Graham McIntire
66986e294b
Add a telegraf role (applied to the resolvers) that runs unbound-control via the inputs.unbound plugin and exposes the stats as a Prometheus /metrics endpoint on :9273, firewalled to the 204.110.188.0/22 scrape network. Imports the InfluxData signing key (influxdata-archive.key; the _compat key expired 2026-01-17) so dnf can validate the package. - prom.w5isp.com: scrape job "unbound" for resolver1/2:9273 - grafana: "Unbound Resolvers" dashboard (queries, cache hit ratio, rcodes, query types, recursion time, request list, cache memory) - resolvers: disable unused shm-enable to silence the startup warning
22 lines
1.1 KiB
YAML
22 lines
1.1 KiB
YAML
---
|
|
# Telegraf agent: collects Unbound stats via unbound-control and exposes them
|
|
# as a Prometheus /metrics endpoint for the prom.w5isp.com server to scrape.
|
|
# (unbound-control runs fine as the unprivileged telegraf user because the
|
|
# resolvers' control interface is plaintext on localhost.)
|
|
telegraf_interval: "30s"
|
|
telegraf_unbound_binary: /usr/sbin/unbound-control
|
|
|
|
# Prometheus output — Prometheus scrapes http://<resolver>:<port>/metrics.
|
|
telegraf_prometheus_port: 9273
|
|
telegraf_prometheus_listen: "0.0.0.0:{{ telegraf_prometheus_port }}"
|
|
|
|
# Only this source network may reach the metrics port (the routed scrape
|
|
# path from prom.w5isp.com). Keeps Unbound stats off the public internet.
|
|
telegraf_scrape_allow_cidr: "204.110.188.0/22"
|
|
|
|
# InfluxData package repository (EL/RedHat).
|
|
# Use influxdata-archive.key (not _compat): the _compat key's primary expired
|
|
# 2026-01-17, while current packages are signed by a 2025 subkey only present
|
|
# in this keyring.
|
|
telegraf_influxdata_baseurl: "https://repos.influxdata.com/stable/$basearch/main"
|
|
telegraf_influxdata_gpgkey: "https://repos.influxdata.com/influxdata-archive.key"
|