commit 04f64287d60c25b019630c77a29644ee99924a9c
parent 7147e9d3080aacf5b692c2307a32233828d276b3
Author: MTRNord <mtrnord1@gmail.com>
Date: Tue, 6 Jun 2023 19:39:38 +0200
Fix smtp
Diffstat:
3 files changed, 323 insertions(+), 336 deletions(-)
diff --git a/apps/base/kube-prometheus-stack/release.yaml b/apps/base/kube-prometheus-stack/release.yaml
@@ -1,183 +1,161 @@
apiVersion: helm.toolkit.fluxcd.io/v2beta1
kind: HelmRelease
metadata:
- name: kube-prometheus
- namespace: monitoring
+ name: kube-prometheus
+ namespace: monitoring
spec:
- interval: 5m
- chart:
- spec:
- version: 46.6.x
- chart: kube-prometheus-stack
- sourceRef:
- kind: HelmRepository
- name: prometheus-community
- interval: 60m
- install:
- crds: Create
- upgrade:
- crds: CreateReplace
- # Force recreation due to Helm not properly patching Deployment with e.g. added port,
- # causing spurious drift detection
- force: true
- # https://github.com/prometheus-community/helm-charts/blob/main/charts/kube-prometheus-stack/values.yaml
- values:
+ interval: 5m
+ chart:
+ spec:
+ version: "46.6.x"
+ chart: kube-prometheus-stack
+ sourceRef:
+ kind: HelmRepository
+ name: prometheus-community
+ interval: 60m
+ install:
+ crds: Create
+ upgrade:
+ crds: CreateReplace
+ # Force recreation due to Helm not properly patching Deployment with e.g. added port,
+ # causing spurious drift detection
+ force: true
+ # https://github.com/prometheus-community/helm-charts/blob/main/charts/kube-prometheus-stack/values.yaml
+ values:
+ prometheus:
+ prometheusSpec:
+ podMonitorSelectorNilUsesHelmValues: false
+ serviceMonitorSelectorNilUsesHelmValues: false
+ storageSpec:
+ volumeClaimTemplate:
+ spec:
+ storageClassName: nfs-client
+ accessModes: ["ReadWriteOnce"]
+ resources:
+ requests:
+ storage: 50Gi
+ selector: {}
+ alertmanager:
+ alertmanagerSpec:
+ useExistingSecret: true
+ namespaceOverride: monitoring
+ grafana:
+ smtp:
+ existingSecret: "smtp-auth-secret"
+ extraSecretMounts:
+ - name: auth-generic-oauth-secret-mount
+ secretName: auth-generic-oauth-secret
+ defaultMode: 0440
+ mountPath: /etc/secrets/auth_generic_oauth
+ readOnly: true
+ defaultDashboardsTimezone: Europe/Berlin
+ dashboardProviders:
+ dashboardproviders.yaml:
+ apiVersion: 1
+ providers:
+ - name: "monitoring"
+ orgId: 1
+ folder: "Monitoring"
+ type: file
+ disableDeletion: true
+ editable: false
+ updateIntervalSeconds: 10
+ allowUiUpdates: false
+ options:
+ path: /var/lib/grafana/dashboards/monitoring
+ - name: "matrix"
+ orgId: 1
+ folder: "Matrix"
+ type: file
+ disableDeletion: true
+ editable: false
+ updateIntervalSeconds: 10
+ allowUiUpdates: false
+ options:
+ path: /var/lib/grafana/dashboards/matrix
+ - name: "nats"
+ orgId: 1
+ folder: "Nats"
+ type: file
+ disableDeletion: true
+ editable: false
+ updateIntervalSeconds: 10
+ allowUiUpdates: false
+ options:
+ path: /var/lib/grafana/dashboards/nats
+ dashboards:
+ monitoring:
+ felix-dashboard:
+ url: https://git.nordgedanken.dev/kubernetes/grafana/raw/branch/main/felix-dashboard.json
+ typha-dashboard:
+ url: https://git.nordgedanken.dev/kubernetes/grafana/raw/branch/main/typha-dashboard.json
+ cilium-dashboard:
+ url: https://raw.githubusercontent.com/cilium/cilium/v1.13.1/examples/kubernetes/addons/prometheus/files/grafana-dashboards/cilium-dashboard.json
+ cilium-operator-dashboard:
+ url: https://raw.githubusercontent.com/cilium/cilium/v1.13.1/examples/kubernetes/addons/prometheus/files/grafana-dashboards/cilium-operator-dashboard.json
+ hubble-dashboard:
+ url: https://raw.githubusercontent.com/cilium/cilium/v1.13.1/examples/kubernetes/addons/prometheus/files/grafana-dashboards/hubble-dashboard.json
+ postgres-dashboard:
+ url: https://raw.githubusercontent.com/prometheus-community/postgres_exporter/master/postgres_mixin/dashboards/postgres-overview.json
+ kube-router-dashboard:
+ url: https://raw.githubusercontent.com/cloudnativelabs/kube-router/master/dashboard/kube-router.json
+ nats:
+ nats-jetstream:
+ url: https://git.nordgedanken.dev/kubernetes/grafana/raw/branch/main/nats.json
+ matrix:
+ synapse-dashboard:
+ url: https://git.nordgedanken.dev/kubernetes/grafana/raw/branch/main/synapse.json
+ dendrite-dashboard:
+ url: https://git.nordgedanken.dev/kubernetes/grafana/raw/branch/main/dendrite.json
+ matrix-media-repo-dashboard:
+ url: https://git.nordgedanken.dev/kubernetes/grafana/raw/branch/main/matrix-media-repo.json
+ grafana.ini:
smtp:
- existingSecret: smtp-auth-secret
- prometheus:
- prometheusSpec:
- podMonitorSelectorNilUsesHelmValues: false
- serviceMonitorSelectorNilUsesHelmValues: false
- storageSpec:
- volumeClaimTemplate:
- spec:
- storageClassName: nfs-client
- accessModes:
- - ReadWriteOnce
- resources:
- requests:
- storage: 50Gi
- selector: {}
- alertmanager:
- alertmanagerSpec:
- useExistingSecret: true
- namespaceOverride: monitoring
- grafana:
- extraSecretMounts:
- - name: auth-generic-oauth-secret-mount
- secretName: auth-generic-oauth-secret
- defaultMode: 288
- mountPath: /etc/secrets/auth_generic_oauth
- readOnly: true
- defaultDashboardsTimezone: Europe/Berlin
- dashboardProviders:
- dashboardproviders.yaml:
- apiVersion: 1
- providers:
- - name: monitoring
- orgId: 1
- folder: Monitoring
- type: file
- disableDeletion: true
- editable: false
- updateIntervalSeconds: 10
- allowUiUpdates: false
- options:
- path: /var/lib/grafana/dashboards/monitoring
- - name: matrix
- orgId: 1
- folder: Matrix
- type: file
- disableDeletion: true
- editable: false
- updateIntervalSeconds: 10
- allowUiUpdates: false
- options:
- path: /var/lib/grafana/dashboards/matrix
- - name: nats
- orgId: 1
- folder: Nats
- type: file
- disableDeletion: true
- editable: false
- updateIntervalSeconds: 10
- allowUiUpdates: false
- options:
- path: /var/lib/grafana/dashboards/nats
- dashboards:
- monitoring:
- felix-dashboard:
- url: https://git.nordgedanken.dev/kubernetes/grafana/raw/branch/main/felix-dashboard.json
- typha-dashboard:
- url: https://git.nordgedanken.dev/kubernetes/grafana/raw/branch/main/typha-dashboard.json
- cilium-dashboard:
- url: https://raw.githubusercontent.com/cilium/cilium/v1.13.1/examples/kubernetes/addons/prometheus/files/grafana-dashboards/cilium-dashboard.json
- cilium-operator-dashboard:
- url: https://raw.githubusercontent.com/cilium/cilium/v1.13.1/examples/kubernetes/addons/prometheus/files/grafana-dashboards/cilium-operator-dashboard.json
- hubble-dashboard:
- url: https://raw.githubusercontent.com/cilium/cilium/v1.13.1/examples/kubernetes/addons/prometheus/files/grafana-dashboards/hubble-dashboard.json
- postgres-dashboard:
- url: https://raw.githubusercontent.com/prometheus-community/postgres_exporter/master/postgres_mixin/dashboards/postgres-overview.json
- kube-router-dashboard:
- url: https://raw.githubusercontent.com/cloudnativelabs/kube-router/master/dashboard/kube-router.json
- nats:
- nats-jetstream:
- url: https://git.nordgedanken.dev/kubernetes/grafana/raw/branch/main/nats.json
- matrix:
- synapse-dashboard:
- url: https://git.nordgedanken.dev/kubernetes/grafana/raw/branch/main/synapse.json
- dendrite-dashboard:
- url: https://git.nordgedanken.dev/kubernetes/grafana/raw/branch/main/dendrite.json
- matrix-media-repo-dashboard:
- url: https://git.nordgedanken.dev/kubernetes/grafana/raw/branch/main/matrix-media-repo.json
- grafana.ini:
- smtp:
- enabled: true
- host: mail.nordgedanken.dev:465
- from_address: ops@nordgedanken.dev
- user: ops@nordgedanken.dev
- password: ENC[AES256_GCM,data:gAPdou+t52tu,iv:aKAchWRPLvmiTnGviUHz25C82yzPsAfcFPgTr30PxPo=,tag:dpFAHbVZPZrsru2k48Waow==,type:str]
- paths:
- data: ENC[AES256_GCM,data:vSfZtzoRLiR4yHioUbFrS0c=,iv:lalX2QXqhf+v5zNnzYcPxlM/LjFO7C80FMA9PN5P5uo=,tag:+TDRv7goiSdKCSBFPVoxtA==,type:str]
- logs: /var/log/grafana
- plugins: /var/lib/grafana/plugins
- provisioning: /etc/grafana/provisioning
- analytics:
- check_for_updates: true
- log:
- mode: console
- grafana_net:
- url: https://grafana.net
- auth.generic_oauth:
- enabled: true
- scopes: openid email profile roles
- name: OAuth
- allow_sign_up: true
- client_id: $__file{/etc/secrets/auth_generic_oauth/client_id}
- client_secret: $__file{/etc/secrets/auth_generic_oauth/client_secret}
- auth_url: https://keycloak.midnightthoughts.space/realms/master/protocol/openid-connect/auth
- token_url: https://keycloak.midnightthoughts.space/realms/master/protocol/openid-connect/token
- api_url: https://keycloak.midnightthoughts.space/realms/master/protocol/openid-connect/userinfo
- role_attribute_path: contains(resource_access.grafana.roles[*], 'admin') && 'Admin' || contains(resource_access.grafana.roles[*], 'editor') && 'Editor' || 'Viewer'
- imageRenderer:
- enabled: true
- kubeProxy:
- enabled: false
- postRenderers:
- - kustomize:
- patches:
- - target:
- # Ignore these objects from Flux diff as they are mutated from chart hooks
- kind: (ValidatingWebhookConfiguration|MutatingWebhookConfiguration)
- name: kube-prometheus-stack-admission
- patch: |
- - op: add
- path: /metadata/annotations/helm.toolkit.fluxcd.io~1driftDetection
- value: disabled
- - target:
- # Ignore these objects from Flux diff as they are mutated at apply time but not at dry-run time
- kind: PrometheusRule
- patch: |
- - op: add
- path: /metadata/annotations/helm.toolkit.fluxcd.io~1driftDetection
- value: disabled
-sops:
- kms: []
- gcp_kms: []
- azure_kv: []
- hc_vault: []
- age:
- - recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh
- enc: |
- -----BEGIN AGE ENCRYPTED FILE-----
- YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBYSndZNyt4bzVPZUNGZ2R1
- c2xhQmVtSnd5K2RFanJzaVNVaXdEU3ZZejFvCklqSTBiU2NXL0UyKzQxTGxrbnZo
- OWxHeEpVc2p0RGRzd1R6OFFUUnJPUDQKLS0tIE54RkxDSWs5QXZ2QWVoeFJTOFpY
- OHg4d3FycE9NWWc2WlVyS1NqUEtuNkEKjbwYqSr3FPBrPp71oYz/eKvG3QQVWXEs
- //5ic9Uw/7tR0BrA1oc6SP6jtkJ+L5KCL02ZlEi5u1PQQBL7XEEAMA==
- -----END AGE ENCRYPTED FILE-----
- lastmodified: "2023-06-06T17:30:09Z"
- mac: ENC[AES256_GCM,data:/om6L8cpAbNXVZ07J/UE90o6zexyGNmGqwxR6YpGhLBwHycyodaZT8pnYG12THR2FSbNJqIxsx4oEMJkbEvIX4pQenI9wjKYrGT+mXqHTHTR7UNctv7hVthy9Isly5tfu+vYkXc6/LQixgvSWYxVh09ziziFScLMrSWN2QL3Fmk=,iv:9ZZZ26CHmzveb3iCmh3pYXzmmZJZ2lo3juEknROKsJs=,tag:7kblnoA5KbycGjJNkh4bSg==,type:str]
