Thore Cimbal
44cc030f0b
Sixty-three criticals on running images have no fix to take. Writing them into a trivy ignore file would have been the obvious move and the wrong one: trivy drops ignored findings from its output, so afterwards 'zero because fixed' and 'zero because we looked away' render identically. Every finding stays in trivy_vuln_info. The decisions sit beside them in entscheidungen.json and are counted, not subtracted. Each entry names its CVEs one by one. A blanket entry per image would also swallow the next finding that shows up there, which is the finding you would most want to see. The loader rejects an entry without ids, and rejects a review date it cannot parse — rejecting the whole file, because a half-read decision list is worse than none. An unreadable file leaves everything counted as open. Getting that direction backwards would mean a typo reads as 'all decided', and nobody would notice. The end-to-end run caught the same mistake in the other half: when the derived target set is empty the set is unknown, not empty, so the open count now falls back to every report rather than to zero. Three python services move off the debian base while we are here — 3.13-slim carried four criticals with no fix, 3.13-alpine none. All three run on the stdlib alone and TLS was checked inside the image before the switch.
threadnet-operating
Der Betriebs-/Monitoring-Stack für den Operating-Host CFGMON: Prometheus,
Loki, Grafana, Alloy, Alertmanager und der CVE-Exporter — vollständig als Code,
ein docker compose up -d stellt ihn auf einem frischen Host wieder her.
→ monitoring/README.md ist die eigentliche
Betriebsanleitung (Deployment, Config-Fallen, Alerting, CVE-Pipeline).
Wo was liegt
| Pfad | Inhalt |
|---|---|
monitoring/ |
der Stack: Compose, Prometheus, Loki, Grafana, Alertmanager, Alloy |
monitoring/cve/ |
CVE-Exporter (Trivy-Scan → Prometheus-Metriken), ADR-0003 |
monitoring/grafana/ |
Datasources und Dashboards als Code |
Offene Punkte
Kein Backlog in diesem Repo. Offene Punkte sind Issues im
management-Projekt
(ADR-0005) —
sie betreffen meist mehrere Hosts, eine Liste je Repo würde auseinanderlaufen.
Für diesen Stack einschlägig sind unter anderem
#8 Remote-Write und Loki ohne Auth,
#9 Grafana-Credentials und
#10 Gitea-Backups off-host;
Bestand und Historie zum Host stehen in
hosts/cfgmon.md.
Kanonisch ist git.lab (ADR-0001,
ADR-0002).
Von außerhalb des Labs ist derselbe Stand über den Push-Mirror
sorb/management lesbar — dorthin
aber nie pushen, der Mirror überschreibt.