From 9a878e8b8bafcb388ed90809df5d7448a3c6b68b Mon Sep 17 00:00:00 2001 From: mm Date: Sun, 13 Sep 2026 17:26:42 +0200 Subject: [PATCH] feat: Telegraf node installer (Linux apt/dnf/apk/static, Proxmox, Apache, Docker; Windows PowerShell) --- .gitignore | 2 + LICENSE | 9 ++ README.md | 64 ++++++++++++ install.ps1 | 113 ++++++++++++++++++++ install.sh | 233 ++++++++++++++++++++++++++++++++++++++++++ telegraf/apache.conf | 13 +++ telegraf/base.conf | 47 +++++++++ telegraf/docker.conf | 20 ++++ telegraf/proxmox.conf | 12 +++ 9 files changed, 513 insertions(+) create mode 100644 .gitignore create mode 100644 LICENSE create mode 100644 README.md create mode 100644 install.ps1 create mode 100755 install.sh create mode 100644 telegraf/apache.conf create mode 100644 telegraf/base.conf create mode 100644 telegraf/docker.conf create mode 100644 telegraf/proxmox.conf diff --git a/.gitignore b/.gitignore new file mode 100644 index 0000000..bf9dfdc --- /dev/null +++ b/.gitignore @@ -0,0 +1,2 @@ +*.swp +.DS_Store diff --git a/LICENSE b/LICENSE new file mode 100644 index 0000000..e5b929e --- /dev/null +++ b/LICENSE @@ -0,0 +1,9 @@ +MIT License + +Copyright (c) 2026 Mathias Mahrholz + +Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions: + +The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. diff --git a/README.md b/README.md new file mode 100644 index 0000000..3894642 --- /dev/null +++ b/README.md @@ -0,0 +1,64 @@ +# netbird-telegraf-installer + +Ein Befehl, und eine Node liefert Metriken + Logs an den zentralen Collector im NetBird-Netz +(Prometheus Remote Write `:9090`, Loki `:3100`, Grafana `:3000` — alle auf `100.83.134.46`). + +Voraussetzung: Die Node ist NetBird-Peer und erreicht `100.83.134.46`. Kein Tunnel, keine Freigabe nach außen. + +## Linux — Debian, Ubuntu, Proxmox VE, RHEL/Rocky/Alma/Fedora, Alpine, sonstige + +```sh +curl -fsSL https://gitea.m-m.bio/mm/netbird-telegraf-installer/raw/branch/main/install.sh | sudo sh -s -- --name +``` + +| Option | Bedeutung | +|---|---| +| `--name ` | Node-Name im Dashboard (Default: `hostname -s`) | +| `--collector ` | Collector-IP (Default `100.83.134.46`) | +| `--role proxmox\|apache\|docker\|none` | Zusatz-Profil; Default `auto` erkennt Proxmox, Docker und Apache selbst | +| `--pve-token 'telegraf@pve!monitoring=…'` | Proxmox-API-Token für VM/CT-Metriken | +| `--apache-log ` | Access-Log (Default `/var/log/apache2/access.log`) | +| `--uninstall` | alles entfernen | + +Ablauf: Paketquelle von InfluxData (apt/dnf/apk) oder statisches Binary (amd64/arm64/armv7) → `/etc/telegraf/telegraf.conf` + `telegraf.d/` aus diesem Repo → `/etc/default/telegraf` mit NODE_NAME/COLLECTOR → systemd-Dienst `telegraf`, enabled, Konfig-Test vor dem Start. + +### Proxmox VE + +```sh +pveum user add telegraf@pve +pveum user token add telegraf@pve monitoring -privsep 1 # Secret notieren +pveum acl modify / -token 'telegraf@pve!monitoring' -role PVEAuditor +curl -fsSL https://gitea.m-m.bio/mm/netbird-telegraf-installer/raw/branch/main/install.sh | sh -s -- --name pve1 --pve-token 'telegraf@pve!monitoring=' +``` + +### Apache + +Wird automatisch erkannt (`apache2ctl`/`httpd`). Access-Log geht roh nach