Thore CimbalandClaude Fable 5
b6007c50fd
- cve-scan: Trivy-Loop ueber die 29 real deployten Images (Cluster-Inventur 2026-08-01 + Prod-Web-Image); 24h-Intervall, Fehler einzelner Images blockieren nicht - cve-exporter: Stdlib-Exporter mit first_seen-State (Zeitstrahl), Schema trivy_vuln_info/_count/_first_seen/_last_scan gemaess Pflichtfeldern - 3 Alertregeln (CRITICAL sofort, HIGH mit 24h-Daempfung, Scan-Frische) - promtool SUCCESS 9 rules; alle mit room=security - matrix-alerts: Label-basiertes Raum-Routing (MATRIX_ROOM_<NAME>), Edits landen im richtigen Raum via State - Grafana-Dashboard cve-overview: Severity-Stats, CVE-Tabelle mit NVD-Link/Fix-Version/first-seen, Zeitstrahl, Verlauf UNGETESTET bis zum Deploy auf CFGMON (compose up -d). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PKhFj1S3UdD6xL2fbWPeYj
55 lines
1.3 KiB
YAML
55 lines
1.3 KiB
YAML
global:
|
|
scrape_interval: 15s
|
|
|
|
rule_files:
|
|
- /etc/prometheus/alerts.yml
|
|
|
|
alerting:
|
|
alertmanagers:
|
|
- static_configs:
|
|
- targets: ["alertmanager:9093"]
|
|
|
|
# Zusaetzlich zu diesen Scrape-Targets kommen Metriken per Remote-Write rein
|
|
# (k3s-Cluster: flux, kube_state_metrics; Matrix-Server: synapse).
|
|
scrape_configs:
|
|
## Operating-Server (dieser Host)
|
|
- job_name: "operating_prometheus"
|
|
static_configs:
|
|
- targets: ["localhost:9090"]
|
|
|
|
- job_name: "operating_node-exporter"
|
|
static_configs:
|
|
- targets: ["node-exporter:9100"]
|
|
|
|
- job_name: "operating_cadvisor"
|
|
# cadvisor laeuft im Portainer-Stack "thread-net-git", selbes traefik-Netz
|
|
static_configs:
|
|
- targets: ["cadvisor:8080"]
|
|
|
|
- job_name: "operating_traefik"
|
|
metrics_path: "/metrics"
|
|
static_configs:
|
|
- targets: ["traefik:8080"]
|
|
|
|
## Externe Hosts
|
|
- job_name: "k3s_host_node"
|
|
static_configs:
|
|
- targets: ["10.0.0.2:9100"]
|
|
labels:
|
|
instance: "k3s-host"
|
|
|
|
- job_name: "pterodactyl_host_node"
|
|
static_configs:
|
|
- targets: ["157.90.155.206:9100"]
|
|
labels:
|
|
instance: "pterodactyl"
|
|
|
|
- job_name: "gameserver_cadvisor"
|
|
static_configs:
|
|
- targets: ["157.90.155.206:8080"]
|
|
|
|
# CVE-Exporter (gitops#47)
|
|
- job_name: "cve_exporter"
|
|
static_configs:
|
|
- targets: ["cve-exporter:9101"]
|