- pgp: []
- encrypted_regex: ^(data|stringData|password|registration_shared_secret|shared_secret)$
- version: 3.7.3
+ enabled: true
+ host: mail.nordgedanken.dev:465
+ from_address: ops@nordgedanken.dev
+ paths:
+ data: /var/lib/grafana/
+ logs: /var/log/grafana
+ plugins: /var/lib/grafana/plugins
+ provisioning: /etc/grafana/provisioning
+ analytics:
+ check_for_updates: true
+ log:
+ mode: console
+ grafana_net:
+ url: https://grafana.net
+ auth.generic_oauth:
+ enabled: true
+ scopes: openid email profile roles
+ name: OAuth
+ allow_sign_up: true
+ client_id: $__file{/etc/secrets/auth_generic_oauth/client_id}
+ client_secret: $__file{/etc/secrets/auth_generic_oauth/client_secret}
+ auth_url: "https://keycloak.midnightthoughts.space/realms/master/protocol/openid-connect/auth"
+ token_url: "https://keycloak.midnightthoughts.space/realms/master/protocol/openid-connect/token"
+ api_url: "https://keycloak.midnightthoughts.space/realms/master/protocol/openid-connect/userinfo"
+ role_attribute_path: contains(resource_access.grafana.roles[*], 'admin') && 'Admin' || contains(resource_access.grafana.roles[*], 'editor') && 'Editor' || 'Viewer'
+ imageRenderer:
+ enabled: true
+ kubeProxy:
+ enabled: false
+
+ postRenderers:
+ - kustomize:
+ patches:
+ - target:
+ # Ignore these objects from Flux diff as they are mutated from chart hooks
+ kind: (ValidatingWebhookConfiguration|MutatingWebhookConfiguration)
+ name: kube-prometheus-stack-admission
+ patch: |
+ - op: add
+ path: /metadata/annotations/helm.toolkit.fluxcd.io~1driftDetection
+ value: disabled
+ - target:
+ # Ignore these objects from Flux diff as they are mutated at apply time but not at dry-run time
+ kind: PrometheusRule
+ patch: |
+ - op: add
+ path: /metadata/annotations/helm.toolkit.fluxcd.io~1driftDetection
+ value: disabled
diff --git a/apps/production/kube-prometheus-stack-values.yaml b/apps/production/kube-prometheus-stack-values.yaml
@@ -1,153 +1,132 @@
apiVersion: helm.toolkit.fluxcd.io/v2beta1
kind: HelmRelease
metadata:
- name: kube-prometheus
- namespace: monitoring
+ name: kube-prometheus
+ namespace: monitoring
spec:
- values:
- grafana:
- alerting:
- rules.yaml:
- apiVersion: 1
- groups:
- - orgId: 1
- name: Matrix Synapse
- folder: Matrix
- interval: 1m
- rules:
- - uid: b6db960c-c0bd-4d4f-b0f1-e1f216ec81cc
- title: DNSQueryRefusedError
- condition: C
- data:
- - refId: ENC[AES256_GCM,data:Aw==,iv:DjPjjWi/+tWAnqckw8vxJpd8WYYOrQdzSiq6pJJId+k=,tag:fzjnwSyduXv7zlyJmvD6Ig==,type:str]
- queryType: ENC[AES256_GCM,data:LycpcXY=,iv:XuxlLWjdbaRTDRwuW1smjg4ACyV0O03Kya2eboVm2jo=,tag:ZR7vMFHpDChI4ntV3M/oZA==,type:str]
- relativeTimeRange:
- from: ENC[AES256_GCM,data:Qoc1,iv:vzMqwMJtxLU3fLvc5th9cX/Jx+naKFrb0SCQ1+Dqzbc=,tag:zfQ4H1lEAIT82CI/FUqriQ==,type:int]
- to: ENC[AES256_GCM,data:4Q==,iv:K2PPZSGYjWOxIzw5Q/PL1UXxYfWkYSDqwGU+iRoN1oI=,tag:AN/JBVBF5EIepcBaPAGKSg==,type:int]
- datasourceUid: ENC[AES256_GCM,data:fUr73Q==,iv:lw5lwVbOmQC9K3Kkpi/oOvfBA5lyJSeZ95prz0T43+c=,tag:PRReq4q11YZ8c6c52iZrkA==,type:str]
- model:
- datasource:
- type: ENC[AES256_GCM,data:Nc7DIg==,iv:INDes4Htr4aKIlDFnJvTIocIzfvgSbJ23wc7F4gN3GQ=,tag:6FLCQc3q/SGJqS8hNozmjA==,type:str]
- editorMode: ENC[AES256_GCM,data:7TUsfQ==,iv:8HIqtT+m5SUVj6gMZ+Gf2JrH7UGUIFtmAAGKsTrEDLg=,tag:DYfEaNjJEp1il2ocrBH4xw==,type:str]