Loki. Für Request-Metriken `inputs.apache` in `telegraf/apache.conf` einschalten (braucht mod_status). + +## Windows — PowerShell als Administrator + +```powershell +Set-ExecutionPolicy Bypass -Scope Process -Force +iwr -useb https://gitea.m-m.bio/mm/netbird-telegraf-installer/raw/branch/main/install.ps1 | iex +``` +Mit Parametern: `& ([scriptblock]::Create((iwr -useb …/install.ps1))) -Name mypc` +Installiert nach `C:\Program Files\Telegraf`, Dienst `telegraf`; liefert CPU/RAM/Disk/Net/Dienste + Eventlog (Warnung/Fehler) an den Collector. `-Uninstall` entfernt alles. + +## Docker-Host ohne root + +Wer kein sudo hat, aber in der Gruppe `docker` ist: Container-Variante aus +[netbird-observability/stacks/telegraf-node](https://gitea.m-m.bio/mm/netbird-observability) (privates Repo). + +## Prüfen + +```sh +curl -s 'http://100.83.134.46:9090/api/v1/query?query=system_uptime{node=""}' +journalctl -u telegraf -f +``` +Im Grafana-Dashboard „NetBird Observability — Overview“ erscheint die Node automatisch im Node-Filter. + +## Sicherheit + +- Der Collector akzeptiert unauthentifiziert — er ist nur über das NetBird-Interface erreichbar. +- Telegraf läuft als Benutzer `telegraf` (Docker-Socket read-only via Gruppe `docker`, Apache-Logs via Gruppe `adm`). +- Dieses Repo ist öffentlich und enthält keine Secrets. Tokens landen nur in `/etc/default/telegraf` (0600). diff --git a/install.ps1 b/install.ps1 new file mode 100644 index 0000000..0bc4b1f --- /dev/null +++ b/install.ps1 @@ -0,0 +1,113 @@ +<# +.SYNOPSIS + NetBird Observability — Telegraf Node Installer (Windows, als Administrator) +.EXAMPLE + Set-ExecutionPolicy Bypass -Scope Process -Force + iwr -useb https://gitea.m-m.bio/mm/netbird-telegraf-installer/raw/branch/main/install.ps1 | iex + # mit Parametern: + & ([scriptblock]::Create((iwr -useb https://gitea.m-m.bio/mm/netbird-telegraf-installer/raw/branch/main/install.ps1))) -Name mypc -Collector 100.83.134.46 +#> +param( + [string]$Name = $env:COMPUTERNAME.ToLower(), + [string]$Collector = "100.83.134.46", + [string]$Version = "1.40.0", + [switch]$Uninstall +) +$ErrorActionPreference = "Stop" +$Dir = "C:\Program Files\Telegraf" +$Exe = "$Dir\telegraf.exe" +$Conf = "$Dir\telegraf.conf" + +$isAdmin = ([Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator) +if (-not $isAdmin) { throw "Bitte als Administrator ausführen." } + +if ($Uninstall) { + if (Test-Path $Exe) { Stop-Service telegraf -ErrorAction SilentlyContinue; & $Exe --service uninstall 2>$null } + Remove-Item -Recurse -Force $Dir -ErrorAction SilentlyContinue + Write-Host "[netbird-telegraf] Telegraf entfernt."; exit 0 +} + +$arch = "amd64" +if ($env:PROCESSOR_ARCHITECTURE -eq "ARM64") { $arch = "arm64" } +elseif (-not [Environment]::Is64BitOperatingSystem) { $arch = "i386" } +Write-Host "[netbird-telegraf] Node=$Name Arch=$arch Collector=$Collector" + +try { + Invoke-WebRequest -UseBasicParsing -TimeoutSec 8 "http://${Collector}:9090/-/ready" | Out-Null + Write-Host "[netbird-telegraf] Collector erreichbar." +} catch { + Write-Warning "Collector http://${Collector}:9090 nicht erreichbar — NetBird verbunden? Installation läuft weiter, Telegraf puffert." +} + +if (-not (Test-Path $Exe)) { + $zip = Join-Path $env:TEMP "telegraf.zip" + $url = "https://dl.influxdata.com/telegraf/releases/telegraf-${Version}_windows_${arch}.zip" + Write-Host "[netbird-telegraf] Lade $url" + Invoke-WebRequest -UseBasicParsing $url -OutFile $zip + $tmp = Join-Path $env:TEMP "telegraf-extract" + Remove-Item -Recurse -Force $tmp -ErrorAction SilentlyContinue + Expand-Archive $zip $tmp + New-Item -ItemType Directory -Force $Dir | Out-Null + $bin = Get-ChildItem $tmp -Recurse -Filter telegraf.exe | Select-Object -First 1 + Copy-Item $bin.FullName $Exe -Force +} + +$cfg = @" +[global_tags] + node = "$Name" + +[agent] + interval = "15s" + flush_interval = "15s" + metric_batch_size = 1000 + metric_buffer_limit = 20000 + hostname = "$Name" + +[[outputs.http]] + url = "http://${Collector}:9090/api/v1/write" + data_format = "prometheusremotewrite" + timeout = "10s" + namedrop = ["win_eventlog"] + [outputs.http.headers] + Content-Type = "application/x-protobuf" + Content-Encoding = "snappy" + X-Prometheus-Remote-Write-Version = "0.1.0" + +[[outputs.loki]] + domain = "http://${Collector}:3100" + endpoint = "/loki/api/v1/push" + namepass = ["win_eventlog"] + sanitize_label_names = true + metric_name_label = "" + +[[inputs.cpu]] + percpu = false + totalcpu = true +[[inputs.mem]] +[[inputs.swap]] +[[inputs.system]] +[[inputs.disk]] +[[inputs.diskio]] +[[inputs.net]] +[[inputs.win_services]] + +[[inputs.win_eventlog]] + xpath_query = "" + from_beginning = false + only_first_line_of_message = true + +[[processors.override]] + namepass = ["win_eventlog"] + fieldinclude = ["Message", "Source", "EventID"] +"@ +Set-Content -Path $Conf -Value $cfg -Encoding UTF8 + +& $Exe --config $Conf --test --input-filter cpu | Out-Null +Stop-Service telegraf -ErrorAction SilentlyContinue +& $Exe --service uninstall 2>$null | Out-Null +& $Exe --service install --config $Conf | Out-Null +Start-Service telegraf +Start-Sleep -Seconds 3 +if ((Get-Service telegraf).Status -ne "Running") { throw "Dienst telegraf läuft nicht." } +Write-Host "[netbird-telegraf] OK — Node '$Name' liefert an http://${Collector}:9090 (Metriken) und :3100 (Eventlog Warn/Error)." +Write-Host "[netbird-telegraf] Grafana: http://${Collector}:3000 (nur im NetBird)" diff --git a/install.sh b/install.sh new file mode 100755 index 0000000..90ee85d --- /dev/null +++ b/install.sh @@ -0,0 +1,233 @@ +#!/usr/bin/env sh +# ============================================================================ +# NetBird Observability — Telegraf Node Installer (Linux) +# +# Installiert Telegraf als systemd-Dienst und verbindet die Node fest mit dem +# zentralen Collector auf dem imac (Prometheus Remote Write + Loki) im NetBird. +# +# Unterstützt: Debian/Ubuntu/Proxmox VE (apt), RHEL/Rocky/Alma/Fedora (dnf/yum), +# Alpine (apk, OpenRC), sonstige Linux via statischem Binary. +# Architekturen: amd64 / x86_64, arm64 / aarch64, armv7. +# Windows: install.ps1 verwenden. +# +# Nutzung (als root): +# curl -fsSL https://gitea.m-m.bio/mm/netbird-telegraf-installer/raw/branch/main/install.sh | sh -s -- --name +# Optionen: +# --name Node-Name (Default: hostname -s) +# --collector Collector-IP im NetBird (Default: 100.83.134.46) +# --role Zusatz-Profil: proxmox | apache | docker | none (Default: auto) +# --pve-token Proxmox API-Token 'user@pve!name=secret' (nur --role proxmox) +# --apache-log

