CCCHH/ansible-infra
CCCHH/ansible-infra
4
2
Fork 1
Code Issues 4 Pull requests 1 Wiki Activity Actions

prometheus remote write with alloy using it
Some checks failed
/ Ansible Lint (push) Failing after 1m53s
Details

Browse source
This commit is contained in:
chris 2025-04-30 01:08:43 +02:00
commit e183f1a2c3
Signed by: c6ristian
SSH key fingerprint: SHA256:B3m+yzpaxGXSEcDBpPHfvza/DNC0wuX+CKMeGq8wgak
8 changed files with 161 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

16
resources/chaosknoten/grafana/nginx/loki.hamburg.ccc.de.conf
View file

@ -3,13 +3,16 @@ server {
allow 172.31.17.128/25;
allow 212.12.51.128/28;
allow 2a00:14b0:42:100::/56;
allow 2a00:14b0:4200:3380::/64;
# Z9
allow 2a07:c480:0:100::/56;
allow 2a07:c481:1::/48;
deny all;
listen [2a00:14b0:4200:3380:0000:5a5f:1dbc:6a39]:9099 ssl http2;
listen 172.31.17.145:9099 ssl http2;
listen [2a00:14b0:4200:3380:0000:5a5f:1dbc:6a39]:50051 ssl;
listen 172.31.17.145:50051 ssl;
http2 on;
server_name loki.hamburg.ccc.de;
@ -27,7 +30,7 @@ server {
# This is https in any case.
proxy_set_header X-Forwarded-Proto https;
proxy_set_header X-Scope-OrgID $remote_user;
grpc_pass grpc://localhost:19009;
grpc_pass grpc://localhost:19099;
}
}
@ -36,13 +39,15 @@ server {
allow 172.31.17.128/25;
allow 212.12.51.128/28;
allow 2a00:14b0:42:100::/56;
allow 2a00:14b0:4200:3380::/64;
# Z9
allow 2a07:c480:0:100::/56;
allow 2a07:c481:1::/48;
deny all;
listen [2a00:14b0:4200:3380:0000:5a5f:1dbc:6a39]:3100 ssl http2;
listen 172.31.17.145:3100 ssl http2;
listen [2a00:14b0:4200:3380:0000:5a5f:1dbc:6a39]:443 ssl;
listen 172.31.17.145:443 ssl;
http2 on;
server_name loki.hamburg.ccc.de;
@ -62,7 +67,6 @@ server {
proxy_set_header X-Forwarded-Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Port 3100;
# This is https in any case.
proxy_set_header X-Forwarded-Proto https;
proxy_set_header X-Scope-OrgID $remote_user;

55
resources/chaosknoten/grafana/nginx/metrics.hamburg.ccc.de.conf Normal file
View file

@ -0,0 +1,55 @@
server {
# Wieske
allow 172.31.17.128/25;
allow 212.12.51.128/28;
allow 2a00:14b0:42:100::/56;
allow 2a00:14b0:4200:3380::/64;
# Z9
allow 2a07:c480:0:100::/56;
allow 2a07:c481:1::/48;
deny all;
listen [2a00:14b0:4200:3380:0000:5a5f:1dbc:6a39]:443 ssl;
listen 172.31.17.145:443 ssl;
http2 on;
server_name metrics.hamburg.ccc.de;
client_body_buffer_size 32k;
ssl_certificate /etc/letsencrypt/live/metrics.hamburg.ccc.de/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/metrics.hamburg.ccc.de/privkey.pem;
# verify chain of trust of OCSP response using Root CA and Intermediate certs
ssl_trusted_certificate /etc/letsencrypt/live/metrics.hamburg.ccc.de/chain.pem;
# HSTS (ngx_http_headers_module is required) (63072000 seconds)
add_header Strict-Transport-Security "max-age=63072000" always;
auth_basic "metrics";
auth_basic_user_file metrics.htpasswd;
location /api/v1/write {
proxy_set_header Host $host;
proxy_set_header X-Forwarded-Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Port 3100;
# This is https in any case.
proxy_set_header X-Forwarded-Proto https;
proxy_pass http://127.0.0.1:9090;
}
location /ready {
rewrite ^ /-/ready break;
proxy_set_header Host $host;
proxy_set_header X-Forwarded-Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
# This is https in any case.
proxy_set_header X-Forwarded-Proto https;
proxy_pass http://127.0.0.1:9090;
}
}

1
resources/chaosknoten/grafana/nginx/metrics.htpasswd.j2 Normal file
View file

@ -0,0 +1 @@
chaos:{{ lookup("community.general.passwordstore", "noc/vm-secrets/chaosknoten/grafana/metrics_chaos_basic_auth", create=false, missing="error") }}