Thore Cimbal
b989987d69
Gate 3 planned three rules; there are four. The fourth covers a case the others miss entirely: every source answers cleanly but empty. Then nothing is missing, because the desired set is empty, the freshness stamps are current, and nothing is scanned at all. The Python suite already carries that case as "an empty set is not the same as success", so the rule belongs with it. These are the first rule unit tests in this stack. Each rule has a case where it must fire and one where it must stay silent, because a rule that always fires cannot be told from a correct one otherwise. Two sabotages confirm the tests bite: an unreachable threshold on the source-freshness rule makes the expected alert vanish, and removing the six hour grace period makes the missing-targets rule fire at five hours where the test demands silence. The grace period is not padding. A full round over roughly 65 images takes time, so right after a deploy the gap is real rather than wrong. The dashboard gains coverage and unscanned-image counters in the two free slots of the top row, and a source-freshness bar at the bottom, so no existing panel moves. That bar is the only place where a failed derivation can be told apart from success.
threadnet-operating
Der Betriebs-/Monitoring-Stack für den Operating-Host CFGMON: Prometheus,
Loki, Grafana, Alloy, Alertmanager und der CVE-Exporter — vollständig als Code,
ein docker compose up -d stellt ihn auf einem frischen Host wieder her.
→ monitoring/README.md ist die eigentliche
Betriebsanleitung (Deployment, Config-Fallen, Alerting, CVE-Pipeline).
Wo was liegt
| Pfad | Inhalt |
|---|---|
monitoring/ |
der Stack: Compose, Prometheus, Loki, Grafana, Alertmanager, Alloy |
monitoring/cve/ |
CVE-Exporter (Trivy-Scan → Prometheus-Metriken), ADR-0003 |
monitoring/grafana/ |
Datasources und Dashboards als Code |
Offene Punkte
Kein Backlog in diesem Repo. Offene Punkte sind Issues im
management-Projekt
(ADR-0005) —
sie betreffen meist mehrere Hosts, eine Liste je Repo würde auseinanderlaufen.
Für diesen Stack einschlägig sind unter anderem
#8 Remote-Write und Loki ohne Auth,
#9 Grafana-Credentials und
#10 Gitea-Backups off-host;
Bestand und Historie zum Host stehen in
hosts/cfgmon.md.
Kanonisch ist git.lab (ADR-0001,
ADR-0002).
Von außerhalb des Labs ist derselbe Stand über den Push-Mirror
sorb/management lesbar — dorthin
aber nie pushen, der Mirror überschreibt.