

       192
       +
       

     

       193
       +
                 		# allow from loopback

     

       194
       +
                 		iifname lo accept

     

       195
       +
       

     

       196
       +
                 		# allow icmp

     

       197
       +
                 		ip protocol icmp accept

     

       198
       +
                 		ip6 nexthdr icmpv6 counter accept

     

       199
       +
       

     

       200
       +
                 		# allow ssh

     

       201
       +
                 		tcp dport ssh accept

     

       202
       +
       

     

       203
       +
                 		# allow http and https

     

       204
       +
                 		tcp dport 8080 accept

     

       205
       +
                 		tcp dport 8443 accept

     

       206
       +
       

     

       207
       +
                 		# allow truenas to report metrics using graphite

     

       208
       +
                 		ip saddr 192.168.100.3 tcp dport 2003 accept

     

       209
       +
                 		ip saddr 192.168.100.3 udp dport 2003 accept

     

       210
       +
       

     

       211
       +
                 		# allow plugs to access mqtt broker

     

       212
       +
                 		ip saddr 192.168.100.1 tcp dport 1883 accept

     

       213
       +
                 	}

     

       214
       +
       

     

       215
       +
                 	chain forward {

     

       216
       +
                 		type filter hook forward priority filter; policy drop;

     

       217
       +
       

     

       218
       +
                 		ct state {established, related} accept

     

       219
       +
                 		ct state invalid drop

     

       220
       +
       

     

       221
       +
                 		ct status dnat accept

     

       222
       +
                 	}

     

       223
       +
       

     

       224
       +
                 	chain output {

     

       225
       +
                 		type filter hook output priority 0; policy accept;

     

       226
       +
                 	}

     

       227
       +
                 }

     

       228
       +
       

     

       229
        
       systemd:

     

       230
        
         units:

     

       231
        
           - name: install-additional-software.service

     
···

       349
        
       

     

       350
        
               [Install]

     

       351
        
               WantedBy=remote-fs.target

     

       352
       +
       

     

       353
       +
           - name: nftables.service

     

       354
       +
             enabled: true

     

       355
        
       

     

       356
        
       kernel_arguments:

     

       357
        
         should_exist:

+25 -4

configs/alloy/config.alloy

···

       9
        
       

     

       10
        
       discovery.relabel "docker" {

     

       11
        
         targets = discovery.docker.fcos.targets

     

       12
       -
         

     

       13
        
         rule {

     

       14
        
           action = "labelmap"

     

       15
        
           regex  = "^__meta_docker_(.*)$"

     
···

       19
        
       loki.source.docker "podman" {

     

       20
        
         host          = "unix:///var/run/docker.sock"

     

       21
        
         targets       = discovery.docker.fcos.targets

     

       22
       -
         labels        = { "source_name" = "podman" } 

     

       23
        
         forward_to    = [loki.process.copy_msg.receiver]

     

       24
        
         relabel_rules = discovery.relabel.docker.rules

     

       25
        
       }

     
···

       47
        
         }

     

       48
        
       }

     

       49
        
       

     

       50
       -
       // Just Traefik for now

     

       51
        
       prometheus.scrape "scrape_metrics" {

     

       52
       -
         targets         = [{ __address__ = "traefik:8082" }]

     

       53
        
         forward_to      = [prometheus.remote_write.victoria_metrics.receiver]

     

       54
        
         scrape_interval = "10s"

     

       55
        
       }

     
···

       59
        
           url = "http://victoria:8428/prometheus/api/v1/write"

     

       60
        
         }

     

       61
        
       }

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0

···

       9
        
       

     

       10
        
       discovery.relabel "docker" {

     

       11
        
         targets = discovery.docker.fcos.targets

     

       12
       +
       

     

       13
        
         rule {

     

       14
        
           action = "labelmap"

     

       15
        
           regex  = "^__meta_docker_(.*)$"

     
···

       19
        
       loki.source.docker "podman" {

     

       20
        
         host          = "unix:///var/run/docker.sock"

     

       21
        
         targets       = discovery.docker.fcos.targets

     

       22
       +
         labels        = { "source_name" = "podman" }

     

       23
        
         forward_to    = [loki.process.copy_msg.receiver]

     

       24
        
         relabel_rules = discovery.relabel.docker.rules

     

       25
        
       }

     
···

       47
        
         }

     

       48
        
       }

     

       49
        
       

     

       0
        
       
     

       50
        
       prometheus.scrape "scrape_metrics" {

     

       51
       +
         targets         = [{ __address__ = "traefik:8082" }, {__address__ = "rmqtt:6060", __metrics_path__ = "/api/v1/metrics/prometheus" }]

     

       52
        
         forward_to      = [prometheus.remote_write.victoria_metrics.receiver]

     

       53
        
         scrape_interval = "10s"

     

       54
        
       }

     
···

       58
        
           url = "http://victoria:8428/prometheus/api/v1/write"

     

       59
        
         }

     

       60
        
       }

     

       61
       +
       

     

       62
       +
       // Receive metrics from MQTT

     

       63
       +
       otelcol.receiver.otlp "telegraf" {

     

       64
       +
         http {}

     

       65
       +
         grpc {}

     

       66
       +
       

     

       67
       +
         output {

     

       68
       +
           metrics = [otelcol.processor.batch.telegraf.input]

     

       69
       +
         }

     

       70
       +
       }

     

       71
       +
       

     

       72
       +
       otelcol.processor.batch "telegraf" {

     

       73
       +
         output {

     

       74
       +
           metrics = [otelcol.exporter.otlphttp.victoria_metrics.input]

     

       75
       +
         }

     

       76
       +
       }

     

       77
       +
       

     

       78
       +
       otelcol.exporter.otlphttp "victoria_metrics" {

     

       79
       +
         client {

     

       80
       +
           endpoint = "http://victoria:8428/opentelemetry"

     

       81
       +
         }

     

       82
       +
       }

+4 -1

configs/containers/systemd/pods/victoria.pod

···

       4
        
       [Pod]

     

       5
        
       PodName=victoria

     

       6
        
       Network=victoria.network

     

       7
       -
       Network=reverse-proxy.network
     

       0
        
       
     

       0
        
       
     

       0

···

       4
        
       [Pod]

     

       5
        
       PodName=victoria

     

       6
        
       Network=victoria.network

     

       7
       +
       Network=reverse-proxy.network

     

       8
       +
       # Publish Graphite collector ports

     

       9
       +
       PublishPort=2003:2003/tcp

     

       10
       +
       PublishPort=2003:2003/udp

+27

configs/containers/systemd/rmqtt.container.tftpl

···

       1
       +
       [Unit]

     

       2
       +
       Description=RMQTT Broker Quadlet

     

       3
       +
       

     

       4
       +
       [Container]

     

       5
       +
       Image=docker.io/rmqtt/rmqtt:latest

     

       6
       +
       AutoUpdate=registry

     

       7
       +
       ContainerName=rmqtt

     

       8
       +
       

     

       9
       +
       User=1000:1000

     

       10
       +
       UserNS=keep-id:uid=1000,gid=1000

     

       11
       +
       

     

       12
       +
       Label="glance.parent=victoria-metrics"

     

       13
       +
       Label="glance.name=MQTT Broker"

     

       14
       +
       Label="glance.hide=false"

     

       15
       +
       

     

       16
       +
       Volume=/var/mnt/docker/app_data/rmqtt/logs:/var/log/rmqtt:Z

     

       17
       +
       

     

       18
       +
       Network=reverse-proxy.network

     

       19
       +
       PublishPort=1883:1883

     

       20
       +
       PublishPort=6060:6060

     

       21
       +
       

     

       22
       +
       [Service]

     

       23
       +
       TimeoutStartSec=900

     

       24
       +
       Restart=always

     

       25
       +
       

     

       26
       +
       [Install]

     

       27
       +
       WantedBy=multi-user.target default.target

+26

configs/containers/systemd/telegraf.container.tftpl

···

       1
       +
       [Unit]

     

       2
       +
       Description=Telegraf Agent Quadlet

     

       3
       +
       

     

       4
       +
       [Container]

     

       5
       +
       Image=docker.io/telegraf:alpine

     

