# Quadlet unit: blackbox exporter (rootless, host network, boot-persistent).
#
# Install path on dankclaw:
#   ~/.config/containers/systemd/blackbox-exporter.container
#
# WHY Network=host. The probes it runs are (a) the host's own LAN IP
# (192.168.0.143:8081 SearXNG, :3005 OpenWebUI — host-process/portmap binds a
# bridge container cannot reach; netavark DNATs published ports only, see
# Container Host Reachability in the vault) and (b) ComfyUI's published port
# via 127.0.0.1 (rootless --network=host shares the real host netns, so the
# 0.0.0.0:8188 publish answers on loopback). A bridge-networked prober could
# reach neither class reliably.
#
# WHY the listener binds TWO addresses. The netavark hairpin gap (measured
# 2026-10-21, cadvisor job comment): a BRIDGE CONTAINER CANNOT DIAL ITS OWN
# HOST'S LAN IP at all — so a LAN-only bind is unscrapable by Prometheus,
# whatever the signal-relay law suggests for services containers dial as
# clients. The podman gateway (169.254.1.2 = host.containers.internal) is the
# address bridge containers reach same-host targets at, so the exporter binds
# it explicitly for the scrape rather than relying on loopback-forwarding
# semantics, and keeps the LAN bind for diagnostics. No public DNS name, no
# guard chain: internal net only, per the exposure policy. The listen flag is
# --web.listen-address and it is REPEATABLE, one flag per bind; plain
# --listen-address does not exist and the exporter exits in 100 ms with
# "unknown long flag" (live 2026-10-21).

[Unit]
Description=Blackbox exporter (HTTP probe prober)
After=network-online.target

[Container]
Image=docker.io/prom/blackbox-exporter@sha256:ea1c7aa3ef3f307cd03e85f34abb604478ccb90b567fc690da0cd9776da76b13
ContainerName=blackbox-exporter
Network=host
Exec=/bin/blackbox_exporter --config.file=/etc/blackbox_exporter/config.yml --web.listen-address=192.168.0.143:9115 --web.listen-address=169.254.1.2:9115
Volume=/opt/blackbox/blackbox.yml:/etc/blackbox_exporter/config.yml:ro
HealthCmd=/bin/sh -c "wget -q -O /dev/null http://169.254.1.2:9115/-/healthy || exit 1"
HealthInterval=30s
HealthRetries=3

[Service]
Restart=always
RestartSec=5

[Install]
WantedBy=default.target