- expr: ENC[AES256_GCM,data:lTDvkTYzDQ34XEFNCIzt9hbjlzpxAgi7l0LbkpyEv+Te3vl/2/yBoF7rJHB2WmAn6tJc+0GWmI1Ip0NNywPZBhKJG3+H1KnKUqh+9jl5VV76jQv8oem78Cwu2kCwVDU=,iv:ZSukbDVSyNTTklRwmLMVC6BsFx9ojTPbA/RjBi2JceY=,tag:stsGimGkFjK+cf4QwlzyQg==,type:str]
- hide: ENC[AES256_GCM,data:c1QPmko=,iv:1S9P+L0e82OsHO1a4FY0u+CTiZTXtgiaSfQ7SZUFT/g=,tag:K2799ptm1Z/Cyk6lswDNrg==,type:bool]
- intervalMs: ENC[AES256_GCM,data:ZOPAIA==,iv:VwKvoXNPBga3gH3ezoEj2bXtkdvx7qfCAylxKIiFqCU=,tag:7/Ko4iOzyesKx31CfsXqbQ==,type:int]
- maxDataPoints: ENC[AES256_GCM,data:LAxdosE=,iv:4sUfCNiDnZlHDyQF/cE3+is1HzxviO3JlY9ekqFGylQ=,tag:fCoe/+WIPzYe1z7DsN/sCg==,type:int]
- queryType: ENC[AES256_GCM,data:RSeuFm8=,iv:vULn63/ANgqNGIbNo1yWBNIZNrKSDD2eNGzeK2ooSLs=,tag:6s12gp422JjA0PqLTltEXQ==,type:str]
- refId: ENC[AES256_GCM,data:8A==,iv:JBJVfL7D49f4oo0L9KYRkGye603f1b9+h92D0uyoA2I=,tag:t6et+fsxkfsmgWCQvintdA==,type:str]
- - refId: ENC[AES256_GCM,data:aA==,iv:Y5u2cMpNCtY5dMd0zIoCkp7GP6CLgsgudVnpYBIUgGE=,tag:QR92xSsFHmWuv8syAnhWig==,type:str]
- relativeTimeRange:
- from: ENC[AES256_GCM,data:S3Kr,iv:4qfOfDsWR/Fgz34x0fkLoU/8gilerzqdj6HFQNSff3g=,tag:MVev06A1h1/BnHZ9bpjPTQ==,type:int]
- to: ENC[AES256_GCM,data:Hg==,iv:uvgNQNZLlgIQ9qquLXWB5RF+1f1v+OxoCo+ohsT1AiY=,tag:pEnXlQ8VtRV+X4mSoF1udw==,type:int]
- datasourceUid: ENC[AES256_GCM,data:U4pUzUqUXb4=,iv:+9yDt6o8RI+6XkoO59pyr5jDUcTecqoEZF52wSFcZXE=,tag:U9Fg9jPU9EEaZkchV5EbdQ==,type:str]
- model:
- conditions:
- - evaluator:
- params: []
- type: ENC[AES256_GCM,data:z+g=,iv:SwemC2oSV9BWQWxC3ser3v6UA2zyQUQz9LPANhfiO28=,tag:hjyaSZ0SIxAWbEPK/P3wZw==,type:str]
- operator:
- type: ENC[AES256_GCM,data:/Q8t,iv:nRNUdojW2id3ZoG0XL18dCxhQouEAiu+S/MWiZ0cxsI=,tag:xSiIsqd6tbhqj28tx5cgzA==,type:str]
- query:
- params:
- - ENC[AES256_GCM,data:aw==,iv:8y3tP/HYyu/78J76VnNRiAxuH+7NBEZyLVT0xb0xy/I=,tag:nYMritqps37n9IA0w6hBhQ==,type:str]
- reducer:
- params: []
- type: ENC[AES256_GCM,data:3d1ykg==,iv:KteG2/4YX0bUXuHsTYR+fLm3lnkSIg2ty9n1C2v1ye0=,tag:ABfPqyeG3oM/ZxxOLBzw1w==,type:str]
- type: ENC[AES256_GCM,data:08gtcZE=,iv:iqTPfVl14cwbZfN0Jg6GHR7ksjT+9pq7XHXA29l4Gts=,tag:oKXmAvW6zcmlf6O5VGJYow==,type:str]
- datasource:
- type: ENC[AES256_GCM,data:tM5kX0wE1v8=,iv:P13tE8f/eChhBXdbR/aArh9ZnV/HRu8GfokeLKfyVNI=,tag:sjE2UliQw10/uDdww0qMlg==,type:str]
- uid: ENC[AES256_GCM,data:xVEkH/2B2wk=,iv:OrZjP5tIipyyPF48YJpPhjkMvdU9s2Nb6x6VdgOJM8k=,tag:/kdT6atbzSHQRVv9xlQhwQ==,type:str]
- expression: ENC[AES256_GCM,data:Ew==,iv:zp4CBRftlMg526zBDIM4FfdMoUNecbiOz+4jhJMGJTU=,tag:o3dteXOx8M209PvR6qkctg==,type:str]
- hide: ENC[AES256_GCM,data:baNu47k=,iv:kTAo4WNt+6zk61KdfnF8ymKjsYFtAeCOCZbaVW6r/ZU=,tag:7D5n12YXTi/BYd2v0b6NQw==,type:bool]
- intervalMs: ENC[AES256_GCM,data:ynSRpA==,iv:WlrZ4QpdV8Y1TOUVVaaTceRYKln+1GbuoQlI/tjzhoE=,tag:LqnqJBwh4brbttv/Nn7j9w==,type:int]
- maxDataPoints: ENC[AES256_GCM,data:SmmppsI=,iv:RhLA2I73gvTejgiisS7AnYcJyI8idlkmvxeuNbuVyJ0=,tag:erf60mtOuWJQAD7AC+kbdQ==,type:int]
- reducer: ENC[AES256_GCM,data:gMY2xA==,iv:ZaLc/8fr4SXa9/QSJMJyKsWyP79qvzfzxz9l6WObdRA=,tag:o8n7lUAMywNS6cwR7AKUOw==,type:str]
- refId: ENC[AES256_GCM,data:eA==,iv:9IJCn96ehOPVbNZagTtqVhOhreq2rKpPd6pk0BhXRjg=,tag:Uy6s3NvIwjLx5dPTopX2jw==,type:str]
- type: ENC[AES256_GCM,data:uNprZPT+,iv:YLVfF/z7CFSNoUCF+wDhSm3AOpJ2Hr4jWneV2IU/fsg=,tag:rxZD1BDWHiJ/NaZCX0JLSA==,type:str]
