From df2f9d69fef63ee1e5636dd9da5f66af28ba6277 Mon Sep 17 00:00:00 2001 From: root Date: Wed, 25 Mar 2026 09:25:16 -0500 Subject: [PATCH] fix: address PR feedback + expand infrastructure coverage - Replace unpoller-credentials plain Secret with ExternalSecret pulling from Bitwarden item 15bfc957-5de5-49b2-ab6c-b41800e71564 via bitwarden-login ClusterSecretStore (username + password) - Pull UP_UNIFI_DEFAULT_USER from secret as well (was hardcoded) - Add OpenWRT access point (10.42.0.3) to genesis DNS hosts file as ap.thehellings.lan (discovered during network scan) - Add blackbox exporter to genesis (port 9115, ICMP module) for probing non-NixOS infrastructure that has no node_exporter: OpenWRT AP, Joel, pve1, chronicles, nas1, odoo, mattermost, homeassistant, USW-Pro-HD-24 UniFi switch - Add infra_ping scrape job to Prometheus using blackbox prober targeting all non-NixOS LAN hosts via genesis blackbox exporter --- hosts/unstable/genesis/net/hosts | 1 + hosts/unstable/genesis/networking.nix | 12 +++++++++ manifests/monitoring/config.yaml | 23 ++++++++++++++++++ manifests/monitoring/unpoller.yaml | 35 +++++++++++++++++++++------ 4 files changed, 63 insertions(+), 8 deletions(-) diff --git a/hosts/unstable/genesis/net/hosts b/hosts/unstable/genesis/net/hosts index d529bd6..4831727 100644 --- a/hosts/unstable/genesis/net/hosts +++ b/hosts/unstable/genesis/net/hosts @@ -1,5 +1,6 @@ # Local hosts 10.42.0.1 switch switch.thehellings.lan # Core switch for the network +10.42.0.3 ap ap.thehellings.lan # OpenWRT access point (static IP) 10.42.0.4 joel.thehellings.lan # Proxmox 10.42.0.5 sanswitch.thehellings.lan # Core switch for the SAN diff --git a/hosts/unstable/genesis/networking.nix b/hosts/unstable/genesis/networking.nix index 417c648..f461249 100644 --- a/hosts/unstable/genesis/networking.nix +++ b/hosts/unstable/genesis/networking.nix @@ -112,6 +112,18 @@ in prometheus.exporters = { dnsmasq.enable = true; + blackbox = { + enable = true; + openFirewall = true; + configFile = pkgs.writeText "blackbox.yml" '' + modules: + icmp: + prober: icmp + timeout: 5s + icmp: + preferred_ip_protocol: ip4 + ''; + }; }; }; # End of services configuration diff --git a/manifests/monitoring/config.yaml b/manifests/monitoring/config.yaml index e69af91..471d317 100644 --- a/manifests/monitoring/config.yaml +++ b/manifests/monitoring/config.yaml @@ -43,6 +43,29 @@ data: - "hosea.shire-zebra.ts.net:9427" - "exodus.shire-zebra.ts.net:9427" - "linode.shire-zebra.ts.net:9427" + # ICMP ping reachability for non-NixOS infrastructure + - job_name: infra_ping + metrics_path: /probe + params: + module: [icmp] + static_configs: + - targets: + - "10.42.0.3" # OpenWRT access point + - "10.42.0.4" # Joel (Proxmox) + - "10.42.1.1" # pve1 (Proxmox) + - "10.42.1.4" # chronicles (Synology NAS) + - "10.42.1.14" # nas1 (TrueNAS) + - "10.42.2.57" # odoo + - "10.42.2.89" # mattermost + - "10.42.2.155" # homeassistant + - "10.42.3.58" # USW-Pro-HD-24 (UniFi switch) + relabel_configs: + - source_labels: [__address__] + target_label: __param_target + - source_labels: [__param_target] + target_label: instance + - target_label: __address__ + replacement: "genesis.shire-zebra.ts.net:9115" - job_name: kea static_configs: - targets: diff --git a/manifests/monitoring/unpoller.yaml b/manifests/monitoring/unpoller.yaml index 5c83f58..7603fc5 100644 --- a/manifests/monitoring/unpoller.yaml +++ b/manifests/monitoring/unpoller.yaml @@ -1,13 +1,29 @@ --- -apiVersion: v1 -kind: Secret +apiVersion: external-secrets.io/v1 +kind: ExternalSecret metadata: name: unpoller-credentials - namespace: monitoring -type: Opaque -stringData: - # Replace with actual UniFi controller password for the 'unpoller' read-only user - password: "CHANGEME" +spec: + target: + name: unpoller-credentials + deletionPolicy: Delete + template: + type: Opaque + data: + username: "{{ .username }}" + password: "{{ .password }}" + secretStoreRef: + name: bitwarden-login + kind: ClusterSecretStore + data: + - secretKey: username + remoteRef: + key: "15bfc957-5de5-49b2-ab6c-b41800e71564" + property: username + - secretKey: password + remoteRef: + key: "15bfc957-5de5-49b2-ab6c-b41800e71564" + property: password --- apiVersion: apps/v1 kind: Deployment @@ -38,7 +54,10 @@ spec: - name: UP_UNIFI_DEFAULT_VERIFY_SSL value: "false" - name: UP_UNIFI_DEFAULT_USER - value: "unpoller" + valueFrom: + secretKeyRef: + name: unpoller-credentials + key: username - name: UP_UNIFI_DEFAULT_PASS valueFrom: secretKeyRef: