Frank
f134cc8876
Retiring dankclaw/compose.yaml and adding alert rules invalidated claims across
the repo, including in the rule file agents read first. Clean cutover includes
the prose.
**Tests that had gone hollow.** Four assertions grepped dankclaw/compose.yaml
for a service name. With the file gone they passed by *absence* — a gate that
can no longer fail. Each now asserts the real invariant ("no dankclaw compose
file competes with the quadlet units") and keeps a live check for a re-added
entry, so it still fails when one appears: verified by recreating a compose file
with a comfyui service and watching three tests go red, then removing it.
**AGENTS.md, which was wrong about ComfyUI.** It said ComfyUI runs CPU-only
("no ROCm wheels for gfx1151, CUDA images wrong"). That was true in the
compose era and is false now: the restored unit runs with /dev/kfd + /dev/dri and
must NOT pass --cpu. An agent trusting the rule file would have re-broken it.
Also corrected: the observability paragraph ("RUNNING BUT UNCONFIGURED, no
datasource, no rules" — all three have been configured since 2026-09-16), the
Active runbook row that still named halogen for frank-large, halogen's absence
from the Retired table, the benchmark policy naming halogen's harness, and the
seam list.
**Unit and page claims.** prometheus.container said "no alerting rules anywhere
in this stack"; node-exporter.container said Dankserver runs from its compose
stack; Prometheus.md documented three jobs as working (they scrape HTML: they
can never report up) and said no dashboard existed; index.md and the three
authentik service pages pointed at the retired file; Authentik.md's upgrade
instruction told you to bump an image tag in it.
One bad edit of my own on the way (a stale line number clobbered a See Also
entry in Prometheus.md) — caught by reading back, fixed, and the vault link
checker now proves the cross-references hold.
55 lines
2.3 KiB
INI
55 lines
2.3 KiB
INI
# Quadlet unit: node-exporter (rootless, boot-persistent).
|
|
#
|
|
# Install path on dankclaw: ~/.config/containers/systemd/node-exporter.container
|
|
# Unit name: node-exporter.service (container name: node-exporter)
|
|
#
|
|
# Host metrics source for Prometheus. This replaces the compose service of the
|
|
# same name in dankclaw/compose.yaml ("Observability" block).
|
|
#
|
|
# HOST NAMESPACE. It must run in the host network namespace to report the
|
|
# host's own interfaces/connections, and --pid=host for the processes and
|
|
# cgroups collectors. "localhost" inside the container is therefore the host's
|
|
# loopback, which is what the homepage status timer probes.
|
|
#
|
|
# LISTEN ADDRESSES. Until 2026-09-11 this bound :9100 on every interface. It
|
|
# now binds exactly two: loopback for the homepage status probe, and the LAN
|
|
# address because Prometheus — which runs in a container on dankclaw_default —
|
|
# scrapes http://192.168.0.143:9100 (shared/prometheus/prometheus.yml,
|
|
# job "node-dankclaw"). node_exporter itself has no authentication, so keeping
|
|
# the wildcard bind off the table matters: this is the second half of the
|
|
# pairing that removes the unauthenticated observability surface, and both
|
|
# consumers are accounted for. Dankserver runs its own copy of this container
|
|
# (scraped by the "node-dankserver" job) — since 2026-09-16 as a Quadlet unit in
|
|
# the same shape (dankserver/observability/quadlet/), because the compose-only
|
|
# version it replaced had been dead for a day and a half before anyone noticed.
|
|
#
|
|
# MOUNTS. The container reads the host's /proc, /sys and / as /host/* read-only
|
|
# and is pointed at them with --path.*; it writes nothing anywhere.
|
|
|
|
[Unit]
|
|
Description=Prometheus node exporter (Dankclaw host metrics)
|
|
After=network-online.target
|
|
Wants=network-online.target
|
|
|
|
[Container]
|
|
ContainerName=node-exporter
|
|
Image=docker.io/prom/node-exporter:latest
|
|
Network=host
|
|
PodmanArgs=--pid=host
|
|
Exec=--path.procfs=/host/proc --path.sysfs=/host/sys --path.rootfs=/rootfs --web.listen-address=127.0.0.1:9100 --web.listen-address=192.168.0.143:9100
|
|
Volume=/proc:/host/proc:ro
|
|
Volume=/sys:/host/sys:ro
|
|
Volume=/:/rootfs:ro
|
|
HealthCmd=wget --spider -q http://localhost:9100/metrics
|
|
HealthInterval=30s
|
|
HealthTimeout=10s
|
|
HealthRetries=3
|
|
HealthStartPeriod=30s
|
|
|
|
[Service]
|
|
Restart=always
|
|
RestartSec=10
|
|
|
|
[Install]
|
|
WantedBy=default.target
|