Thore Cimbal
07875ba6bb
Without this, an image dropped from the desired set keeps reporting: the exporter reads every json in the results directory and takes the target from Trivy's own ArtifactName. That is precisely what the security room showed on 2026-08-20, when it carried HIGH findings for threadnet-web:v0.3.0, an image that runs nowhere. Deletion only ever runs against a list that was successfully read. The guard at the top of the round already skips everything when the list is missing or empty, so a restart during a Prometheus outage cannot clear the estate. The round became a function so the test can load the real one. The first version of that test rebuilt the loop instead, and a rebuilt test proves the rebuild — it stayed green while the shipped file set its paths unconditionally and ignored the environment entirely. Loading it exposed that within one run. Two of my own errors are fixed here as well. The driver read `runde || sleep A && sleep B`, which groups left to right, so a missing list would have slept the wait AND the full day — exactly what the short wait exists to prevent. And the paths were hardcoded where the exporter already took them from the environment. Removing the guard as a deliberate sabotage turns the dangerous case red: untouched reports drop from two to zero.
threadnet-operating
Der Betriebs-/Monitoring-Stack für den Operating-Host CFGMON: Prometheus,
Loki, Grafana, Alloy, Alertmanager und der CVE-Exporter — vollständig als Code,
ein docker compose up -d stellt ihn auf einem frischen Host wieder her.
→ monitoring/README.md ist die eigentliche
Betriebsanleitung (Deployment, Config-Fallen, Alerting, CVE-Pipeline).
Wo was liegt
| Pfad | Inhalt |
|---|---|
monitoring/ |
der Stack: Compose, Prometheus, Loki, Grafana, Alertmanager, Alloy |
monitoring/cve/ |
CVE-Exporter (Trivy-Scan → Prometheus-Metriken), ADR-0003 |
monitoring/grafana/ |
Datasources und Dashboards als Code |
Offene Punkte
Kein Backlog in diesem Repo. Offene Punkte sind Issues im
management-Projekt
(ADR-0005) —
sie betreffen meist mehrere Hosts, eine Liste je Repo würde auseinanderlaufen.
Für diesen Stack einschlägig sind unter anderem
#8 Remote-Write und Loki ohne Auth,
#9 Grafana-Credentials und
#10 Gitea-Backups off-host;
Bestand und Historie zum Host stehen in
hosts/cfgmon.md.
Kanonisch ist git.lab (ADR-0001,
ADR-0002).
Von außerhalb des Labs ist derselbe Stand über den Push-Mirror
sorb/management lesbar — dorthin
aber nie pushen, der Mirror überschreibt.