newedge/infra

0 Fork 1

Files

T

History

kurogeek 37496b974e modules/prometheus: run alertmanager as a static user

nixpkgs' alertmanager uses DynamicUser, so the `alertmanager` user only
exists while the service is running. The matrix-alertmanager-urlfile
secret is owned by that user; at boot sops-install-secrets cannot resolve
it and rejects the whole manifest, leaving /run/secrets empty (no ssh
host key, yggdrasil key, tor key, ...). Deploys masked it because the
dynamic user was resolvable via nss-systemd at switch time.

Create a static alertmanager user/group and disable DynamicUser.

2026-10-26 09:27:42 +00:00

tests/vm

clanService/prometheus: init monitoring system

2026-06-23 15:27:31 +07:00

default.nix

modules/prometheus: run alertmanager as a static user

2026-10-26 09:27:42 +00:00

flake-module.nix

clanService/prometheus: init monitoring system

2026-06-23 15:27:31 +07:00

README.md

prometheus: write README

2026-10-22 17:32:15 +07:00

README.md

Prometheus

Monitoring over the Yggdrasil network. Requires the yggdrasil clan service on every machine in the instance.

Roles:

server: runs Prometheus and Alertmanager, scraping every nodes machine by its Yggdrasil address. Optional matrix-alertmanager forwards alerts to Matrix rooms; the bot token and webhook secret are generated as clan vars.
nodes: enables the services.prometheus.exporters listed in exporters (with openFirewall) so the server can harvest them.