superconfig/configs/monitoring/ at 1f737d16dff43f668290cb5a729a598d49fe58a3 · lass.pds.lassul.us/superconfig · Tangled

lass.pds.lassul.us / superconfig

0

This repository has no description

0

superconfig / configs / monitoring

1 folder 5 files

at 1f737d16dff43f668290cb5a729a598d49fe58a3

Hermes configs.byoidc: init on neoprism (byoidc.lassul.us) 3d ago

configs.monitoring: export the superconfig revision each machine runs autoUpgrade pins the upgrade to the revision the forward-only guard resolved and writes it to /var/lib/superconfig-revision after a successful upgrade, like deploy does. Vector reads that file every 30s and exports nixos_system_info{host,revision,revision_short}; the node dashboard shows host -> revision_short.

5 days ago

configs.monitoring: alert on disk health and memory pressure smartctl_exporter runs on every non-container machine, bound to localhost and scraped by Vector into the host-tagged metrics path. Alerts on a failed SMART status, NVMe critical warnings, new NVMe media errors and NVMe spare below its threshold. Memory PSI comes from /proc/pressure/memory via an exec source, as a counter of stalled seconds, so the alert takes an exact 10m rate instead of the kernel's 5m avg300 EWMA. Plus an alert on any OOM kill. MemoryPressure threshold 10%: some task stalling on memory a tenth of the time over 10 minutes is sustained reclaim/swap thrash, while short spikes such as big builds average out.

4 days ago

configs.monitoring: exempt every mount of the download dataset from DiskAlmostFull yellow mounts the same ZFS dataset (tank/download) as neoprism's /var/download, which is covered by DownloadSpace*, so DiskAlmostFull fired for it. Match the exemption on the device of neoprism's series instead of host and mountpoint.

3 days ago

configs.byoidc: init on neoprism (byoidc.lassul.us) byoidc lets people sign in with their own OpenID provider; Zitadel will offer it as one generic OIDC IdP. The downstream client "zitadel" gets its secret from a prompt-less clan var, which root-owned is fine for both byoidc (LoadCredential) and zitadel-reconcile (root). Its state (cached upstream clients, signing key) is not backed up: subjects are derived from issuer and upstream sub, a new signing key is picked up through JWKS, and upstream clients are registered again on demand.

3 days ago

machines.orange: remove, move mumble-reminder to neoprism

5 days ago

retiolum: drop self.retiolum, acheron and starkstrom are in kartei now kartei carries both cards (krebs/kartei#92), so the superconfig-only host set is empty; read hosts, own addresses and tinc host files from kartei alone.

5 days ago