Apache-Access-Log (Default: /var/log/apache2/access.log) +# --uninstall Telegraf + Konfiguration entfernen +# ============================================================================ +set -eu + +COLLECTOR="${COLLECTOR:-100.83.134.46}" +NODE_NAME="${NODE_NAME:-$(hostname -s 2>/dev/null || hostname)}" +ROLE="auto" +PVE_TOKEN="${PVE_TOKEN:-}" +APACHE_LOG="/var/log/apache2/access.log" +TELEGRAF_VERSION="${TELEGRAF_VERSION:-1.40.0}" +REPO_RAW="https://gitea.m-m.bio/mm/netbird-telegraf-installer/raw/branch/main" +UNINSTALL=0 + +while [ $# -gt 0 ]; do + case "$1" in + --name) NODE_NAME="$2"; shift 2 ;; + --collector) COLLECTOR="$2"; shift 2 ;; + --role) ROLE="$2"; shift 2 ;; + --pve-token) PVE_TOKEN="$2"; shift 2 ;; + --apache-log) APACHE_LOG="$2"; shift 2 ;; + --uninstall) UNINSTALL=1; shift ;; + -h|--help) sed -n '2,24p' "$0"; exit 0 ;; + *) echo "Unbekannte Option: $1" >&2; exit 2 ;; + esac +done + +log() { printf '\033[1;34m[netbird-telegraf]\033[0m %s\n' "$*"; } +die() { printf '\033[1;31m[netbird-telegraf] FEHLER:\033[0m %s\n' "$*" >&2; exit 1; } + +[ "$(id -u)" -eq 0 ] || die "Bitte als root ausführen (sudo)." + +# -------------------------------------------------------------------------- +# Uninstall +# -------------------------------------------------------------------------- +if [ "$UNINSTALL" -eq 1 ]; then + log "Entferne Telegraf …" + systemctl disable --now telegraf 2>/dev/null || rc-service telegraf stop 2>/dev/null || true + if command -v apt-get >/dev/null; then apt-get remove -y telegraf >/dev/null 2>&1 || true + elif command -v dnf >/dev/null; then dnf remove -y telegraf >/dev/null 2>&1 || true + elif command -v yum >/dev/null; then yum remove -y telegraf >/dev/null 2>&1 || true + elif command -v apk >/dev/null; then apk del telegraf >/dev/null 2>&1 || true + fi + rm -rf /etc/telegraf /usr/local/bin/telegraf /etc/systemd/system/telegraf.service + systemctl daemon-reload 2>/dev/null || true + log "Fertig." + exit 0 +fi + +# -------------------------------------------------------------------------- +# Erkennung: OS, Arch, Rolle +# -------------------------------------------------------------------------- +OS_ID="unknown"; [ -r /etc/os-release ] && . /etc/os-release && OS_ID="${ID:-unknown}" +ARCH_RAW="$(uname -m)" +case "$ARCH_RAW" in + x86_64|amd64) ARCH="amd64" ;; + aarch64|arm64) ARCH="arm64" ;; + armv7l|armhf) ARCH="armhf" ;; + *) die "Architektur $ARCH_RAW wird nicht unterstützt." ;; +esac + +IS_PVE=0; command -v pveversion >/dev/null 2>&1 && IS_PVE=1 +HAS_DOCKER=0; [ -S /var/run/docker.sock ] && HAS_DOCKER=1 +HAS_APACHE=0; { command -v apache2ctl >/dev/null 2>&1 || command -v httpd >/dev/null 2>&1; } && HAS_APACHE=1 +if [ "$ROLE" = "auto" ]; then + ROLE="none" + [ "$IS_PVE" -eq 1 ] && ROLE="proxmox" +fi +log "Node=$NODE_NAME OS=$OS_ID Arch=$ARCH Rolle=$ROLE Docker=$HAS_DOCKER Apache=$HAS_APACHE Collector=$COLLECTOR" + +# -------------------------------------------------------------------------- +# Erreichbarkeit des Collectors (NetBird