336 lines
15 KiB
Bash
Executable File
336 lines
15 KiB
Bash
Executable File
#!/usr/bin/env sh
|
|
# ============================================================================
|
|
# NetBird Observability — Telegraf Node Installer (Linux)
|
|
#
|
|
# Installiert Telegraf als systemd-Dienst und verbindet die Node fest mit dem
|
|
# zentralen Collector auf dem imac (Prometheus Remote Write + Loki) im NetBird.
|
|
#
|
|
# Unterstützt: Debian/Ubuntu/Proxmox VE (apt), RHEL/Rocky/Alma/Fedora (dnf/yum),
|
|
# Alpine (apk, OpenRC), sonstige Linux via statischem Binary.
|
|
# Architekturen: amd64 / x86_64, arm64 / aarch64, armv7.
|
|
# Windows: install.ps1 verwenden.
|
|
#
|
|
# Nutzung (als root):
|
|
# curl -fsSL https://gitea.m-m.bio/mm/netbird-telegraf-installer/raw/branch/main/install.sh | sh -s -- --name <node-name>
|
|
# Optionen:
|
|
# --name <n> Node-Name (Default: hostname -s)
|
|
# --token <t> Bearer-Token des Reverse-Proxys (Pflicht)
|
|
# --collector <ip> Direktweg im NetBird statt Reverse Proxy
|
|
# --role <r> Zusatz-Profil: proxmox | apache | docker | none (Default: auto)
|
|
# --pve-token <t> Proxmox API-Token 'user@pve!name=secret' (nur --role proxmox)
|
|
# --pve-node <n> Name des PVE-Knotens im PVE-Baum (Default: per pvesh erkannt)
|
|
# --pve-url <u> PVE-API-URL (Default: https://127.0.0.1:8006/api2/json)
|
|
# --apache-log <p> Apache-Access-Log (Default: /var/log/apache2/access.log)
|
|
# --uninstall Telegraf + Konfiguration entfernen
|
|
# ============================================================================
|
|
set -eu
|
|
|
|
# Ausgang ueber den NetBird-Reverse-Proxy: funktioniert auch fuer Hosts, die
|
|
# KEIN NetBird-Peer sind (Büro-LAN, Kundenlaptop, CGNAT). Token erforderlich.
|
|
PROM_URL_DEFAULT="https://imac-prometheus.x05.idx.wf/api/v1/write"
|
|
LOKI_URL_DEFAULT="https://imac-loki.x05.idx.wf"
|
|
COLLECTOR="${COLLECTOR:-}" # nur setzen fuer den Direktweg im NetBird
|
|
TELEGRAF_TOKEN="${TELEGRAF_TOKEN:-}"
|
|
NODE_NAME="${NODE_NAME:-$(hostname -s 2>/dev/null || hostname)}"
|
|
ROLE="auto"
|
|
PVE_TOKEN="${PVE_TOKEN:-}"
|
|
PVE_NODE="${PVE_NODE:-}"
|
|
PVE_URL="${PVE_URL:-}"
|
|
APACHE_LOG="/var/log/apache2/access.log"
|
|
TELEGRAF_VERSION="${TELEGRAF_VERSION:-1.40.0}"
|
|
REPO_RAW="https://gitea.m-m.bio/mm/netbird-telegraf-installer/raw/branch/main"
|
|
UNINSTALL=0
|
|
|
|
while [ $# -gt 0 ]; do
|
|
case "$1" in
|
|
--name) NODE_NAME="$2"; shift 2 ;;
|
|
--collector) COLLECTOR="${2:-}"; shift 2 ;;
|
|
--token) TELEGRAF_TOKEN="$2"; shift 2 ;;
|
|
--role) ROLE="$2"; shift 2 ;;
|
|
--pve-token) PVE_TOKEN="$2"; shift 2 ;;
|
|
--pve-node) PVE_NODE="$2"; shift 2 ;;
|
|
--pve-url) PVE_URL="$2"; shift 2 ;;
|
|
--apache-log) APACHE_LOG="$2"; shift 2 ;;
|
|
--uninstall) UNINSTALL=1; shift ;;
|
|
-h|--help) sed -n '2,24p' "$0"; exit 0 ;;
|
|
*) echo "Unbekannte Option: $1" >&2; exit 2 ;;
|
|
esac
|
|
done
|
|
|
|
log() { printf '\033[1;34m[netbird-telegraf]\033[0m %s\n' "$*"; }
|
|
die() { printf '\033[1;31m[netbird-telegraf] FEHLER:\033[0m %s\n' "$*" >&2; exit 1; }
|
|
|
|
[ "$(id -u)" -eq 0 ] || die "Bitte als root ausführen (sudo)."
