---
ansible_host: 10.0.19.31
ansible_python_interpreter: /usr/bin/python3
ansible_ssh_common_args: '-o StrictHostKeyChecking=accept-new'

network:
  skip: true

# Open Prometheus stack ports to the home LAN.
# Trusted subnets (Tailscale, VNTX) are already wide-open via firewall role defaults;
# this adds the 10.0.16.0/22 home cluster subnet so the k8s nodes can hit node_exporter
# and so any LAN client can reach the Grafana UI.
firewall_allow_rules:
  - port: 22
    proto: tcp
    from_ip: 10.0.0.0/16
    comment: SSH from home LAN
  - port: 9090
    proto: tcp
    from_ip: 10.0.0.0/16
    comment: Prometheus UI/API
  - port: 9093
    proto: tcp
    from_ip: 10.0.0.0/16
    comment: Alertmanager
  - port: 9100
    proto: tcp
    from_ip: 10.0.0.0/16
    comment: node_exporter
  - port: 3000
    proto: tcp
    from_ip: 10.0.0.0/16
    comment: Grafana UI
  - port: 3100
    proto: tcp
    from_ip: 10.0.0.0/16
    comment: Loki HTTP (push + query)

# Scrape the Unbound resolvers' Telegraf exporters (port 9273, plain HTTP,
# firewalled on the resolvers to the 204.110.188.0/22 scrape network).
prometheus_extra_scrape_configs:
  - job_name: unbound
    targets:
      - resolver1.vntx.net:9273
      - resolver2.vntx.net:9273