Graham McIntire
39bedb08d1
Proxmox: node1-3 → 10.0.19.101-103 Talos cp1-3 → 10.0.19.1-3, workers → 10.0.19.4-6 K8s endpoint → VIP https://10.0.19.10:6443 Ansible: prom → 10.0.19.31, db → 10.0.19.30 Talos: added VIP block to controlplane.yaml base config Promtail: Loki URL → 10.0.19.31 Docs: all references updated, talos4 removed
45 lines
1.2 KiB
YAML
45 lines
1.2 KiB
YAML
---
|
|
ansible_host: 10.0.19.31
|
|
ansible_python_interpreter: /usr/bin/python3
|
|
ansible_ssh_common_args: '-o StrictHostKeyChecking=accept-new'
|
|
|
|
network:
|
|
skip: true
|
|
|
|
# Open Prometheus stack ports to the home LAN.
|
|
# Trusted subnets (Tailscale, VNTX) are already wide-open via firewall role defaults;
|
|
# this adds the 10.0.16.0/22 home cluster subnet so the k8s nodes can hit node_exporter
|
|
# and so any LAN client can reach the Grafana UI.
|
|
firewall_allow_rules:
|
|
- port: 22
|
|
proto: tcp
|
|
from_ip: 10.0.0.0/16
|
|
comment: SSH from home LAN
|
|
- port: 9090
|
|
proto: tcp
|
|
from_ip: 10.0.0.0/16
|
|
comment: Prometheus UI/API
|
|
- port: 9093
|
|
proto: tcp
|
|
from_ip: 10.0.0.0/16
|
|
comment: Alertmanager
|
|
- port: 9100
|
|
proto: tcp
|
|
from_ip: 10.0.0.0/16
|
|
comment: node_exporter
|
|
- port: 3000
|
|
proto: tcp
|
|
from_ip: 10.0.0.0/16
|
|
comment: Grafana UI
|
|
- port: 3100
|
|
proto: tcp
|
|
from_ip: 10.0.0.0/16
|
|
comment: Loki HTTP (push + query)
|
|
|
|
# Scrape the Unbound resolvers' Telegraf exporters (port 9273, plain HTTP,
|
|
# firewalled on the resolvers to the 204.110.188.0/22 scrape network).
|
|
prometheus_extra_scrape_configs:
|
|
- job_name: unbound
|
|
targets:
|
|
- resolver1.vntx.net:9273
|
|
- resolver2.vntx.net:9273
|