|
|
[ -n "$TELEGRAF_TOKEN" ] || die "Kein Token: --token <Bearer-Token> angeben (siehe README)."
|
|
|
|
if [ -n "${COLLECTOR:-}" ]; then
|
|
PROM_URL="http://$COLLECTOR:9090/api/v1/write"; LOKI_URL="http://$COLLECTOR:3100"
|
|
log "Direktweg im NetBird: Collector $COLLECTOR"
|
|
else
|
|
PROM_URL="$PROM_URL_DEFAULT"; LOKI_URL="$LOKI_URL_DEFAULT"
|
|
fi
|
|
|
|
# --------------------------------------------------------------------------
|
|
# Uninstall
|
|
# --------------------------------------------------------------------------
|
|
if [ "$UNINSTALL" -eq 1 ]; then
|
|
log "Entferne Telegraf …"
|
|
systemctl disable --now telegraf 2>/dev/null || rc-service telegraf stop 2>/dev/null || true
|
|
if command -v apt-get >/dev/null; then apt-get remove -y telegraf >/dev/null 2>&1 || true
|
|
elif command -v dnf >/dev/null; then dnf remove -y telegraf >/dev/null 2>&1 || true
|
|
elif command -v yum >/dev/null; then yum remove -y telegraf >/dev/null 2>&1 || true
|
|
elif command -v apk >/dev/null; then apk del telegraf >/dev/null 2>&1 || true
|
|
fi
|
|
rm -rf /etc/telegraf /usr/local/bin/telegraf /etc/systemd/system/telegraf.service
|
|
systemctl daemon-reload 2>/dev/null || true
|
|
log "Fertig."
|
|
exit 0
|
|
fi
|
|
|
|
# --------------------------------------------------------------------------
|
|
# Erkennung: OS, Arch, Rolle
|
|
# --------------------------------------------------------------------------
|
|
OS_ID="unknown"; [ -r /etc/os-release ] && . /etc/os-release && OS_ID="${ID:-unknown}"
|
|
ARCH_RAW="$(uname -m)"
|
|
case "$ARCH_RAW" in
|
|
x86_64|amd64) ARCH="amd64" ;;
|
|
aarch64|arm64) ARCH="arm64" ;;
|
|
armv7l|armhf) ARCH="armhf" ;;
|
|
*) die "Architektur $ARCH_RAW wird nicht unterstützt." ;;
|
|
esac
|
|
|
|
IS_PVE=0; command -v pveversion >/dev/null 2>&1 && IS_PVE=1
|
|
HAS_DOCKER=0; [ -S /var/run/docker.sock ] && HAS_DOCKER=1
|
|
GPU="none"
|
|
if command -v nvidia-smi >/dev/null 2>&1 && nvidia-smi -L >/dev/null 2>&1; then
|
|
GPU="nvidia"
|
|
elif command -v rocm-smi >/dev/null 2>&1; then
|
|
GPU="amd"
|
|
elif [ -e /dev/dri/renderD128 ]; then
|
|
GPU="intel"
|
|
fi
|
|
HAS_APACHE=0; { command -v apache2ctl >/dev/null 2>&1 || command -v httpd >/dev/null 2>&1; } && HAS_APACHE=1
|
|
if [ "$ROLE" = "auto" ]; then
