mirror of
https://github.com/RWejlgaard/pez-infra.git
synced 2026-10-31 19:11:03 +00:00
Rasmus "Pez" Wejlgaard
7683f8c7ea
* Install Grafana Alloy from Ansible (PESO-158) copenhagen-a came back from its Proxmox repave with no Alloy at all, so it's been unmonitored since. Nothing in this repo installs Alloy — every host got it from Grafana's onboarding one-liner, and the common role only bolted on a resilience drop-in if the unit already happened to exist. A rebuild silently loses monitoring. New alloy role owns the whole thing: the Grafana apt repo, the package, the config, the credentials drop-in and the resilience override. Runs on every host, so this can't happen again on the next repave. Moved the resilience drop-in out of common into the role that owns Alloy. The rendered config is byte-identical to what's on the hosts today apart from the managed-by header, so the only effect on the healthy hosts is one restart. * Pin Alloy to 1.19.2-1 and add the Grafana Cloud key to SOPS Adding the apt repo means the fleet is upgradable for the first time, so pin the version explicitly rather than letting copenhagen-a come up five minor versions ahead of everyone else. All six hosts land on 1.19.2-1. Checked the 1.14 -> 1.19 changelog against what we actually run. Nothing breaking touches the bootstrap config or the fleet pipelines; the only entry that lands anywhere near us is 1.18.0 giving otelcol.receiver.otlp upstream default timeouts, which affects the Caddy tracing pipeline on helsinki-a and sets no timeouts explicitly today. |
||
|---|---|---|
| .. | ||
| hosts | ||
| architecture.md | ||
| getting-started.md | ||
| monitoring.md | ||
| networking.md | ||
| README.md | ||
| secrets.md | ||
| services.md | ||
Documentation
Everything you need to understand how this infrastructure works.
Contents
- Architecture — High-level overview, network topology, traffic flow diagrams
- Networking — Tailscale mesh, physical networking, DNS and proxy flow
- Services — Complete service map: what runs where, ports, auth
- Monitoring — Grafana Cloud, Alloy, synthetic checks, alerting via PagerDuty
- Secrets — SOPS + age encryption: setup, usage, CI integration
- Getting Started — How to work with this repo, deploy changes, add services
- Hosts — Per-host detail (hardware, services, quirks)
Quick Reference
| Host | Tailscale IP | Location | Role |
|---|---|---|---|
| helsinki-a | 100.67.6.27 | Hetzner Cloud (Helsinki) | Reverse proxy, SSO, Bitwarden, Forgejo |
| london-a | 100.122.180.98 | London | Proxmox VE hypervisor |
| london-b | 100.84.65.101 | London | Storage, media, Docker services |
| london-c | 100.123.72.87 | London | Raspberry Pi, Octopus Energy exporter |
| nuremberg-a | 100.70.180.24 | Hetzner Cloud (Nuremberg) | Mail (poste.io) |
| copenhagen-a | 100.91.240.29 | Copenhagen | Proxmox VE hypervisor |