Graham McIntire
6d173d9fcb
- new ansible loki role installs loki 3.5.5 on prometheus_servers as a systemd unit (single-binary, filesystem store, 30d retention) - open tcp/3100 on prom.w5isp.com to 10.0.0.0/16 - grafana: provision loki datasource at http://127.0.0.1:3100 - k8s: promtail daemonset + rbac in monitoring namespace, ships pod logs to http://10.0.15.31:3100 with cluster=home-cluster label - argocd: Application points at home/cluster/promtail
39 lines
1 KiB
YAML
39 lines
1 KiB
YAML
---
|
|
ansible_user: ansible
|
|
ansible_host: 10.0.15.31
|
|
ansible_python_interpreter: /usr/bin/python3
|
|
ansible_ssh_private_key_file: /Users/graham/.ssh/ansible
|
|
ansible_ssh_common_args: '-o StrictHostKeyChecking=accept-new'
|
|
|
|
network:
|
|
skip: true
|
|
|
|
# Open Prometheus stack ports to the home LAN.
|
|
# Trusted subnets (Tailscale, VNTX) are already wide-open via firewall role defaults;
|
|
# this adds the 10.0.15.0/24 home cluster subnet so the k8s nodes can hit node_exporter
|
|
# and so any LAN client can reach the Grafana UI.
|
|
firewall_allow_rules:
|
|
- port: 22
|
|
proto: tcp
|
|
from_ip: 10.0.0.0/16
|
|
comment: SSH from home LAN
|
|
- port: 9090
|
|
proto: tcp
|
|
from_ip: 10.0.0.0/16
|
|
comment: Prometheus UI/API
|
|
- port: 9093
|
|
proto: tcp
|
|
from_ip: 10.0.0.0/16
|
|
comment: Alertmanager
|
|
- port: 9100
|
|
proto: tcp
|
|
from_ip: 10.0.0.0/16
|
|
comment: node_exporter
|
|
- port: 3000
|
|
proto: tcp
|
|
from_ip: 10.0.0.0/16
|
|
comment: Grafana UI
|
|
- port: 3100
|
|
proto: tcp
|
|
from_ip: 10.0.0.0/16
|
|
comment: Loki HTTP (push + query)
|