|
|
ROLE="none"
|
|
[ "$IS_PVE" -eq 1 ] && ROLE="proxmox"
|
|
fi
|
|
log "Node=$NODE_NAME OS=$OS_ID Arch=$ARCH Rolle=$ROLE Docker=$HAS_DOCKER Apache=$HAS_APACHE GPU=$GPU Collector=$COLLECTOR"
|
|
|
|
# --------------------------------------------------------------------------
|
|
# Erreichbarkeit des Collectors (NetBird Lazy Connection: erst anklopfen)
|
|
# --------------------------------------------------------------------------
|
|
if command -v curl >/dev/null; then
|
|
HOST_OF_URL="$(printf '%s' "$PROM_URL" | sed -E 's#^https?://([^/:]+).*#\1#')"
|
|
ping -c1 -W2 "$HOST_OF_URL" >/dev/null 2>&1 || true # NetBird Lazy Connection wecken
|
|
if curl -fsS -m 10 -H "Authorization: Bearer $TELEGRAF_TOKEN" "${PROM_URL%/api/v1/write}/-/ready" >/dev/null 2>&1; then
|
|
log "Collector erreichbar (auth ok): $PROM_URL"
|
|
else
|
|
log "WARNUNG: $PROM_URL nicht erreichbar oder Token falsch — Installation läuft weiter, Telegraf puffert und retried."
|
|
fi
|
|
fi
|
|
|
|
# --------------------------------------------------------------------------
|
|
# Installation
|
|
# --------------------------------------------------------------------------
|
|
install_apt() {
|
|
command -v gpg >/dev/null || { apt-get update -qq; apt-get install -y -qq gnupg >/dev/null; }
|
|
command -v curl >/dev/null || apt-get install -y -qq curl >/dev/null
|
|
mkdir -p /etc/apt/keyrings
|
|
curl -fsSL https://repos.influxdata.com/influxdata-archive.key | gpg --dearmor --yes -o /etc/apt/keyrings/influxdata-archive.gpg
|
|
echo "deb [signed-by=/etc/apt/keyrings/influxdata-archive.gpg] https://repos.influxdata.com/debian stable main" > /etc/apt/sources.list.d/influxdata.list
|
|
apt-get update -qq
|
|
DEBIAN_FRONTEND=noninteractive apt-get install -y -qq telegraf >/dev/null
|
|
}
|
|
install_rpm() {
|
|
cat > /etc/yum.repos.d/influxdata.repo <<'EOF'
|
|
[influxdata]
|
|
name = InfluxData Repository - Stable
|
|
baseurl = https://repos.influxdata.com/stable/$basearch/main
|
|
enabled = 1
|
|
gpgcheck = 1
|
|
gpgkey = https://repos.influxdata.com/influxdata-archive.key
|
|
EOF
|
|
if command -v dnf >/dev/null; then dnf install -y -q telegraf; else yum install -y -q telegraf; fi
|
|
}
|
|
install_static() {
|
|
command -v curl >/dev/null || die "curl fehlt."