- - refId: ENC[AES256_GCM,data:dA==,iv:6N0vROYbzeTQV8SZIzkAk7trx0ckUVIStynazcPaxe4=,tag:iH9hgLlsEuI9Gf1zeCrk3g==,type:str]
- relativeTimeRange:
- from: ENC[AES256_GCM,data:98U+,iv:boHV4ISg32pb/xb6AKp2UEGyTUYY8U3h5moYHoJZFQo=,tag:LqjkRTk/9I7UreUSQKf9EA==,type:int]
- to: ENC[AES256_GCM,data:Jg==,iv:kvawlqhlS+kqQ6uQFw64R7pbgTRfqy1iONy7RoBHCEY=,tag:suNlkISSeXFLiOwZmAwyxw==,type:int]
- datasourceUid: ENC[AES256_GCM,data:YwRiaGbRaLQ=,iv:pJfKr5Z5tS3jXxPcQo6un7xBa3I1w2IarvlZmV1BjPs=,tag:kFMojst5/l+AstUxnQv1Dw==,type:str]
- model:
- conditions:
- - evaluator:
- params:
- - ENC[AES256_GCM,data:Fg==,iv:tgz19yWwOgZ+877mM0MY0lbvpxuEeZ7DRTA6uNCIuO8=,tag:v32TZrM8+b5orkJ6cvXFlw==,type:int]
- type: ENC[AES256_GCM,data:Vnk=,iv:mo7PF5LM4xR6Y8cvro69vGYroJkoXh6snON9xl3ZDps=,tag:R2KrYP9TSGd8obKtwf29Aw==,type:str]
- operator:
- type: ENC[AES256_GCM,data:8kWL,iv:fe6yy0hog1CoV6V8SakWKnYpNzzubF7P+zBwrCliLAY=,tag:UIuNMxwj3qk/qfib0p71zg==,type:str]
- query:
- params:
- - ENC[AES256_GCM,data:zw==,iv:bnKboMKbvpnpx0KV7kag+RH4vlcTxImUf0YfWSALhXc=,tag:Eereg4zc7dkyf6t10ZjRVw==,type:str]
- reducer:
- params: []
- type: ENC[AES256_GCM,data:6IfEXg==,iv:TVXLsKeud7dBRG6mqX36khXRX0y+FAGDhRUut01tgnM=,tag:RNRpTJ5GNKuBJS/CV0z0Ng==,type:str]
- type: ENC[AES256_GCM,data:nei4c9Q=,iv:irbGp8seW3csOp+3psKgnjkBnbIKFQeIVXnGULwdQPk=,tag:gXPDQyMo/DunuNSe/E7Lyw==,type:str]
- datasource:
- type: ENC[AES256_GCM,data:RqToCRrv7Ho=,iv:S3GLXwk0DG23RxuSdf/7UCv7WdHE2LL4oMQy1XndNyo=,tag:6FH+oN8v3NwzTadN3RQ+iA==,type:str]
- uid: ENC[AES256_GCM,data:IaF85Tdl9kc=,iv:B+q1VL/FHbPKxWaN40+nWhyarVkt05dJF2uDycb3hqw=,tag:msb/XGbZM6slImPXaO8lGg==,type:str]
- expression: ENC[AES256_GCM,data:SA==,iv:wxhbpIQuJWvowsNFb2La0c58QtDXhWypVmMDEYGqIro=,tag:QNeIhhKppmAC84Z/wNLujg==,type:str]
- hide: ENC[AES256_GCM,data:QlLQxOI=,iv:hpEvuR9uQTGaNe45E0VePiXQKsxQ2q+RgZRDthke+a4=,tag:huvFJoe5Yq5WNMV45fjHNw==,type:bool]
- intervalMs: ENC[AES256_GCM,data:5rHVBw==,iv:kvs5FFAGN+g+/fauIJLxyBzJzMsZbm1W8flhxfVvYt8=,tag:NsSQlIC4EunQOsrhkcGanA==,type:int]
- maxDataPoints: ENC[AES256_GCM,data:Wt20YFo=,iv:H7VAjOzE4liNwtLv6jAWyBhwy8xJI1tMwW5MyAtHNJg=,tag:FtOzQEe2EqKPguYc5KfaLA==,type:int]
- refId: ENC[AES256_GCM,data:lw==,iv:byvupRo/+R1ooMNmJghKuB1nGyng7dKRjjp8Z4FepRE=,tag:Z0fkmyeySfMHA18QtF4lWQ==,type:str]
- type: ENC[AES256_GCM,data:Nh3k5oBXebce,iv:x22JfY0MCeRUNpmxkoPiyymRaLX27RN+0z4ErjVF74Y=,tag:4hDNbJQhTbqQ/mf6VjTT2A==,type:str]
- noDataState: NoData
- execErrState: Error
- for: 5m
- annotations:
- summary: Matrix Synapse DNS Errors are higher than usual
- isPaused: false
- contactpoints.yaml:
- apiVersion: 1
- contactPoints:
- - orgId: 1
- name: MidnightThoughts Ops
- receivers:
- - uid: "1"
- name: MidnightThoughts Ops
- type: email
- sendReminder: true
- frequency: 1m
- settings:
- addresses: ops@nordgedanken.dev
- policies.yaml:
- apiVersion: 1
- policies:
- - orgId: 1
- receiver: MidnightThoughts Ops
- group_by:
- - grafana_folder
- - alertname
- ingress:
- enabled: true
- hosts:
- - grafana.midnightthoughts.space
- tls:
- - secretName: grafana.midnightthoughts.space
- hosts:
- - grafana.midnightthoughts.space
- grafana.ini:
- server:
- root_url: https://grafana.midnightthoughts.space
-sops:
- kms: []
- gcp_kms: []
- azure_kv: []
- hc_vault: []
- age:
- - recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh
- enc: |
- -----BEGIN AGE ENCRYPTED FILE-----
- YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBmTnRQUG5kN3lKbHM3RnJ0