Lazy Connection: erst anklopfen) +# -------------------------------------------------------------------------- +if command -v curl >/dev/null; then + ping -c1 -W2 "$COLLECTOR" >/dev/null 2>&1 || true + if curl -fsS -m 8 "http://$COLLECTOR:9090/-/ready" >/dev/null 2>&1; then + log "Collector erreichbar." + else + log "WARNUNG: http://$COLLECTOR:9090 nicht erreichbar. NetBird auf dieser Node verbunden? (netbird status) — Installation läuft weiter, Telegraf puffert und retried." + fi +fi + +# -------------------------------------------------------------------------- +# Installation +# -------------------------------------------------------------------------- +install_apt() { + command -v gpg >/dev/null || { apt-get update -qq; apt-get install -y -qq gnupg >/dev/null; } + command -v curl >/dev/null || apt-get install -y -qq curl >/dev/null + mkdir -p /etc/apt/keyrings + curl -fsSL https://repos.influxdata.com/influxdata-archive.key | gpg --dearmor --yes -o /etc/apt/keyrings/influxdata-archive.gpg + echo "deb [signed-by=/etc/apt/keyrings/influxdata-archive.gpg] https://repos.influxdata.com/debian stable main" > /etc/apt/sources.list.d/influxdata.list + apt-get update -qq + DEBIAN_FRONTEND=noninteractive apt-get install -y -qq telegraf >/dev/null +} +install_rpm() { + cat > /etc/yum.repos.d/influxdata.repo <<'EOF' +[influxdata] +name = InfluxData Repository - Stable +baseurl = https://repos.influxdata.com/stable/$basearch/main +enabled = 1 +gpgcheck = 1 +gpgkey = https://repos.influxdata.com/influxdata-archive.key +EOF + if command -v dnf >/dev/null; then dnf install -y -q telegraf; else yum install -y -q telegraf; fi +} +install_static() { + command -v curl >/dev/null || die "curl fehlt." + TB="telegraf-${TELEGRAF_VERSION}_linux_${ARCH}.tar.gz" + log "Statisches Binary $TB …" + TMP="$(mktemp -d)" + curl -fsSL "https://dl.influxdata.com/telegraf/releases/$TB" -o "$TMP/t.tgz" + tar -xzf "$TMP/t.tgz" -C "$TMP" + install -m 0755 "$TMP"/telegraf-*/usr/bin/telegraf /usr/local/bin/telegraf + rm -rf "$TMP" + id telegraf >/dev/null 2>&1 || useradd -r -s /usr/sbin/nologin -d /etc/telegraf telegraf 2>/dev/null || adduser -S -D -H -s /sbin/nologin telegraf + if command -v rc-update >/dev/null; then + cat > /etc/init.d/telegraf <<'EOF' +#!/sbin/openrc-run +description="Telegraf" +command=/usr/local/bin/telegraf +command_args="--config /etc/telegraf/telegraf.conf --config-directory /etc/telegraf/telegraf.d" +command_user=telegraf +command_background=true +pidfile=/run/telegraf.pid +start_pre() { set -a; [ -r /etc/default/telegraf ] && . /etc/default/telegraf; set +a; } +depend() { need net; } +EOF + chmod +x /etc/init.d/telegraf + return + fi + mkdir -p /etc/systemd/system + cat > /etc/systemd/system/telegraf.service <<'EOF' +[Unit] +Description=Telegraf +After=network-online.target +Wants=network-online.target +[Service] +User=telegraf +EnvironmentFile=-/etc/default/telegraf +ExecStart=/usr/local/bin/telegraf --config /etc/telegraf/telegraf.conf --config-directory /etc/telegraf/telegraf.d +Restart=on-failure +RestartSec=5s +[Install] +WantedBy=multi-user.target +EOF +} + +if command -v telegraf >/dev/null 2>&1 || [ -x /usr/local/bin/telegraf ]; then + log "Telegraf bereits installiert ($(telegraf --version 2>/dev/null || /usr/local/bin/telegraf --version))." +else + case "$OS_ID" in + debian|ubuntu|raspbian|linuxmint|pop) install_apt ;; + rhel|centos|rocky|almalinux|fedora|ol) install_rpm ;; + alpine) apk add --no-cache -q curl ca-certificates; install_static ;; + *) if command -v apt-get >/dev/null; then install_apt + elif command -v dnf >/dev/null || command -v yum >/dev/null; then install_rpm + else install_static; fi ;; + esac +fi + +# -------------------------------------------------------------------------- +# Konfiguration +# -------------------------------------------------------------------------- +mkdir -p /etc/telegraf/telegraf.d /etc/default +umask 077 +cat > /etc/default/telegraf </dev/null || true; } +case "$ROLE" in + proxmox) [ -n "$PVE_TOKEN" ] || log "HINWEIS: --pve-token fehlt; VM/CT-Metriken bleiben aus. Token anlegen: pveum user token add telegraf@pve monitoring -privsep 1 && pveum acl modify / -token 'telegraf@pve!monitoring' -role PVEAuditor" + fetch proxmox.conf /etc/telegraf/telegraf.d/proxmox.conf ;; + apache) fetch apache.conf /etc/telegraf/telegraf.d/apache.conf; usermod -aG adm telegraf 2>/dev/null || true ;; + docker|none) ;; + *) die "Unbekannte Rolle: $ROLE" ;; +esac +[ "$HAS_APACHE" -eq 1 ] && [ "$ROLE" != "apache" ] && { fetch apache.conf /etc/telegraf/telegraf.d/apache.conf; usermod -aG adm telegraf 2>/dev/null || true; } +chown -R telegraf:telegraf /etc/telegraf 2>/dev/null || true + +# Konfig testen +TG="$(command -v telegraf || echo /usr/local/bin/telegraf)" +set -a; . /etc/default/telegraf; set +a +"$TG" --config /etc/telegraf/telegraf.conf --config-directory /etc/telegraf/telegraf.d --test --input-filter cpu:mem >/dev/null 2>&1 || die "Konfiguration ungültig — telegraf --test prüfen." + +# -------------------------------------------------------------------------- +# Dienst +# -------------------------------------------------------------------------- +if command -v systemctl >/dev/null && [ -d /run/systemd/system ]; then + systemctl daemon-reload + systemctl enable --now telegraf >/dev/null + systemctl restart telegraf + sleep 3 + systemctl is-active --quiet telegraf || { journalctl -u telegraf -n 20 --no-pager; die "telegraf läuft nicht."; } +elif command -v systemctl >/dev/null; then + log "HINWEIS: systemd nicht aktiv (Container/Chroot) — Dienst wird beim nächsten Boot gestartet (enabled)." + systemctl enable telegraf >/dev/null 2>&1 || true +elif command -v rc-update >/dev/null; then + rc-update add telegraf default >/dev/null 2>&1 || true + rc-service telegraf restart >/dev/null 2>&1 || log "HINWEIS: OpenRC nicht aktiv (Container?) — Dienst beim nächsten Boot." +fi + +log "OK — Node '$NODE_NAME' liefert an http://$COLLECTOR:9090 (Metriken) und :3100 (Logs)." +log "Prüfen: curl -s 'http://$COLLECTOR:9090/api/v1/query?query=system_uptime{node=\"$NODE_NAME\"}'" +log "Grafana: http://$COLLECTOR:3000 (nur im NetBird)" diff --git a/telegraf/apache.conf b/telegraf/apache.conf new file mode 100644 index 0000000..48a0743 --- /dev/null +++ b/telegraf/apache.conf @@ -0,0 +1,13 @@ +# Apache: Access-Log → Loki (roh) + optional