mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-06 10:59:59 +00:00
kevinveenbirkenbachandClaude Opus 5.5
883b9c4f46
Every blackbox probe of a Tor deployment answered 404, so AppDown fired for
all deployed apps although they were up. The job built its targets from
canonical_domains_map(DOMAIN_PRIMARY), which knows no onion domain. In a Tor
deployment the vhosts answer under <sub>.<onion> only, and the front proxy
served the clearnet names from its default server.
The targets now come from lookup('domains'), the map the vhosts are built
from, and each target takes its scheme from the domain it probes instead of
from the Prometheus vhost.
Which roles are probed follows lookup('roles_with_service', 'prometheus'),
the list the role's own spec expects metrics for. It leaves out the database
roles, which have a domain in the map and no vhost, and the roles that
declare scrape: false because their vhost carries no Prometheus block.
Two roles declared more than their vhost delivers. web-svc-mirror renders a
vhost of its own with no backend behind it, and on a live stack its probe
answered 404 under the onion name as well, so it declares scrape: false now.
web-app-peertube has a backend, but its vhost template never included the
Prometheus locations. It includes them now.
The spec could not see any of this in a compose deployment. dotenv_quote
wraps PROMETHEUS_TARGET_ROLES_JSON in quotes there, JSON.parse returned a
string, the role list came out empty and the per-role test was skipped. The
value is decoded now, and the test also requires probe_success == 1 for
every role in the list.
Closes #792
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
56 lines
1.9 KiB
Django/Jinja
56 lines
1.9 KiB
Django/Jinja
server {
|
|
server_name {{ domain }};
|
|
|
|
{% include 'roles/sys-front-tls/templates/nginx_ssl_header.j2' %}
|
|
|
|
{% include 'roles/sys-front-inj-all/templates/server.conf.j2'%}
|
|
|
|
{% include 'roles/sys-svc-proxy/templates/headers/content_security_policy.conf.j2' %}
|
|
|
|
{% include 'roles/sys-svc-proxy/templates/headers/access_control_allow.conf.j2' %}
|
|
|
|
{% set location = "@html" %}
|
|
{% include 'roles/sys-svc-proxy/templates/location/html.conf.j2' %}
|
|
|
|
location / {
|
|
try_files /dev/null {{ location }};
|
|
}
|
|
|
|
location = /api/v1/videos/upload-resumable {
|
|
client_max_body_size 0;
|
|
proxy_request_buffering off;
|
|
|
|
try_files /dev/null {{ location }};
|
|
}
|
|
|
|
location ~ ^/api/v1/videos/(upload|([^/]+/studio/edit))$ {
|
|
limit_except POST HEAD { deny all; }
|
|
client_max_body_size 12G; # default is 1M
|
|
add_header X-File-Maximum-Size 8G always; # inform backend of the set value in bytes before mime-encoding (x * 1.4 >= client_max_body_size)
|
|
|
|
try_files /dev/null {{ location }};
|
|
}
|
|
|
|
location ~ ^/api/v1/(videos|video-playlists|video-channels|users/me) {
|
|
client_max_body_size 6M; # default is 1M
|
|
add_header X-File-Maximum-Size 4M always; # inform backend of the set value in bytes before mime-encoding (x * 1.4 >= client_max_body_size)
|
|
|
|
try_files /dev/null {{ location }};
|
|
}
|
|
|
|
{% set webserver_websocket_location = "@websocket" %}
|
|
{% include 'roles/sys-svc-proxy/templates/location/ws.conf.j2' %}
|
|
|
|
location /socket.io {
|
|
try_files /dev/null {{ webserver_websocket_location }};
|
|
}
|
|
|
|
location /tracker/socket {
|
|
# Exception: peers ping the tracker every 15 minutes; nginx's 60s default read timeout would close the websocket between pings
|
|
proxy_read_timeout 15m;
|
|
|
|
try_files /dev/null {{ webserver_websocket_location }};
|
|
}
|
|
|
|
{% include 'roles/web-app-prometheus/templates/nginx/locations.conf.j2' %}
|
|
} |