|
|
TB="telegraf-${TELEGRAF_VERSION}_linux_${ARCH}.tar.gz"
|
|
log "Statisches Binary $TB …"
|
|
TMP="$(mktemp -d)"
|
|
curl -fsSL "https://dl.influxdata.com/telegraf/releases/$TB" -o "$TMP/t.tgz"
|
|
tar -xzf "$TMP/t.tgz" -C "$TMP"
|
|
install -m 0755 "$TMP"/telegraf-*/usr/bin/telegraf /usr/local/bin/telegraf
|
|
rm -rf "$TMP"
|
|
id telegraf >/dev/null 2>&1 || useradd -r -s /usr/sbin/nologin -d /etc/telegraf telegraf 2>/dev/null || adduser -S -D -H -s /sbin/nologin telegraf
|
|
if command -v rc-update >/dev/null; then
|
|
cat > /etc/init.d/telegraf <<'EOF'
|
|
#!/sbin/openrc-run
|
|
description="Telegraf"
|
|
command=/usr/local/bin/telegraf
|
|
command_args="--config /etc/telegraf/telegraf.conf --config-directory /etc/telegraf/telegraf.d"
|
|
command_user=telegraf
|
|
command_background=true
|
|
pidfile=/run/telegraf.pid
|
|
start_pre() { set -a; [ -r /etc/default/telegraf ] && . /etc/default/telegraf; set +a; }
|
|
depend() { need net; }
|
|
EOF
|
|
chmod +x /etc/init.d/telegraf
|
|
return
|
|
fi
|
|
mkdir -p /etc/systemd/system
|
|
cat > /etc/systemd/system/telegraf.service <<'EOF'
|
|
[Unit]
|
|
Description=Telegraf
|
|
After=network-online.target
|
|
Wants=network-online.target
|
|
[Service]
|
|
User=telegraf
|
|
EnvironmentFile=-/etc/default/telegraf
|
|
ExecStart=/usr/local/bin/telegraf --config /etc/telegraf/telegraf.conf --config-directory /etc/telegraf/telegraf.d
|
|
Restart=on-failure
|
|
RestartSec=5s
|
|
[Install]
|
|
WantedBy=multi-user.target
|
|
EOF
|
|
}
|
|
|
|
if command -v telegraf >/dev/null 2>&1 || [ -x /usr/local/bin/telegraf ]; then
|
|
log "Telegraf bereits installiert ($(telegraf --version 2>/dev/null || /usr/local/bin/telegraf --version))."
|
|
else
|
|
case "$OS_ID" in
|
|
debian|ubuntu|raspbian|linuxmint|pop) install_apt ;;
|
|
rhel|centos|rocky|almalinux|fedora|ol) install_rpm ;;
|
|
alpine) apk add --no-cache -q curl ca-certificates; install_static ;;
|
|
*) if command -v apt-get >/dev/null; then install_apt
|
|
elif command -v dnf >/dev/null || command -v yum >/dev/null; then install_rpm
|
|
else install_static; fi ;;
|
|
esac
|
|
fi
|
|
|
|
# --------------------------------------------------------------------------
|
|
# Konfiguration
|
|
# --------------------------------------------------------------------------
|
|
# Proxmox-Parameter VOR dem Schreiben der Konfiguration ermitteln
|
|
if [ "$ROLE" = "proxmox" ]; then
|
|
[ -n "$PVE_NODE" ] || PVE_NODE="$(pvesh get /nodes --output-format json 2>/dev/null | sed -n 's/.*"node":"\([^"]*\)".*/\1/p' | head -1)"
|
|
[ -n "$PVE_NODE" ] || PVE_NODE="$NODE_NAME"
|
|
[ -n "$PVE_URL" ] || PVE_URL="https://127.0.0.1:8006/api2/json"
|
|
log "Proxmox: node_name=$PVE_NODE base_url=$PVE_URL"
|
|
fi
|
|
|
|
mkdir -p /etc/telegraf/telegraf.d /etc/default
|
|
umask 077
|
|
cat > /etc/default/telegraf <<EOF
|
|
NODE_NAME=$NODE_NAME
|
|
COLLECTOR=${COLLECTOR:-}
|
|
PROM_URL=$PROM_URL
|
|
LOKI_URL=$LOKI_URL
|
|
TELEGRAF_TOKEN=$TELEGRAF_TOKEN
|
|
PVE_TOKEN=$PVE_TOKEN
|
|
PVE_NODE=$PVE_NODE
|
|
PVE_URL=$PVE_URL
|
|
APACHE_LOG=$APACHE_LOG
|
|
EOF
|
|
umask 022
|
|
|
|
fetch() { curl -fsSL "$REPO_RAW/$1" -o "$2" || die "Download $1 fehlgeschlagen."; }