Request-Metriken → Prometheus +[[inputs.tail]] + files = ["${APACHE_LOG}"] + from_beginning = false + name_override = "apache_log" + data_format = "value" + data_type = "string" + [inputs.tail.tags] + source = "apache" + +# Optional: mod_status (a2enmod status; ExtendedStatus On; /server-status?auto lokal freigeben) +# [[inputs.apache]] +# urls = ["http://localhost/server-status?auto"] diff --git a/telegraf/base.conf b/telegraf/base.conf new file mode 100644 index 0000000..3cc7672 --- /dev/null +++ b/telegraf/base.conf @@ -0,0 +1,47 @@ +# NetBird Observability — Basis-Konfiguration (alle Linux-Nodes) +# Variablen aus /etc/default/telegraf: NODE_NAME, PROM_URL, LOKI_URL + +[global_tags] + node = "${NODE_NAME}" + +[agent] + interval = "15s" + flush_interval = "15s" + metric_batch_size = 1000 + metric_buffer_limit = 20000 + hostname = "${NODE_NAME}" + omit_hostname = false + +# ---- Metriken → Prometheus Remote Write (imac) ---- +[[outputs.http]] + url = "${PROM_URL}" + data_format = "prometheusremotewrite" + timeout = "10s" + namedrop = ["docker_log", "apache_log"] + [outputs.http.headers] + Content-Type = "application/x-protobuf" + Content-Encoding = "snappy" + X-Prometheus-Remote-Write-Version = "0.1.0" + +# ---- Logs → Loki (imac) ---- +[[outputs.loki]] + domain = "${LOKI_URL}" + endpoint = "/loki/api/v1/push" + timeout = "10s" + namepass = ["docker_log", "apache_log"] + sanitize_label_names = true + metric_name_label = "" + +# ---- Host-Metriken ---- +[[inputs.cpu]] + percpu = false + totalcpu = true +[[inputs.mem]] +[[inputs.swap]] +[[inputs.system]] +[[inputs.disk]] + ignore_fs = ["tmpfs", "devtmpfs", "overlay", "squashfs", "fuse.lxcfs"] +[[inputs.diskio]] +[[inputs.net]] +[[inputs.processes]] +[[inputs.kernel]] diff --git a/telegraf/docker.conf b/telegraf/docker.conf new file mode 100644 index 0000000..286d157 --- /dev/null +++ b/telegraf/docker.conf @@ -0,0 +1,20 @@ +# Docker-Container: Stats + Logs (nur wenn /var/run/docker.sock existiert) +[[inputs.docker]] + endpoint = "unix:///var/run/docker.sock" + perdevice_include = [] + total_include = ["cpu", "blkio", "network"] + docker_label_include = [] + docker_label_exclude = ["*"] + +[[inputs.docker_log]] + endpoint = "unix:///var/run/docker.sock" + from_beginning = false + source_tag = false + docker_label_include = [] + docker_label_exclude = ["*"] + [inputs.docker_log.tagdrop] + container_image = ["telegraf"] + +[[processors.override]] + namepass = ["docker_log"] + fielddrop = ["container_id"] diff --git a/telegraf/proxmox.conf b/telegraf/proxmox.conf new file mode 100644 index 0000000..c28a50d --- /dev/null +++ b/telegraf/proxmox.conf @@ -0,0 +1,12 @@ +# Proxmox VE: VM/CT-Metriken über die PVE-API (Token mit PVEAuditor-Rolle) +# Token anlegen (auf dem PVE-Host): +# pveum user add telegraf@pve +# pveum user token add telegraf@pve monitoring -privsep 1 +# pveum acl modify / -token 'telegraf@pve!monitoring' -role PVEAuditor +# Ergebnis "telegraf@pve!monitoring=xxxxxxxx-…" als --pve-token übergeben. +[[inputs.proxmox]] + base_url = "https://127.0.0.1:8006/api2/json" + api_token = "${PVE_TOKEN}" + node_name = "${NODE_NAME}" + insecure_skip_verify = true + response_timeout = "10s"