Repository navigation
feat(monitoring): manage the exporter firewall guard and keep exporters up across docker restarts - #84
Conversation
…rs up across docker restarts Embed the hand-installed rootfiles-exporter-firewall helper (same paths, chains and owner marker, so existing guards are adopted in place) behind modules.monitoring.exporter_firewall. Exporter drop-ins now order after the guard and verify their rules in ExecStartPre instead of Requires=, the guard unit only Wants docker, and the DCGM exporter and hub units are wanted by docker.service. Doctor reports coverage from the guard check and names an unmanaged guard. A runner scenario covers adoption, filtering, guard and docker restarts and fail-closed starts. Closes #83 Claude-Session: https://claude.ai/code/session_0177Zk7to4EYohgM59v4Fcj7
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
…ix scrape check under pipefail Claude-Session: https://claude.ai/code/session_0177Zk7to4EYohgM59v4Fcj7
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
rootfiles/internal/module/monitoring.go
Line 58 in 02a4a2f
Install the firewall before starting exporters
On a first apply with exporter_firewall: true and no pre-existing guard, this starts/enables node exporter or DCGM before applyExporterGuard installs either the firewall rules or the exporters' ExecStartPre drop-ins. On the intended hosts without UFW, the exporter is therefore reachable by every network peer until the hub setup and guard setup finish, which can be prolonged by Compose image pulls. Install an initial fail-closed guard and drop-ins before starting the exporters, then update it with the hub bridge afterward.
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
…unsafe helper files, back up setup units Claude-Session: https://claude.ai/code/session_0177Zk7to4EYohgM59v4Fcj7
|
Re the Codex review-body finding "Install the firewall before starting exporters": fixed in 5bfed9f. Apply now runs the guard before the exporters, and runs it again after the hub on hub hosts so a first apply still admits the bridge the hub just created. The step that starts refused exporters now only starts enabled units, so a fresh host without node exporter gets no spurious start. |
Implements #83.
modules.monitoring.exporter_firewall: trueinstalls the embeddedrootfiles-exporter-firewallhelper and its config, runssetup, and checks it withhelper check. Paths, chains and the owner marker match the hand-installed v1 template, so the 8 guarded hosts are adopted without rule changes.After=the guard plusExecStartPre=+helper verify-host(node) /verify-docker(DCGM) instead ofRequires=; the guard unitWants=docker.service.checkalso compares unit and drop-in contents.WantedBy=multi-user.target docker.service, withsystemctl reenableon change or a missing wants link.doctor: coverage from the guard check; warns about an unmanaged guard. With the option off nothing is touched.listen_address, exactly one IPv4 /32 inallow_from, an enabled exporter, default ports.exporter-firewall-scenarioruns on the runner's Docker/iptables/systemd: invalid config and dry run (AC5), v1 adoption with an unchangediptables -S(AC1), source filtering (AC2), guard unit stop and missing rules (AC4), docker stop/start (AC3).docs/releases/v0.18.0.md.Closes #83
🤖 Generated with Claude Code
https://claude.ai/code/session_0177Zk7to4EYohgM59v4Fcj7