Frank
d2810ab610
Closing the command-center security queue #70/#71/#72/#73/#74: rolling tags let a rebuild move under a running service with nobody approving it, and make a CVE audit ungradeable. 36 quadlet units across dankclaw, dankserver and frankbook-pro now carry tag@sha256; localhost/* builds stay exempt (their build is the pin). The pihole and copyparty pins pull the fixed builds; valkey 9.1.2 (already running) and redis 7.4.11 are pinned in place, vendor fixes TBD. New gate tests/quadlet_image_pins.bats: no unpinned registry image, no generator-rejected key anywhere. Three seams that pinned the old exact-tag law (frankbook readarr, open_webui, seerr) now require tag AND digest - strictly stronger. Quadlet Lifecycle docs: batch-abort law, entrypoint flags-only law, pin law.
59 lines
2.5 KiB
INI
59 lines
2.5 KiB
INI
# Quadlet unit: node-exporter (rootless, boot-persistent) — DANKSERVER.
|
|
#
|
|
# Install path on dankserver: ~/.config/containers/systemd/node-exporter.container
|
|
# Unit name: node-exporter.service (container name: node-exporter)
|
|
#
|
|
# WHY THIS FILE EXISTS. Until 2026-09-16 the Dankserver node-exporter ran only
|
|
# from `dankserver/compose.yaml` (the "Observability" block, `restart:
|
|
# unless-stopped`). Rootless Podman does not restart bare containers after the
|
|
# explicit stop that shutdown performs, so it died at a reboot and stayed dead:
|
|
# `podman ps -a` showed it `Exited (143)` and Prometheus' `node-dankserver` job
|
|
# had been scraping nothing since. The compose entry also bound the default
|
|
# wildcard address, which is the unauthenticated-metrics-API-on-every-interface
|
|
# posture that was already removed on Dankclaw. This unit replaces both: one
|
|
# owner per container name (the compose service is deleted), explicit listen
|
|
# addresses, and a generator-provided boot path.
|
|
#
|
|
# HOST NAMESPACE. Networking and PID in the host's namespaces: the collectors
|
|
# report the host's own interfaces, connections, processes and cgroups. The
|
|
# host's /proc, /sys and / are mounted read-only under /host and /rootfs, and
|
|
# node_exporter writes nothing.
|
|
#
|
|
# LISTEN ADDRESSES. Exactly two:
|
|
# - 127.0.0.1:9100 for host-local probes
|
|
# - 192.168.0.235:9100 for Prometheus, which scrapes this host from Dankclaw
|
|
# (shared/prometheus/prometheus.yml, job "node-dankserver"). It cannot use
|
|
# loopback across hosts, and node_exporter has no authentication, so the
|
|
# wildcard bind stays off the table. This is the same deliberate LAN
|
|
# listener posture the observability runbook documents.
|
|
#
|
|
# MIRROR. Keep this file in step with dankclaw/observability/quadlet/
|
|
# node-exporter.container; only the Description and the LAN address differ.
|
|
|
|
[Unit]
|
|
Description=Prometheus node exporter (Dankserver host metrics)
|
|
After=network-online.target
|
|
Wants=network-online.target
|
|
|
|
[Container]
|
|
ContainerName=node-exporter
|
|
Image=docker.io/prom/node-exporter:latest@sha256:1b4e4438faca4dd7e001dd445d161a4a2091b0fededa84093b3a8dfeae1f1be0
|
|
Network=host
|
|
PodmanArgs=--pid=host
|
|
Exec=--path.procfs=/host/proc --path.sysfs=/host/sys --path.rootfs=/rootfs --web.listen-address=127.0.0.1:9100 --web.listen-address=192.168.0.235:9100
|
|
Volume=/proc:/host/proc:ro
|
|
Volume=/sys:/host/sys:ro
|
|
Volume=/:/rootfs:ro
|
|
HealthCmd=wget --spider -q http://localhost:9100/metrics
|
|
HealthInterval=30s
|
|
HealthTimeout=10s
|
|
HealthRetries=3
|
|
HealthStartPeriod=30s
|
|
|
|
[Service]
|
|
Restart=always
|
|
RestartSec=10
|
|
|
|
[Install]
|
|
WantedBy=default.target
|