|
|
|
|
# Holt eine Conf und ersetzt ${...}-Platzhalter aus /etc/default/telegraf.
|
|
fetch_conf() {
|
|
fetch "$1" "$2.tmp"
|
|
set -a; [ -r /etc/default/telegraf ] && . /etc/default/telegraf; set +a
|
|
envsubst '${NODE_NAME} ${PVE_TOKEN} ${PVE_NODE} ${PVE_URL} ${APACHE_LOG}' < "$2.tmp" > "$2"
|
|
rm -f "$2.tmp"
|
|
}
|
|
fetch telegraf/base.conf /etc/telegraf/telegraf.conf
|
|
rm -f /etc/telegraf/telegraf.d/*.conf
|
|
[ "$HAS_DOCKER" -eq 1 ] && { fetch telegraf/docker.conf /etc/telegraf/telegraf.d/docker.conf; usermod -aG docker telegraf 2>/dev/null || true; }
|
|
case "$ROLE" in
|
|
proxmox) [ -n "$PVE_TOKEN" ] || log "HINWEIS: --pve-token fehlt; VM/CT-Metriken bleiben aus. Token anlegen: pveum user token add telegraf@pve monitoring -privsep 1 && pveum acl modify / -token 'telegraf@pve!monitoring' -role PVEAuditor"
|
|
fetch_conf telegraf/proxmox.conf /etc/telegraf/telegraf.d/proxmox.conf ;;
|
|
apache) fetch_conf telegraf/apache.conf /etc/telegraf/telegraf.d/apache.conf; usermod -aG adm telegraf 2>/dev/null || true ;;
|
|
docker|none) ;;
|
|
*) die "Unbekannte Rolle: $ROLE" ;;
|
|
esac
|
|
[ "$HAS_APACHE" -eq 1 ] && [ "$ROLE" != "apache" ] && { fetch_conf telegraf/apache.conf /etc/telegraf/telegraf.d/apache.conf; usermod -aG adm telegraf 2>/dev/null || true; }
|
|
|
|
# --- GPU (nur wenn erkannt) ---
|
|
# Jeder Block wird NUR geschrieben, wenn das jeweilige Werkzeug wirklich da ist.
|
|
# Ein Input ohne Binary laesst Telegraf beim Start hart scheitern -> alle Metriken aus.
|
|
case "$GPU" in
|
|
nvidia)
|
|
cat > /etc/telegraf/telegraf.d/gpu.conf <<'EOF'
|
|
[[inputs.nvidia_smi]]
|
|
timeout = "10s"
|
|
[inputs.nvidia_smi.tagdrop]
|
|
compute_mode = ["*"]
|
|
EOF
|
|
log "NVIDIA-GPU erkannt: inputs.nvidia_smi aktiv."
|
|
;;
|
|
amd)
|
|
fetch scripts/gpu-rocm.sh /etc/telegraf/gpu-rocm.sh
|
|
chmod 0755 /etc/telegraf/gpu-rocm.sh
|
|
# KEIN name_override: das Script liefert die Metriknamen selbst
|
|
# (gpu_utilization_gpu, gpu_temperature_edge, ...). name_override wuerde
|
|
# alle Werte zu "gpu" kollabieren -> in Prometheus nur noch gpu_value.
|
|
# data_format = prometheus: mit "influx" haengt Telegraf "_value" an den Namen.
|
|
cat > /etc/telegraf/telegraf.d/gpu.conf <<'EOF'
|
|
[[inputs.exec]]
|
|
interval = "30s"
|
|
timeout = "20s"
|
|
data_format = "prometheus"
|
|
commands = ["/etc/telegraf/gpu-rocm.sh"]
|
|
EOF
|
|
log "AMD-GPU erkannt: rocm-smi-exec-Input aktiv."