- ZmorakFRWDVoeFF5Ym4vUy83a2VFSzlXQUdZCnduZ3pWZEJKQ1RMWXEyT09kMUlz
- NWlranRtK1JVMHg2M21nZjVaWFhGL2sKLS0tIHZVdU03T0xtcUhoK3Jzb0RNRVFx
- b1l6TEFTa0dkVDFSZE9qeTJpeGoyUWcKgIsXz5mgMNAwjesPERTZyfgOC0a8iw+o
- GfIYCI6mQnhQM61UfIsQuGFb+5L1U+jtkkAQp6jHuvh6rh8RTBC3+Q==
- -----END AGE ENCRYPTED FILE-----
- lastmodified: "2023-06-06T17:33:39Z"
- mac: ENC[AES256_GCM,data:NsBrTTw5r7OwuLeCR+7xHVWDIHgb9a6YrRfXiyqNUn+ll8qx0O5hHtHSGtNkjHel3aTGuRBmnKCid98iyOxfO23ftBLC7TP/udSzg925B0GcpOGejRL29Orj4AywM4wRvm4r8z/7bo265cv7TRXb9dXNarmEm1F1sxhi5Q+WbF8=,iv:eLOBNFVwixjq3T65qNoG7kbTBh5F/lyRcSPgzgtPFU0=,tag:1+xvg1mUuQp5bEHr71zttQ==,type:str]
- pgp: []
- encrypted_regex: ^(data|stringData|password|registration_shared_secret|shared_secret)$
- version: 3.7.3
+ values:
+ grafana:
+ alerting:
+ rules.yaml:
+ apiVersion: 1
+ groups:
+ - orgId: 1
+ name: 'Matrix Synapse'
+ folder: Matrix
+ interval: 1m
+ rules:
+ - uid: b6db960c-c0bd-4d4f-b0f1-e1f216ec81cc
+ title: DNSQueryRefusedError
+ condition: C
+ data:
+ - refId: A
+ queryType: range
+ relativeTimeRange:
+ from: 600
+ to: 0
+ datasourceUid: loki
+ model:
+ datasource:
+ type: loki
+ editorMode: code
+ expr: count(rate({namespace="matrix", app="matrix-synapse"} |= `DNSQueryRefusedError` [$__interval]))
+ hide: false
+ intervalMs: 1000
+ maxDataPoints: 43200
+ queryType: range
+ refId: A
+ - refId: B
+ relativeTimeRange:
+ from: 600
+ to: 0
+ datasourceUid: __expr__
+ model:
+ conditions:
+ - evaluator:
+ params: []
+ type: gt
+ operator:
+ type: and
+ query:
+ params:
+ - B
+ reducer:
+ params: []
+ type: last
+ type: query
+ datasource:
+ type: __expr__
+ uid: __expr__
+ expression: A
+ hide: false
+ intervalMs: 1000
+ maxDataPoints: 43200
+ reducer: mean
+ refId: B
+ type: reduce
+ - refId: C
+ relativeTimeRange:
+ from: 600
+ to: 0
+ datasourceUid: __expr__
+ model:
+ conditions:
+ - evaluator:
+ params:
+ - 1
+ type: gt
+ operator:
+ type: and
+ query:
+ params:
+ - C
+ reducer:
+ params: []
+ type: last
+ type: query
+ datasource:
+ type: __expr__
+ uid: __expr__
+ expression: B
+ hide: false
+ intervalMs: 1000
+ maxDataPoints: 43200
+ refId: C
+ type: threshold
+ noDataState: NoData
+ execErrState: Error
+ for: 5m
+ annotations:
+ summary: Matrix Synapse DNS Errors are higher than usual
+ isPaused: false
+ contactpoints.yaml:
+ apiVersion: 1
+ contactPoints:
+ - orgId: 1
+ name: 'MidnightThoughts Ops'
+ receivers:
+ - uid: '1'
+ name: 'MidnightThoughts Ops'
+ type: 'email'
+ sendReminder: true
+ frequency: '1m'
+ settings:
+ addresses: 'ops@nordgedanken.dev'
+ policies.yaml:
+ apiVersion: 1
+ policies:
+ - orgId: 1
+ receiver: 'MidnightThoughts Ops'
+ group_by: ['grafana_folder', 'alertname']
+
+ ingress:
+ enabled: true
+ hosts:
+ - grafana.midnightthoughts.space
+ tls:
+ - secretName: grafana.midnightthoughts.space
+ hosts:
+ - grafana.midnightthoughts.space
+ grafana.ini:
+ server:
+ root_url: https://grafana.midnightthoughts.space
diff --git a/apps/production/secrets/grafana-secret.yaml b/apps/production/secrets/grafana-secret.yaml
@@ -5,8 +5,8 @@ metadata:
namespace: monitoring
type: Opaque
stringData:
- client_id: ENC[AES256_GCM,data:gFeHIfKDzQ==,iv:rjlkXmKnOUrmud+UxPTMwsUqjtgD70yEBJVpGlhtlas=,tag:NYNuXTK27+7hsSmk1M5jJQ==,type:str]
- client_secret: ENC[AES256_GCM,data:n4EG8HHb2g2dgRE/q4Xz/Rp7tOOiRtRxRti06B9SEQk=,iv:ICLXIcpf5slzH8u2E9ImW4wpWm184uQg08XBBsbYOTk=,tag:d0xtAa+7EwkhDrnTiIoAvQ==,type:str]
