Repository navigation
Let sf and sf2 push metrics and logs to the monitoring hub - #12
Merged
Merged
Conversation
sf and sf2 are not in the inventory, so the hub's 8443 allowlist does not cover them. They are about to run Alloy next to their old agents (ipni/infra#166, #188). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This was referenced Oct 22, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Part of ipni/infra#188 (register sf and sf2 with Argo CD), under ipni/infra#166.
sf (
103.232.206.165) and sf2 (103.232.206.162) aren't in this inventory, so the monitoring hub's8443allowlist on lith-1 doesn't cover them. Once they're registered with Argo CD, Alloy on them pushes metrics and logs toingest.monitoring.ipni.io:8443, which goes straight to lith-1, not through Cloudflare. This setsmonitoring_ingest_extra_sourcesto their two addresses, as the comment in the role already suggested.What it changes on the boxes
8443/tcp ALLOW <ip> # monitoring ingest.ufw_allowlistkeeps the rules in step with the list, so dropping an address later removes its rule.alloybasic-auth password, and nothing pushes from those addresses until Alloy runs there.Rollout
CI runs a
platform.ymldry run on this PR. After the merge it runs another dry run, then the apply, once a required reviewer approves it inproduction. The dry run should show only the twomonitoring ingestrules on lith-1.🤖 Generated with Claude Code