|
|
;;
|
|
intel)
|
|
# Bewusst KEIN GPU-Input: intel_gpu_top liefert kein Prometheus/Influx-Format
|
|
# und ein nvidia_smi-Block ohne nvidia-smi wuerde Telegraf killen.
|
|
log "Intel-GPU (/dev/dri) erkannt: kein GPU-Input aktiviert (intel_gpu_top wird nicht erfasst)."
|
|
;;
|
|
*) : ;;
|
|
esac
|
|
chown -R telegraf:telegraf /etc/telegraf 2>/dev/null || true
|
|
|
|
# Konfig testen
|
|
TG="$(command -v telegraf || echo /usr/local/bin/telegraf)"
|
|
set -a; . /etc/default/telegraf; set +a
|
|
"$TG" --config /etc/telegraf/telegraf.conf --config-directory /etc/telegraf/telegraf.d --test --input-filter cpu:mem >/dev/null 2>&1 || die "Konfiguration ungültig — telegraf --test prüfen."
|
|
|
|
# --------------------------------------------------------------------------
|
|
# Dienst
|
|
# --------------------------------------------------------------------------
|
|
if command -v systemctl >/dev/null && [ -d /run/systemd/system ]; then
|
|
systemctl daemon-reload
|
|
systemctl enable --now telegraf >/dev/null
|
|
systemctl restart telegraf
|
|
sleep 3
|
|
if ! systemctl is-active --quiet telegraf; then
|
|
journalctl -u telegraf -n 20 --no-pager
|
|
# Haeufigste Ursache: ein aktivierter Input, dessen Binary fehlt
|
|
# (z.B. nvidia_smi ohne nvidia-smi). GPU-Conf verwerfen und erneut versuchen.
|
|
if [ -f /etc/telegraf/telegraf.d/gpu.conf ]; then
|
|
log "Start fehlgeschlagen — entferne GPU-Conf und versuche erneut."
|
|
rm -f /etc/telegraf/telegraf.d/gpu.conf
|
|
systemctl reset-failed telegraf 2>/dev/null || true
|
|
systemctl restart telegraf
|
|
sleep 3
|
|
fi
|
|
systemctl is-active --quiet telegraf || die "telegraf läuft nicht. journalctl -u telegraf -n 30 prüfen."
|
|
log "WARNUNG: Telegraf läuft, aber ohne GPU-Metriken (Input-Binary fehlte)."
|
|
fi
|
|
elif command -v systemctl >/dev/null; then
|
|
log "HINWEIS: systemd nicht aktiv (Container/Chroot) — Dienst wird beim nächsten Boot gestartet (enabled)."
|
|
systemctl enable telegraf >/dev/null 2>&1 || true
|
|
elif command -v rc-update >/dev/null; then
|
|
rc-update add telegraf default >/dev/null 2>&1 || true
|
|
rc-service telegraf restart >/dev/null 2>&1 || log "HINWEIS: OpenRC nicht aktiv (Container?) — Dienst beim nächsten Boot."
|
|
fi
|
|
|
|
PROM_BASE="$(printf '%s' "$PROM_URL" | sed -E 's#/api/v1/write/?$##')"
|
|
[ "$GPU" != "none" ] && log "GPU=$GPU erfasst. Hinweis: im Docker-Betrieb muss der GPU-Treiber im Container verfuegbar sein (nvidia-container-toolkit bzw. /dev/dri-Mount); im systemd-Betrieb ist das automatisch der Fall."
|
|
|
|
log "OK — Node '$NODE_NAME' liefert an $PROM_URL (Metriken) und $LOKI_URL (Logs)."
|
|
log "Prüfen: curl -s -H 'Authorization: Bearer <TOKEN>' '$PROM_BASE/api/v1/query?query=system_uptime{node=\"$NODE_NAME\"}'"
|
|
log "Grafana: http://100.83.134.46:3000 (nur im NetBird)"
|