+ client_id: ENC[AES256_GCM,data:EyQ67IpnmA==,iv:3QxEinlI1nTk8uEh5Z3sw1IpIoaHmtzocRpUAjM7hnU=,tag:JhYcixWveTJ6FYxlX0N4HA==,type:str]
+ client_secret: ENC[AES256_GCM,data:w5lWs9gkUP3b8IRuZPf278vTjrmNhYPPu4+q7otk27k=,iv:3NWbmhe2QsRnoxSk/n1EJRKFgVQE9236o98JHb41VAM=,tag:Fmo8yGKA3AnmBL/k38RnKQ==,type:str]
sops:
kms: []
gcp_kms: []
@@ -16,14 +16,44 @@ sops:
- recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh
enc: |
-----BEGIN AGE ENCRYPTED FILE-----
- YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB1VW9oNTBnZUdPTllzbmwz
- WEpteTM4TWtVM0RnMll1dnNybUloZkd6RFhNCjlkT1dTWnNVbEZLeUFzMmF6OFJR
- VkRwbStadmRNclNpZ1oyRUF1a0dnbmsKLS0tIHdEclNxQ1NMNVQvTFh5cGlPNFpn
- dzlnTE9GNXJ2SWR3alQ4cVVnTmxESFUKzelYDCWwgc5/OESQqDbXjo6TC03nWy3b
- ZZ6foRoOp+MQztv4OSU0W5ROjK036K4Mbco1sIHFcmZBucDaG7MnKQ==
+ YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSByVG9rSFlrOU84RmFzcXox
+ UkIyVllKVUMxYjB0cTJpR3pKZUQzMDh6YWlZCkRabDlTdHRlVzNqbkR1WnA5YTRS
+ Z0wrRitLc0xFbkFLYmRablJpb010MVkKLS0tIHRYb1FHZVBwQ2w0eVFNTVhvanRk
+ aDdZMFJOTXhiSkIvZUU2dnpoTm9WblkKrfpQkHFd4nLRfjb7WLu3sTBWliFw7uz+
+ lQbLZUPTeA0L5/8++VfV727amwGC/9x6IfQ+X2Ij9rAam9a69DCoIw==
-----END AGE ENCRYPTED FILE-----
- lastmodified: "2023-06-06T17:21:12Z"
- mac: ENC[AES256_GCM,data:R9cGEjsOOa1S3enF5fWOvUsEO+52cT63e2wiLjVwJ3LWDdUKGKgsYTFYJBlB+2jdDHmpAM0wsxLcrwCRMVI8iZBmq8H6oiwLhVEqOA5js9hSBb0Fy5yZJGXuiLWvBbCJWIJ+lIahMKlfb2kz2924aJv7DvhrUZPJ/CEZCllVA2c=,iv:8++4Ot2vRCqjEkgg7nj4VFu+wujbTdH/92x/oKpWzPA=,tag:mvGdbC5rrWadkiSfPGWjQA==,type:str]
+ lastmodified: "2023-06-06T17:38:36Z"
+ mac: ENC[AES256_GCM,data:fopWSWdfsKi+GI+3q8mGqqmhZ2Qw3Ng4N0TFvSd3QcgeIeACPAbKbe8yjD1GKSV2dgelvKTJKhm5Pww3D/84gYaACtjHD33l0RiPMiYhmdOaRRc62FvCCEDpE3PwTnBnOYCD+WspHLAZxteCsDWVKPKX0kvXqcGy3wzTmNV39B4=,iv:Uj33IAzJFN/q2sav5hwkrHTNRco153AM4XQdgUKRIlw=,tag:aaXkcz0fm4G6+0wKV3ooRQ==,type:str]
+ pgp: []
+ encrypted_regex: ^(data|stringData|password|registration_shared_secret|shared_secret)$
+ version: 3.7.3
+---
+apiVersion: v1
+kind: Secret
+metadata:
+ name: smtp-auth-secret
+ namespace: monitoring
+type: Opaque
+stringData:
+ user: ENC[AES256_GCM,data:VT9tWLxsn8Oven8OJ1wEY4goO28=,iv:Xe+BDgf9lWgnyHTdMgJA8ZNJNsdu6f9+oth5apt+9YE=,tag:3wOHwDFfyG862jCTP7PD5w==,type:str]
+ password: ENC[AES256_GCM,data:V9aXdrpdbu4D,iv:OQrAwZly1rKN16qDG7YZoAlIo6TKt0c+FImYGTFJTp0=,tag:SoOQAtcdz+b9o4RZ3axJkA==,type:str]
+sops:
+ kms: []
+ gcp_kms: []
+ azure_kv: []
+ hc_vault: []
+ age:
+ - recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh
+ enc: |
+ -----BEGIN AGE ENCRYPTED FILE-----
+ YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSByVG9rSFlrOU84RmFzcXox
+ UkIyVllKVUMxYjB0cTJpR3pKZUQzMDh6YWlZCkRabDlTdHRlVzNqbkR1WnA5YTRS
+ Z0wrRitLc0xFbkFLYmRablJpb010MVkKLS0tIHRYb1FHZVBwQ2w0eVFNTVhvanRk
+ aDdZMFJOTXhiSkIvZUU2dnpoTm9WblkKrfpQkHFd4nLRfjb7WLu3sTBWliFw7uz+
+ lQbLZUPTeA0L5/8++VfV727amwGC/9x6IfQ+X2Ij9rAam9a69DCoIw==
+ -----END AGE ENCRYPTED FILE-----
+ lastmodified: "2023-06-06T17:38:36Z"
+ mac: ENC[AES256_GCM,data:fopWSWdfsKi+GI+3q8mGqqmhZ2Qw3Ng4N0TFvSd3QcgeIeACPAbKbe8yjD1GKSV2dgelvKTJKhm5Pww3D/84gYaACtjHD33l0RiPMiYhmdOaRRc62FvCCEDpE3PwTnBnOYCD+WspHLAZxteCsDWVKPKX0kvXqcGy3wzTmNV39B4=,iv:Uj33IAzJFN/q2sav5hwkrHTNRco153AM4XQdgUKRIlw=,tag:aaXkcz0fm4G6+0wKV3ooRQ==,type:str]
pgp: []
encrypted_regex: ^(data|stringData|password|registration_shared_secret|shared_secret)$
version: 3.7.3