       6
       +
       AutoUpdate=registry

     

       7
       +
       ContainerName=telegraf

     

       8
       +
       HostName=telegraf

     

       9
       +
       

     

       10
       +
       User=1000:1000

     

       11
       +
       UserNS=keep-id:uid=1000,gid=1000

     

       12
       +
       

     

       13
       +
       Label="glance.parent=victoria-metrics"

     

       14
       +
       Label="glance.name=Telegraf Agent"

     

       15
       +
       Label="glance.hide=false"

     

       16
       +
       

     

       17
       +
       Volume=%E/telegraf/telegraf.conf:/etc/telegraf/telegraf.conf:Z

     

       18
       +
       

     

       19
       +
       Network=reverse-proxy.network

     

       20
       +
       

     

       21
       +
       [Service]

     

       22
       +
       TimeoutStartSec=900

     

       23
       +
       Restart=always

     

       24
       +
       

     

       25
       +
       [Install]

     

       26
       +
       WantedBy=multi-user.target default.target

+4 -1

configs/containers/systemd/victoria/victoria-metrics.container.tftpl

···

       9
        
       User=1000:1000

     

       10
        
       UserNS=keep-id:uid=1000,gid=1000

     

       11
        
       

     

       0
        
       
     

       12
        
       Label="glance.name=VictoriaMetrics"

     

       13
        
       Label="glance.icon=di:victoriametrics-light"

     

       14
        
       Label="glance.url=https://metrics.${base_domain}"

     

       15
        
       Label="glance.description=Metrics Storage"

     

       16
        
       Label="glance.hide=false"

     

       0
        
       
     

       0
        
       
     

       17
        
       

     

       18
        
       Volume=/var/mnt/observability/metrics:/victoria-metrics-data:Z

     

       19
        
       

     
···

       24
        
       Restart=always

     

       25
        
       

     

       26
        
       [Install]

     

       27
       -
       WantedBy=multi-user.target default.target

···

       9
        
       User=1000:1000

     

       10
        
       UserNS=keep-id:uid=1000,gid=1000

     

       11
        
       

     

       12
       +
       Label="glance.id=victoria-metrics"

     

       13
        
       Label="glance.name=VictoriaMetrics"

     

       14
        
       Label="glance.icon=di:victoriametrics-light"

     

       15
        
       Label="glance.url=https://metrics.${base_domain}"

     

       16
        
       Label="glance.description=Metrics Storage"

     

       17
        
       Label="glance.hide=false"

     

       18
       +
       

     

       19
       +
       Exec="--graphiteListenAddr=:2003"

     

       20
        
       

     

       21
        
       Volume=/var/mnt/observability/metrics:/victoria-metrics-data:Z

     

       22
        
       

     
···

       27
        
       Restart=always

     

       28
        
       

     

       29
        
       [Install]

     

       30
       +
       WantedBy=multi-user.target default.target

+21

configs/telegraf/telegraf.conf

···

       1
       +
       [[inputs.mqtt_consumer]]

     

       2
       +
         servers = ["tcp://rmqtt:1883"]

     

       3
       +
         topics = [

     

       4
       +
           "shelly/+/status/+"

     

       5
       +
         ]

     

       6
       +
       

     

       7
       +
         data_format = "json_v2"

     

       8
       +
         [[inputs.mqtt_consumer.json_v2]]

     

       9
       +
           [[inputs.mqtt_consumer.json_v2.field]]

     

       10
       +
             path = "apower"

     

       11
       +
           [[inputs.mqtt_consumer.json_v2.field]]

     

       12
       +
             path = "voltage"

     

       13
       +
           [[inputs.mqtt_consumer.json_v2.field]]

     

       14
       +
             path = "freq"

     

       15
       +
           [[inputs.mqtt_consumer.json_v2.field]]

     

       16
       +
             path = "current"

     

       17
       +
           [[inputs.mqtt_consumer.json_v2.field]]

     

       18
       +
             path = "temperature.tC"

     

       19
       +
       

     

       20
       +
       [[outputs.opentelemetry]]

     

       21
       +
         service_address = "grafana-alloy:4317"