Graham McIntire
66986e294b
Add a telegraf role (applied to the resolvers) that runs unbound-control via the inputs.unbound plugin and exposes the stats as a Prometheus /metrics endpoint on :9273, firewalled to the 204.110.188.0/22 scrape network. Imports the InfluxData signing key (influxdata-archive.key; the _compat key expired 2026-01-17) so dnf can validate the package. - prom.w5isp.com: scrape job "unbound" for resolver1/2:9273 - grafana: "Unbound Resolvers" dashboard (queries, cache hit ratio, rcodes, query types, recursion time, request list, cache memory) - resolvers: disable unused shm-enable to silence the startup warning
46 lines
1.2 KiB
YAML
46 lines
1.2 KiB
YAML
---
|
|
ansible_user: ansible
|
|
ansible_host: 10.0.15.31
|
|
ansible_python_interpreter: /usr/bin/python3
|
|
ansible_ssh_common_args: '-o StrictHostKeyChecking=accept-new'
|
|
|
|
network:
|
|
skip: true
|
|
|
|
# Open Prometheus stack ports to the home LAN.
|
|
# Trusted subnets (Tailscale, VNTX) are already wide-open via firewall role defaults;
|
|
# this adds the 10.0.15.0/24 home cluster subnet so the k8s nodes can hit node_exporter
|
|
# and so any LAN client can reach the Grafana UI.
|
|
firewall_allow_rules:
|
|
- port: 22
|
|
proto: tcp
|
|
from_ip: 10.0.0.0/16
|
|
comment: SSH from home LAN
|
|
- port: 9090
|
|
proto: tcp
|
|
from_ip: 10.0.0.0/16
|
|
comment: Prometheus UI/API
|
|
- port: 9093
|
|
proto: tcp
|
|
from_ip: 10.0.0.0/16
|
|
comment: Alertmanager
|
|
- port: 9100
|
|
proto: tcp
|
|
from_ip: 10.0.0.0/16
|
|
comment: node_exporter
|
|
- port: 3000
|
|
proto: tcp
|
|
from_ip: 10.0.0.0/16
|
|
comment: Grafana UI
|
|
- port: 3100
|
|
proto: tcp
|
|
from_ip: 10.0.0.0/16
|
|
comment: Loki HTTP (push + query)
|
|
|
|
# Scrape the Unbound resolvers' Telegraf exporters (port 9273, plain HTTP,
|
|
# firewalled on the resolvers to the 204.110.188.0/22 scrape network).
|
|
prometheus_extra_scrape_configs:
|
|
- job_name: unbound
|
|
targets:
|
|
- resolver1.vntx.net:9273
|
|
- resolver2.vntx.net:9273
|