Thore Cimbal
27770b6ec7
The scan loop is untouched and still reads images.txt, so nothing about this deployment behaves differently. What changes is that the exporter now knows what *should* be scanned and can say how much of it is: three sources, none of them new infrastructure. The cluster and the operating host both already sit in the same Prometheus, and the registry answers an anonymous token — the same token dance Trivy performs to pull. The coverage numbers are the point of this slice. Once deployed they have to read 24 missing, 2 orphaned and about 0.52, because that is what was counted by hand on 2026-08-21. A different answer means the derivation is wrong, not the hand count stale. Failure handling is the substance rather than an afterthought. A source that fails costs only its own share; its freshness timestamp keeps ageing instead of disappearing, because a series that vanishes can never fire a rule — the third finding of the 2026-08-01 AAR. When every source fails the target file is left untouched, so a restart during a Prometheus outage cannot clear the estate. Twenty-one assertions cover it, each paired with its counter-proof: names that must collapse and names that must not, a source filter that is shown to matter by removing it, and time-ordered tag selection against the name ordering that would silently drop v0.10.0. Sabotaging the normalisation turns eleven of them red, so the suite demonstrably can fail.
threadnet-operating
Der Betriebs-/Monitoring-Stack für den Operating-Host CFGMON: Prometheus,
Loki, Grafana, Alloy, Alertmanager und der CVE-Exporter — vollständig als Code,
ein docker compose up -d stellt ihn auf einem frischen Host wieder her.
→ monitoring/README.md ist die eigentliche
Betriebsanleitung (Deployment, Config-Fallen, Alerting, CVE-Pipeline).
Wo was liegt
| Pfad | Inhalt |
|---|---|
monitoring/ |
der Stack: Compose, Prometheus, Loki, Grafana, Alertmanager, Alloy |
monitoring/cve/ |
CVE-Exporter (Trivy-Scan → Prometheus-Metriken), ADR-0003 |
monitoring/grafana/ |
Datasources und Dashboards als Code |
Offene Punkte
Kein Backlog in diesem Repo. Offene Punkte sind Issues im
management-Projekt
(ADR-0005) —
sie betreffen meist mehrere Hosts, eine Liste je Repo würde auseinanderlaufen.
Für diesen Stack einschlägig sind unter anderem
#8 Remote-Write und Loki ohne Auth,
#9 Grafana-Credentials und
#10 Gitea-Backups off-host;
Bestand und Historie zum Host stehen in
hosts/cfgmon.md.
Kanonisch ist git.lab (ADR-0001,
ADR-0002).
Von außerhalb des Labs ist derselbe Stand über den Push-Mirror
sorb/management lesbar — dorthin
aber nie pushen, der Mirror überschreibt.