Graham McIntire
922552059f
Provisions prom.w5isp.com (10.0.15.31) as the home-cluster monitoring host. Prometheus 3.6.0 scrapes the Talos cluster API/nodes/cAdvisor via an external SA token; Grafana ships with the Prometheus datasource pre-provisioned. host_vars opens 9090/9093/9100/3000 to 10.0.0.0/16 plus SSH from the home LAN so the firewall role doesn't lock out admin access.
35 lines
945 B
YAML
35 lines
945 B
YAML
---
|
|
ansible_user: ansible
|
|
ansible_host: 10.0.15.31
|
|
ansible_python_interpreter: /usr/bin/python3
|
|
ansible_ssh_private_key_file: /Users/graham/.ssh/ansible
|
|
ansible_ssh_common_args: '-o StrictHostKeyChecking=accept-new'
|
|
|
|
network:
|
|
skip: true
|
|
|
|
# Open Prometheus stack ports to the home LAN.
|
|
# Trusted subnets (Tailscale, VNTX) are already wide-open via firewall role defaults;
|
|
# this adds the 10.0.15.0/24 home cluster subnet so the k8s nodes can hit node_exporter
|
|
# and so any LAN client can reach the Grafana UI.
|
|
firewall_allow_rules:
|
|
- port: 22
|
|
proto: tcp
|
|
from_ip: 10.0.0.0/16
|
|
comment: SSH from home LAN
|
|
- port: 9090
|
|
proto: tcp
|
|
from_ip: 10.0.0.0/16
|
|
comment: Prometheus UI/API
|
|
- port: 9093
|
|
proto: tcp
|
|
from_ip: 10.0.0.0/16
|
|
comment: Alertmanager
|
|
- port: 9100
|
|
proto: tcp
|
|
from_ip: 10.0.0.0/16
|
|
comment: node_exporter
|
|
- port: 3000
|
|
proto: tcp
|
|
from_ip: 10.0.0.0/16
|
|
comment: Grafana UI
|